196189 - NS_ERROR_OUT_OF_MEMORY nsIDOMNSHTMLDocument.writeln

Status: VERIFIED INVALID

(Core :: JavaScript Engine, defect)

Description

[Roman Neuhauser]

User-Agent:       Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3a) Gecko/20030211 Phoenix/0.5
Build Identifier: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.3a) Gecko/20030211 Phoenix/0.5

<script language="javascript">
    Object.prototype.toString = function () {
        return this.typeOf ? '[object ' + this.typeOf() + ']'
                           : this.toString();
    }
    document.writeln({});
</script>

javascript console:

Error: uncaught exception: [Exception... "Component returned failure code:
0x8007000e (NS_ERROR_OUT_OF_MEMORY) [nsIDOMNSHTMLDocument.writeln]"  nsresult:
"0x8007000e (NS_ERROR_OUT_OF_MEMORY)"  location: "JS frame ::
http://freepuppy.bellavista.cz/test/test5.html :: <TOP_LEVEL> :: line 6"  data: no]


Reproducible: Always

Steps to Reproduce:




same in 1.3a on Windows XP and Mozilla/5.0 (X11; U; FreeBSD i386; en-US;
rv:1.0.0) Gecko/20020822

Comment 1

[Roman Neuhauser]

Attachment: the snippet from the first comment

Comment 2

[Boris Zbarsky [:bzbarsky]]

What behavior were you expecting exactly?

{}.typeOf is undefined.  So your code comes down to:

Object.prototype.toString = function { return this.toString() };

which just leads to infinite recursion (and an exception gets thrown instead of
crashing; I doubt crashing is a better idea).

Comment 3

[Phil Schwartau]

Boris is right. Here is an example from the standalone JS shell:

js> Object.prototype.toString = function() {return this.toString()};

js> print({});
3: InternalError: too much recursion


That is the correct error, so I have to mark this one invalid; sorry.
Roman: perhaps you meant the |typeof| operator? If so, that would be

<script language="javascript">
    Object.prototype.toString = function ()  {
        return (typeof this) ? '[object ' + (typeof this) + ']' 
                             : this.toString();
    }
    document.writeln({});
</script>



which correctly returns '[object object]' in Mozilla -

Comment 4

[Phil Schwartau]

Roman: thank you for this report. You find interesting ideas;
we depend on contributors like you to catch the things we miss -

Comment 5

[Roman Neuhauser]

Boris: maybe a bit more friendly error message... but that would require
checking the recursion depth, and that might slow things down too much, so yeah,
I would probably retract this PR anyway.

Phil: NP, breaking stuff is fun. :)