Closed Bug 328249 Opened 18 years ago Closed 18 years ago
E4X crash due to infinite recursion in js
Blake generously offered to dive between this bullet and the president, in slow-mo yelling "guuuuuuhnnnnnnnnnnnn!", or was that "eeeeeeeeeeeeeefoooooooorrrrrrrrrrrrrxxxxxxxxxxxxxxxxxxxxxxxx!"? /be
Assignee: general → mrbkap
*** Bug 328254 has been marked as a duplicate of this bug. ***
Our cycle detection wasn't handling lists, causing us to miss the "easy" case described here. Lists of length 1 are special in that you can do stuff on them that acts like you're doing it to its only element, therefore CheckCycle needs to deal. Note that we catch the case where kids->length > 1 before we ever get near the CheckCycle code.
Status: NEW → ASSIGNED
OS: MacOS X → All
Priority: -- → P1
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.9alpha
Comment on attachment 212961 [details] [diff] [review] Fix I was a collaborator on this fix, but sure, r=me. BTW, E4X sucks. /be
Fix checked into trunk.
Status: ASSIGNED → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Comment on attachment 212961 [details] [diff] [review] Fix approved for 1.8.9 branch, a=dveditz for drivers
Attachment #212961 - Flags: approval18.104.22.168? → approval22.214.171.124+
> 1.8.9 branch 1.8.0, I mean
Checking in regress-328249.js; /cvsroot/mozilla/js/tests/e4x/Regress/regress-328249.js,v <-- regress-328249.js initial revision: 1.1 done I don't see a crash in today's ff trunk on winxp, but a current debug shell does appear to crash. I'll know more when I do a full test run.
Marking [rft-dl] (ready for testing in Firefox 126.96.36.199 release candidates) since in-testsuite+ indicates a test case exists in the js test library.
Whiteboard: [patch] → [patch][rft-dl]
v ff 188.8.131.52/1.8/1.9 20060302 win/linux/mac
You need to log in before you can comment on or make changes to this bug.