334935 - Array: methods on a long array cause system to hang (DOS)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Biju]

fix for bug 330812 solved DOS when Array(1 << 29).sort();

but other issues remained.
* unable to catch in try{} catch(e){} block
* Array also have other methods which give prob.

steps to test
1. open long_array_dos.html
2. click Input Case : 0 link
3. click test button
4. repeat for all


BTW: Even though I am not good in CS, just a question. 
For arrays having most elements empty, 
why cant we have an algorithm similar to one processing sparse metrics and save memory and processing time?

Comment 1

[Biju]

Attachment: testcase long_array_dos.html

Comment 2

[Biju]

depends on bugs
bug# 101964, - Performance: truncating arrays is slow in SpiderMonkey
bug# 171262, - Performance: improve speed of new Array creation
bug# 253325, - Array.join() on long array hangs browser for unreasonably long time
bug# 310405, - Unstoppable too long execution with Array.forEach
bug# 322135, - calling push method on array with maximum length (2^32-1 = 4294967295) causes Spidermonkey to run out of memory
bug# 322889, - Array implementation should specialize its own nearly-native JSObjectOps


related 
bug# 253138, - Array.prototype.toSource excludes non-indexed enumerable properties
bug# 260106, - elisions in array literals should not be enumed    	

dist related 
bug# 200505, - Optimization of jsref array_join_sub() function
bug# 224128, - Array.sort isn't a stable sort

Comment 3

[Igor Bukanov]

The patch for bug 310405 addresses this.

Comment 4

[Igor Bukanov]

Removal of performance-related blockers as fixing DOS issues does not require optimized array implementation.

Comment 5

[Bob Clary [:bc] (inactive)]

I'll use the test for bug 310405 for this.