477327 - InternalError: too much recursion with -j (type instability, global shape changing, getter, imacros, deep-bailing)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

+++ This bug was initially created as a clone of Bug #477234 +++

function f() {
    var iters;
    var q;

    var arr = ['', '', ''];
    arr.__defineGetter__('x', function() '');

    for (iters = 0; iters < 11500; ++iters) {
        for each (q in arr)
            ;
        var a = print;
        delete print;
        print = a;
        var b = toSource;
        delete toSource;
        toSource = b;
        var c = toString;
        delete toString;
        toString = c;
    }
}
f();

produces:
  bug.js:12: InternalError: too much recursion

only with -j.  Without -j, no error.

Comment 1

[Bob Clary [:bc] (inactive)]

covered by test js1_8/regress/regress-477234.js

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #0)
> produces:
>   bug.js:12: InternalError: too much recursion
> 
> only with -j.  Without -j, no error.

Confirming only with -j on TM tip, both opt and debug. (Removing assertion keyword since the original testcase in comment #0 does not cause an assertion)

Comment 3

[Jason Orendorff [:jorendorff]]

It went away.