624426 - Too-much-recursion crash [@ js_LookupProperty] or [@ JSID_IS_STRING] or [@ js_CheckForStringIndex]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: more information

__defineSetter__("x",Object.seal);
(eval("\
  (function(){\
    z = arguments;\
    x = z;\
    z.function::callee = []\
  })\
"))()

crashes opt js shells at js_LookupProperty on TM changeset de9053031560 without -m nor -j and crashes debug js shells at JSID_IS_STRING or js_CheckForStringIndex

Seems to be some form of recursive stack overflow.

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   51110:842ca3e81a78
user:        Dave Herman
date:        Tue Jun 15 13:32:32 2010 -0700
summary:     bug 533874, r=jimb: expose the parser as a JS API

Comment 1

[Dave Herman [:dherman]]

That's mysterious. I can't see what that patch could've had to do with this crash. I'll look into it tomorrow.

Dave

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #1)
> That's mysterious. I can't see what that patch could've had to do with this
> crash. I'll look into it tomorrow.
> 
> Dave

I re-ran autoBisect and this seems like a more plausible changeset:

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   54278:441f83a81fb8
user:        Jim Blandy
date:        Tue Sep 21 11:35:30 2010 -0700
summary:     Bug 492845: Implement Object.isSealed, Object.seal. a=jwalden, r=brendan

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fixed by bug 631219.

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   61783:13ddee17c691
user:        David Mandelin
date:        Thu Feb 03 15:11:21 2011 -0800
summary:     Bug 631219: define property instead of setting it in ArgSetter, r=brendan

Comment 4

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.