Crash with too much recursion in exn_toSource

VERIFIED FIXED in mozilla6

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
6 years ago
4 years ago

People

(Reporter: Jesse Ruderman, Assigned: Waldo)

Tracking

(Blocks: 1 bug, {crash, regression, testcase})

Trunk
mozilla6
crash, regression, testcase
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 526549 [details]
stack trace

var e = Error('');
e.fileName = e;
e.toSource();

--> Crash with too much recursion in exn_toSource

The first bad revision is:
changeset:   0906d9490eaf
user:        Jeff Walden
date:        Mon Mar 28 20:01:53 2011 -0700
summary:     Bug 645468 - Remove js_TryMethod: its semantics aren't what most of its users want, and its utility is limited.  r=luke

Comment 1

6 years ago
Awesome testcase.
I reproduced this once, but now I can't reproduce it for some reason, and I'm not sure why.  Is anyone else seeing this still, and if not, could someone bisect and figure out how this went away?  It's not immediately obvious to me why it would have gone away, if it did.
(Reporter)

Comment 3

6 years ago
Still crashes for me with rev 59325b2ca38b (64-bit, debug, mac). Want me to catch it in gdb for you?
Created attachment 528390 [details] [diff] [review]
Patch and test

Nope, it reproduces easily now, not sure what I was doing differently then.
Assignee: general → jwalden+bmo
Status: NEW → ASSIGNED
Attachment #528390 - Flags: review?(luke)

Comment 5

6 years ago
Comment on attachment 528390 [details] [diff] [review]
Patch and test

Review of attachment 528390 [details] [diff] [review]:

Ooh, I get to use splinter.  Unfortunately, I have no nits.
Attachment #528390 - Flags: review?(luke) → review+
Comment on attachment 528390 [details] [diff] [review]
Patch and test

Review of attachment 528390 [details] [diff] [review]:

::: js/src/tests/ecma_5/extensions/toSource-infinite-recursion.js
@@ +22,5 @@
+}
+catch (e)
+{
+  assertEq(e instanceof InternalError, true,
+           "should have thronw for over-recursion");

What do you mean, no nits? You souhld get ouyr eyes cehcked.
http://hg.mozilla.org/tracemonkey/rev/8f7cf9d0b636
OS: Mac OS X → All
Hardware: x86_64 → All
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla6
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/8f7cf9d0b636
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Comment 9

6 years ago
Mozilla/5.0 (X11; Linux i686; rv:6.0) Gecko/20100101 Firefox/6.0

Verified on WinXP, Win7 x86, Ubuntu 11.04 x86 and Mac OS X 10.6 with the steps from comment 0. 

Returned error: InternalError: too much recursion

Setting status to Verified Fixed.
Status: RESOLVED → VERIFIED
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.