684462 - Too-much-recursion through array_sort

Status: VERIFIED FIXED

Description

[Jesse Ruderman]

Created attachment 558046 [details]
stack trace (repeating portion only)

var a = [];
  var sort = a.sort.bind(a);
  a.push(sort);
  a.push(sort);
  sort(sort);

Crashes with too-much-recursion through array_sort.

Similar to bug 671797, which involves array extras such as array_forEach.

This bug goes all the way back to the introduction of Function.prototype.bind in bug 429507.

Comment 1

[Jesse Ruderman]

Bug 715387 is another too-much-recursion crash involving array_sort. It's different in that it involves recursion through toString rather than through sort_compare.

Comment 2

[Gary Kwong [:gkw] [:nth10sd]]

Fix and test landed in bug 779215. -> RESOLVED / VERIFIED FIXED