Created attachment 558046 [details] stack trace (repeating portion only) var a = ; var sort = a.sort.bind(a); a.push(sort); a.push(sort); sort(sort); Crashes with too-much-recursion through array_sort. Similar to bug 671797, which involves array extras such as array_forEach. This bug goes all the way back to the introduction of Function.prototype.bind in bug 429507.
Bug 715387 is another too-much-recursion crash involving array_sort. It's different in that it involves recursion through toString rather than through sort_compare.
Fix and test landed in bug 779215. -> RESOLVED / VERIFIED FIXED