721935 - Crash [@ js::LookupPropertyWithFlags] or [@ js_CheckForStringIndex]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

function tryItOut(code) {
    f = eval("(function(){" + code + "})")
    try {
        f()
    } catch (e) {}
}
tryItOut("x=7");
tryItOut("\"use strict\";for(d in[x=arguments]){}");
tryItOut("for(v in((Object.seal)(x)));x.length=Function")

crashes js opt shell on m-c changeset 8a59519e137e without any CLI arguments at js::LookupPropertyWithFlags and crashes js debug shell at js_CheckForStringIndex

This seems like a too much recursion crash.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fix and test landed in bug 779215. -> RESOLVED / VERIFIED FIXED