728722 - Crash [@ js::ArrayBuffer::obj_lookupGeneric]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

JSON.__proto__[1] = Uint8ClampedArray().buffer
f = (function() {
    function g(c) {
        Object.freeze(c).__proto__ = c
    }
    for each(b in []) {
        try {
            g(b)
        } catch (e) {}
    }
})
f()
f()

crashes js 32-bit debug and opt shell on m-c changeset 24f2c7e26fbd without any CLI arguments with too much recursion at js::ArrayBuffer::obj_lookupGeneric

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   85066:8a915ca62e05
user:        Tom Schuster
date:        Sat Jan 21 19:25:54 2012 +0100
summary:     Bug 686296 - Non-extensible ArrayBuffer __proto__ should not be changable. r=jorendorff

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

On closer examination, bug 686296 might not be the only patch involved - it just turned the testcase in comment 0 from an assert into a too much recursion crash.

Comment 3

[Jesse Ruderman]

See also bug 740872.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Probably fixed by bug 770344, in any case the test was added in bug 779215. -> RESOLVED / VERIFIED FIXED

autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   99553:7a26f7c820bd
user:        Jeff Walden
date:        Wed Jun 27 18:35:56 2012 -0700
summary:     Bug 770344 - Experiment implementing __proto__ as an accessor.  r=luke