Last Comment Bug 745452 - Infinite recursion crash with ArrayBuffer through js::ArrayBuffer::obj_lookupGeneric
: Infinite recursion crash with ArrayBuffer through js::ArrayBuffer::obj_lookup...
Status: RESOLVED FIXED
js-triage-needed [jsbugmon:update,ign...
: crash, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86_64 Linux
: -- critical (vote)
: ---
Assigned To: general
:
:
Mentors:
Depends on: 728722
Blocks: langfuzz
  Show dependency treegraph
 
Reported: 2012-04-14 08:06 PDT by Christian Holler (:decoder)
Modified: 2013-01-19 14:16 PST (History)
3 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Christian Holler (:decoder) 2012-04-14 08:06:26 PDT
The following test crashes on mozilla-central revision 55e7efcc1946 (no options required):


var o = Object.preventExtensions(new ArrayBuffer);
try { (function () { o.__proto__ = ({ __proto__: o, indexArray: ["abc"] }); })(); } catch(exc) {}
uneval(this);


Here's one cycle of the recursion that leads to the crash:

#250 0x0000000000543643 in LookupPropertyWithFlagsInline (cx=0xbaba90, obj=0x7ffff6115140, id=..., flags=1, objp=0x7fffffffc448, propp=0x7fffffffc440) at /srv/repos/mozilla-central/js/src/jsobj.cpp:4696
#251 0x00000000005437ef in js_LookupProperty (cx=0xbaba90, obj=0x7ffff6105080, id=..., objp=0x7fffffffc448, propp=0x7fffffffc440) at /srv/repos/mozilla-central/js/src/jsobj.cpp:4731
#252 0x00000000004078f1 in JSObject::lookupGeneric (this=0x7ffff6105080, cx=0xbaba90, id=..., objp=0x7fffffffc448, propp=0x7fffffffc440) at ../../jsobjinlines.h:1019
#253 0x00000000005cc241 in js::ArrayBuffer::obj_lookupGeneric (cx=0xbaba90, obj=0x7ffff61031a0, id=..., objp=0x7fffffffc448, propp=0x7fffffffc440) at /srv/repos/mozilla-central/js/src/jstypedarray.cpp:359
#254 0x00000000004078f1 in JSObject::lookupGeneric (this=0x7ffff61031a0, cx=0xbaba90, id=..., objp=0x7fffffffc448, propp=0x7fffffffc440) at ../../jsobjinlines.h:1019
Comment 1 Gary Kwong [:gkw] [:nth10sd] 2012-04-14 11:18:11 PDT
See bug 728722.
Comment 2 Christian Holler (:decoder) 2012-08-21 10:02:42 PDT
JSBugMon: The testcase found in this bug no longer reproduces (tried revision f9a8fdb08193).
JSBugMon: Fix Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first good revision is:
changeset:   99553:7a26f7c820bd
user:        Jeff Walden
date:        Wed Jun 27 18:35:56 2012 -0700
summary:     Bug 770344 - Experiment implementing __proto__ as an accessor.  r=luke
Comment 3 Christian Holler (:decoder) 2012-08-21 10:15:05 PDT
Likely fixed by bug 728722, marking as fixed.
Comment 4 Christian Holler (:decoder) 2013-01-19 14:16:48 PST
Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/efaf8960a929

Note You need to log in before you can comment on or make changes to this bug.