761439 - nativeCall on non-cross-compartment wrappers leads to infinite recursion

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

The reason is that IndirectProxyHandler::nativeCall just makes the same call.  Since we have recursion checks on this path, the bug just manifests itself as a recursion error instead of a type error when you do, e.g., Data.prototype.getTime.all(window.location).  Simple fix, though.

Comment 1

[Luke Wagner [:luke]]

Attachment: fix and test

Comment 2

[Steve Fink [:sfink] [:s:]]

I'm going to guess your example test case was meant to be

  Date.prototype.getTime.apply(window.location)

In the shell, wrap(new Date).getTime() works too.

Comment 3

[Luke Wagner [:luke]]

(In reply to Steve Fink [:sfink] from comment #2)
> I'm going to guess your example test case was meant to be

Well, any non-generic method exercises the path.  I picked DataView since window.location isn't in the shell and Data tends to give temporal values :)

Comment 4

[Luke Wagner [:luke]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/807490eb9bbd

Comment 5

[Steve Fink [:sfink] [:s:]]

(In reply to Luke Wagner [:luke] from comment #3)
> (In reply to Steve Fink [:sfink] from comment #2)
> > I'm going to guess your example test case was meant to be
> 
> Well, any non-generic method exercises the path.  I picked DataView since
> window.location isn't in the shell and Data tends to give temporal values :)

I was referring to comment 0, which confused me briefly (Data, all).

Comment 6

[Luke Wagner [:luke]]

Ohh, hah, I see.

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/807490eb9bbd