816511 - A proxy of a prototypeless object causes a crash

Status: RESOLVED DUPLICATE of bug 793160

(Core :: JavaScript Engine, defect)

Description

[Jussi Kalliokoski]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/18.0 Firefox/18.0
Build ID: 20121027042012

Steps to reproduce:

Open developer tools and type in the following:

Object.prototype.__proto__ = new Proxy(Object.create(null), { get: function (tgt, name) { return name } })


Actual results:

The browser crashed.


Expected results:

I have no idea, but at least not crash. I suspect after that doing

lol + cats

would yield "lolcats", regardless of whether they're defined or not, but I'm not sure.

Comment 1

[Loic]

Could you post some crash reports from about:crashes if possible (bp-...)?

Comment 2

[Jussi Kalliokoski]

(In reply to Loic from comment #1)
> Could you post some crash reports from about:crashes if possible (bp-...)?

Sure, here you go: https://crash-stats.mozilla.com/report/index/bp-c8fe22f5-b6d4-4aeb-8b1b-7ae0d2121129

Comment 3

[Jussi Kalliokoski]

Apparently the problem manifests itself just by doing:

new Proxy(Object.create(null), { get: function () { return 'foo' } })

So it has nothing to do with global get handling.

Comment 4

[Loic]

I'm not able to enter "new Proxy(Object.create(null), { get: function () { return 'foo' } })" in the dev toolbar of Firefox 20 on Win 7.
Am I typing this line in the wrong place?

Comment 5

[Jussi Kalliokoski]

(In reply to Loic from comment #4)
> I'm not able to enter "new Proxy(Object.create(null), { get: function () {
> return 'foo' } })" in the dev toolbar of Firefox 20 on Win 7.
> Am I typing this line in the wrong place?

Sorry for being vague, I mean the JS console, Ctrl + K.

Comment 6

[Scoobidiver (away)]

(In reply to Jussi Kalliokoski from comment #2)
> https://crash-stats.mozilla.com/report/index/bp-c8fe22f5-b6d4-4aeb-8b1b-
> 7ae0d2121129
Debug symbols are missing. Can you provide a stack trace (see https://developer.mozilla.org/docs/How_to_get_a_stacktrace_for_a_bug_report#Linux)?

Comment 7

[Boris Zbarsky [:bzbarsky]]

This is bug 793160, as far as I can tell, right?  The patch hasn't landed on 18 yet, but should soon...

Comment 8

[Jussi Kalliokoski]

(In reply to Boris Zbarsky (:bz) from comment #7)
> This is bug 793160, as far as I can tell, right?  The patch hasn't landed on
> 18 yet, but should soon...

Ahh, that seems to be the case. Thanks!