Closed
Bug 566790
Opened 14 years ago
Closed 14 years ago
Too-much-recursion crash with proxies
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: jruderman, Assigned: gal)
References
Details
(Keywords: crash, testcase, Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
(deleted),
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
js> Proxy.create({get:Array.reduce}).w
Segmentation fault
...
36 js 0x0002e1bd __ZL12array_reduceP9JSContextjPl + 39
37 js 0x00014c57 js_generic_fast_native_method_dispatcher + 441
38 js 0x000a5f7f js_Invoke + 1145
39 js 0x000a696d js_InternalInvoke + 197
40 js 0x000fbb0a __ZL4TrapP9JSContextP8JSObjectP6JSAtomjPlS5_ + 108
41 js 0x000fbe9e JSProxy::get(JSContext*, JSObject*, JSObject*, long, long*) + 132
42 js 0x000fc179 __ZL17proxy_GetPropertyP9JSContextP8JSObjectlPl + 45
43 js 0x0000bddb JSObject::getProperty(JSContext*, long, long*) + 45 (jsobj.h:641)
44 js 0x0002d932 js_GetLengthProperty + 308
45 js 0x0002d9ff __ZL11array_extraP9JSContext14ArrayExtraModejPl + 69
46 js 0x0002e1bd __ZL12array_reduceP9JSContextjPl + 39
...
|
Assignee | |
Updated•14 years ago
|
OS: Mac OS X → All
Hardware: x86 → All
Summary: Too-much-recursion crash with "Proxy.create({get:Array.reduce})" → Too-much-recursion crash with proxies
|
|
Assignee | |
Comment 1•14 years ago
|
||
Assignee: general → gal
|
||
Updated•14 years ago
|
Attachment #446163 -
Flags: review+
|
|
Assignee | |
Comment 2•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/e8708576b5a6
Whiteboard: fixed-in-tracemonkey
|
||
Comment 3•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/e8708576b5a6
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•