Bug 6373 - REGRESSION: JavaScript hang when comparing large array to null
Summary: REGRESSION: JavaScript hang when comparing large array to null
Status: VERIFIED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Critical
Assignee: Anders Carlsson
URL: http://www.theregister.com/2005/12/20...
Keywords: InRadar
: 6399 (view as bug list)
Depends on:
Blocks:
 
Reported: 2006-01-04 07:00 PST by mitz
Modified: 2006-01-22 04:57 PST (History)
1 user (show)

See Also:


Attachments
Fix (6.17 KB, patch)
2006-01-07 02:25 PST, Anders Carlsson
mjs: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2006-01-04 07:00:35 PST
Safari hangs on the above URL. It turns out that it's looping over a huge array in a ToString operation, with 
element->isUndefinedOrNull() in array_object.cpp:467 returning true all the time.

Rolling out the changes to operations.cpp from the patch for bug 6268 fixes the problem.
Comment 1 Alice Liu 2006-01-05 14:57:23 PST
<rdar://problem/4400333>
Comment 2 Eric Seidel (no email) 2006-01-06 14:25:02 PST
*** Bug 6399 has been marked as a duplicate of this bug. ***
Comment 3 Anders Carlsson 2006-01-06 15:56:55 PST
I have a patch that fixes this
Comment 4 Anders Carlsson 2006-01-07 02:25:16 PST
Created attachment 5523 [details]
Fix

The problem was that my change to operations.cpp made checks against null
convert objects to primitives, and converting a large sparse array to a string
would simply hang the browser.
Comment 5 Maciej Stachowiak 2006-01-07 02:28:31 PST
Comment on attachment 5523 [details]
Fix

r=me
Comment 6 Joost de Valk (AlthA) 2006-01-22 04:57:18 PST
Removing keyword(s) since bug is fixed.