Summary: | REGRESSION: Stack overflow/crash in KJS::equal | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Alexey Proskuryakov <ap> | ||||||
Component: | JavaScriptCore | Assignee: | Darin Adler <darin> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | Keywords: | HasReduction, InRadar, Regression | ||||||
Priority: | P1 | ||||||||
Version: | 523.x (Safari 3) | ||||||||
Hardware: | Mac | ||||||||
OS: | OS X 10.4 | ||||||||
URL: | http://a88.narod.ru/ars0003.htm | ||||||||
Attachments: |
|
Description
Alexey Proskuryakov
2007-10-22 07:41:57 PDT
Created attachment 16800 [details] test case (will crash) Looks like the new limit for JS stack set in <http://trac.webkit.org/projects/webkit/changeset/25161> is too large indeed. The problem in the original page is caused by a script that accurately preserves window.onload while setting it to its own function. This script is included twice, which causes infinite recursion - must be a pretty common situation. function onLoad() { ... if (savedOnload) savedOnload(); } savedOnload = window.onload; window.onload = onLoad; Hmm, changing KJS_MAX_STACK back to 100 doesn't fix the problem for me. This doesn't have anything to do with JS stack - the infinite recursion is in native code. Crashes on the earliest known WebKit nightly (r11976) with Safari 2.0.4 (419.3) on Mac OS X 10.4.11 (8S165). Does NOT crash with Safari 2.0.4 (419.3) with original WebKit on 10.4.11. Got a fix. Created attachment 17664 [details]
patch
Comment on attachment 17664 [details]
patch
r=me
Committed revision 28370. |