Bug 19185 - fast/js/toString-stack-overflow.html would crash if r34020 were not rolled out
Summary: fast/js/toString-stack-overflow.html would crash if r34020 were not rolled out
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2008-05-22 02:09 PDT by Alexey Proskuryakov
Modified: 2009-02-26 00:11 PST (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2008-05-22 02:09:55 PDT 
run-webkit-tests fast/js/toString-stack-overflow.html

Thread 0 Crashed:
0   com.apple.JavaScriptCore      	0x0039ee4c std::pair<WTF::HashTableIterator<KJS::JSObject*, KJS::JSObject*, WTF::IdentityExtractor<KJS::JSObject*>, WTF::PtrHash<KJS::JSObject*>, WTF::HashTraits<KJS::JSObject*>, WTF::HashTraits<KJS::JSObject*> >, bool> WTF::HashTable<KJS::JSObject*, KJS::JSObject*, WTF::IdentityExtractor<KJS::JSObject*>, WTF::PtrHash<KJS::JSObject*>, WTF::HashTraits<KJS::JSObject*>, WTF::HashTraits<KJS::JSObject*> >::add<KJS::JSObject*, KJS::JSObject*, WTF::IdentityHashTranslator<KJS::JSObject*, KJS::JSObject*, WTF::PtrHash<KJS::JSObject*> > >(KJS::JSObject* const&, KJS::JSObject* const&) + 8 (HashTable.h:607)
1   com.apple.JavaScriptCore      	0x0039f106 WTF::HashTable<KJS::JSObject*, KJS::JSObject*, WTF::IdentityExtractor<KJS::JSObject*>, WTF::PtrHash<KJS::JSObject*>, WTF::HashTraits<KJS::JSObject*>, WTF::HashTraits<KJS::JSObject*> >::add(KJS::JSObject* const&) + 52 (HashTable.h:306)
2   com.apple.JavaScriptCore      	0x0039f13a WTF::HashSet<KJS::JSObject*, WTF::PtrHash<KJS::JSObject*>, WTF::HashTraits<KJS::JSObject*> >::add(KJS::JSObject* const&) + 38 (HashSet.h:207)
3   com.apple.JavaScriptCore      	0x00347dba KJS::arrayProtoFuncToString(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 118 (array_object.cpp:95)
4   com.apple.JavaScriptCore      	0x0031f57a KJS::PrototypeFunction::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 34 (function.cpp:742)
5   com.apple.JavaScriptCore      	0x0031f7b5 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 123 (object.cpp:51)
6   com.apple.JavaScriptCore      	0x003253dd KJS::tryGetAndCallProperty(KJS::ExecState*, KJS::JSObject const*, KJS::Identifier const&) + 175 (object.cpp:260)
7   com.apple.JavaScriptCore      	0x00344415 KJS::JSObject::defaultValue(KJS::ExecState*, KJS::JSType) const + 145 (object.cpp:287)
8   com.apple.JavaScriptCore      	0x0037843c KJS::JSObject::toPrimitive(KJS::ExecState*, KJS::JSType) const + 38 (object.h:641)
9   com.apple.JavaScriptCore      	0x00342da4 KJS::JSObject::toString(KJS::ExecState*) const + 46 (object.cpp:498)
10  com.apple.JavaScriptCore      	0x003bb681 KJS::JSValue::toString(KJS::ExecState*) const + 89 (value.h:518)
11  com.apple.JavaScriptCore      	0x00347f1b KJS::arrayProtoFuncToString(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 471 (array_object.cpp:114)
12  com.apple.JavaScriptCore      	0x0031f57a KJS::PrototypeFunction::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 34 (function.cpp:742)
13  com.apple.JavaScriptCore      	0x0031f7b5 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 123 (object.cpp:51)
14  com.apple.JavaScriptCore      	0x003253dd KJS::tryGetAndCallProperty(KJS::ExecState*, KJS::JSObject const*, KJS::Identifier const&) + 175 (object.cpp:260)
15  com.apple.JavaScriptCore      	0x00344415 KJS::JSObject::defaultValue(KJS::ExecState*, KJS::JSType) const + 145 (object.cpp:287)
16  com.apple.JavaScriptCore      	0x0037843c KJS::JSObject::toPrimitive(KJS::ExecState*, KJS::JSType) const + 38 (object.h:641)
17  com.apple.JavaScriptCore      	0x00342da4 KJS::JSObject::toString(KJS::ExecState*) const + 46 (object.cpp:498)
18  com.apple.JavaScriptCore      	0x003bb681 KJS::JSValue::toString(KJS::ExecState*) const + 89 (value.h:518)
19  com.apple.JavaScriptCore      	0x00347f1b KJS::arrayProtoFuncToString(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 471 (array_object.cpp:114)
...

(as the title says, it's a stack overflow, so the top of your trace may be different).
Comment 1 Alexey Proskuryakov 2008-05-22 02:34:50 PDT 
Reverting r34020 (which removed old recursion protection) fixes this.
Comment 2 Alexey Proskuryakov 2008-05-22 02:36:02 PDT 
<rdar://problem/5955430>
Comment 3 Alexey Proskuryakov 2008-05-22 03:12:36 PDT 
OK, Oliver just rolled out r34020.
Comment 4 Geoffrey Garen 2008-05-22 09:58:13 PDT 
I don't think we can call this fixed, because it indicates that squirrelfish's own recursion protection doesn't work in this case.
Comment 5 Alexey Proskuryakov 2008-05-22 10:44:36 PDT 
Renaming and changing priority accordingly. This might be the first conditional bug in our Bugzilla!
Comment 6 Cameron Zwarich (cpst) 2009-02-26 00:11:19 PST 
This was made irrelevant by r34309:

http://trac.webkit.org/changeset/34309