JSObjectSetPrototype permits to set any object as prototype of any object. Lack of check if an object being added to a property chain is actually in it, could produce crashes and hangs. A small snippet: JSObjectRef object = JSObjectMake(context, /* jsClass */ 0, /* data */ 0); JSObjectSetPrototype(context, object, object); JSObjectGetProperty(context, object, invalid_property_name, /* exception*/ 0); The code should hang. I suppose to see same behavior: > a = new Object [object Object] > a.__proto__=a Exception: Error: cyclic __proto__ value > The patch is on the way...
Created attachment 57329 [details] Fix v1
Comment on attachment 57329 [details] Fix v1 r=me Nice.
Comment on attachment 57329 [details] Fix v1 Clearing flags on attachment: 57329 Committed r60390: <http://trac.webkit.org/changeset/60390>
All reviewed patches have been landed. Closing bug.