STEPS TO REPRODUCE Run the following JS: var o1 = { p1: 1 }; var o2 = { p2: 2 }; o2.__proto__ = o1; var o3 = { p3: 3 }; o3.__proto__ = o2; o1.__proto__ = o3; // this hangs ACTUAL RESULTS Hang. EXPECTED RESULTS It should raise an exception "cyclic __proto__ value".
Created attachment 14427 [details] the fix
As a reproducible crasher, this should be a P1.
Fixed in r21332.
Comment on attachment 14427 [details] the fix r=me