{ "id": "136188", "key": "TIMOB-17960", "fields": { "issuetype": { "id": "4", "description": "An improvement or enhancement to an existing feature or task.", "name": "Improvement", "subtask": false }, "project": { "id": "10153", "key": "TIMOB", "name": "Titanium SDK/CLI", "projectCategory": { "id": "10100", "description": "Titanium and related SDKs used in application development", "name": "Client" } }, "fixVersions": [], "resolution": null, "resolutiondate": null, "created": "2014-09-06T02:06:50.000+0000", "priority": { "name": "None", "id": "6" }, "labels": [ "TCSupportTriage" ], "versions": [ { "id": "15972", "description": "Release 3.4.0", "name": "Release 3.4.0", "archived": false, "released": true, "releaseDate": "2014-09-28" } ], "issuelinks": [], "assignee": null, "updated": "2018-02-28T20:03:37.000+0000", "status": { "description": "The issue is open and ready for the assignee to start work on it.", "name": "Open", "id": "1", "statusCategory": { "id": 2, "key": "new", "colorName": "blue-gray", "name": "To Do" } }, "components": [ { "id": "10206", "name": "iOS", "description": "iOS Platform" } ], "description": "Assigning an object with circular references to a Kroll object property overflows the stack.\r\n\r\n{code}\r\nvar label = Titanium.UI.createLabel({});\r\n\r\nvar a = {\r\n\tdummy: \"x\"\r\n};\r\n\t\r\nvar b = {\r\n\ta: a\r\n};\r\n\t\r\na.b = b;\r\n\t\r\nlabel.test = a;\r\n{code}\r\n\r\nThe bug is in TiBindingTiValueToNSDictionary / TiBindingTiValueToNSObject which will create an infinite recursion while trying to visit the object tree (which is in fact a graph).\r\n\r\nA part of the call stack:\r\n\r\n{code}\r\n...\r\n frame #2694: 0x0026209f Museo900`TiBindingTiValueToNSObject(jsContext=0x0cfcc19c, objRef=0x100edf28) + 1903 at TiBindingTiValue.m:132\r\n frame #2695: 0x0026189b Museo900`TiBindingTiValueToNSDictionary(jsContext=0x0cfcc19c, objRef=0x100edea8) + 283 at TiBindingTiValue.m:50\r\n frame #2696: 0x0026209f Museo900`TiBindingTiValueToNSObject(jsContext=0x0cfcc19c, objRef=0x100edea8) + 1903 at TiBindingTiValue.m:132\r\n frame #2697: 0x0026189b Museo900`TiBindingTiValueToNSDictionary(jsContext=0x0cfcc19c, objRef=0x100edf28) + 283 at TiBindingTiValue.m:50\r\n frame #2698: 0x0026209f Museo900`TiBindingTiValueToNSObject(jsContext=0x0cfcc19c, objRef=0x100edf28) + 1903 at TiBindingTiValue.m:132\r\n frame #2699: 0x0026189b Museo900`TiBindingTiValueToNSDictionary(jsContext=0x0cfcc19c, objRef=0x100edea8) + 283 at TiBindingTiValue.m:50\r\n frame #2700: 0x0026209f Museo900`TiBindingTiValueToNSObject(jsContext=0x0cfcc19c, objRef=0x100edea8) + 1903 at TiBindingTiValue.m:132\r\n frame #2701: 0x000310bc Museo900`TiValueToId(context=0x0caf7540, v=0x100edea8) + 60 at KrollObject.m:86\r\n frame #2702: 0x00031e41 Museo900`KrollSetProperty(jsContext=0x0fc8c110, object=0x0cfd9f90, prop=0x0fb85a10, value=0x100edea8, exception=0xb032cd6c) + 273 at KrollObject.m:280\r\n frame #2703: 0x002b6c8d Museo900`TI::TiCallbackObject::put(this=, exec=, propertyName=, value=TiValue at 0xb032cdbc, slot=) + 365 at TiCallbackObjectFunctions.h:213\r\n frame #2704: 0x002f524b Museo900`TI::Interpreter::privateExecute(TI::Interpreter::ExecutionFlag, TI::RegisterFile*, TI::TiExcState*) [inlined] TI::TiValue::put(this=0x0cfd9f90, slot=0x00000000, exec=, propertyName=0x0fb90590) + 69 at TiObject.h:812\r\n frame #2705: 0x002f5206 Museo900`TI::Interpreter::privateExecute(this=0xb032cff8, flag=Normal, registerFile=0x00000111, callFrame=0x0fc8c110) + 20790 at Interpreter.cpp:3191\r\n frame #2706: 0x002fda6b Museo900`TI::Interpreter::executeCall(this=0x0fb92b80, callFrame=, function=0x0fc8c040, callType=, callData=, thisValue=TiValue at 0xb032d904, args=) + 763 at Interpreter.cpp:965\r\n frame #2707: 0x0033fa73 Museo900`TI::call(exec=0x0cfcc19c, functionObject=TiValue at 0xb032d934, callType=CallTypeJS, callData=0xb032d970, thisValue=TiValue at 0xb032d944, args=0xb032d958) + 83 at CallData.cpp:45\r\n frame #2708: 0x002b53cc Museo900`TiObjectCallAsFunction(ctx=, object=0x100e31f0, thisObject=0x100e2578, argumentCount=, arguments=, exception=) + 492 at TiObjectRef.cpp:449\r\n frame #2709: 0x002612dc Museo900`TiBindingEventProcess(runloop=0x0caf7540, payload=0x0ca1f400) + 1356 at TiBindingEvent.m:278\r\n frame #2710: 0x002615c3 Museo900`-[TiBindingCallbackInvoke invoke:](self=0x0ca9c820, _cmd=0x00406f6c, runLoop=0x0caf7540) + 67 at TiBindingRunLoop.m:53\r\n frame #2711: 0x00029875 Museo900`-[KrollContext invoke:](self=0x0caf7540, _cmd=0x00406f6c, object=0x0ca9c820) + 213 at KrollContext.m:958\r\n frame #2712: 0x0002b2fc Museo900`-[KrollContext main](self=0x0caf7540, _cmd=0x00f893eb) + 4540 at KrollContext.m:1315\r\n frame #2713: 0x00dfb597 Foundation`-[NSThread main] + 76\r\n frame #2714: 0x00dfb4f6 Foundation`__NSThread__main__ + 1275\r\n frame #2715: 0x04ae75b7 libsystem_c.dylib`_pthread_start + 344\r\n{code}\r\n", "attachment": [], "flagged": false, "summary": "Assigning an object with circular references to a Kroll object property overflows stack (TiBindingTiValueToNSObject bug)", "creator": { "name": "s.stefanek", "key": "s.stefanek", "displayName": "Szymon Tomasz Stefanek", "active": true, "timeZone": "America/Los_Angeles" }, "subtasks": [], "reporter": { "name": "s.stefanek", "key": "s.stefanek", "displayName": "Szymon Tomasz Stefanek", "active": true, "timeZone": "America/Los_Angeles" }, "environment": "iOS\r\nTitanium 3.3.0 GA", "comment": { "comments": [], "maxResults": 2, "total": 2, "startAt": 0 } } }