Fix Array.prototype.toString() stackoverflow

[xBaank]

Closes #1975

[lahma]

for clarity, I think this should be ReferenceEquals(thisObject, value), the operator overloads can be a bit quirky

[xBaank]

I modified the code because Array.prototype.toString.call((c = [1, 2, 3, 4], b = [1, 2, 3, 4], b[1] = c, c[1] = b, c)) could still produce a StackOverflow. Now it checks if the array is already visited.

[lahma]

This will make join calls very costly as now every time another array is being created, or did I misunderstand?

[xBaank]

This will make join calls very costly as now every time another array is being created, or did I misunderstand?

Yes, maybe a better aproach would be to pass down the visited hashset along with thisObject and arguments so no arrays are created?

[lahma]

I haven't dug deep into this problem, but I would assume that other types would also be problematic, not just concrete JsArrays if called with different thisObject. Like objects having indexes pointing to circular references, or to interop array-like wrappers.

[lahma]

By looking at V8 code, it seems that at least following are vulnerable to cyclic behavior (V8 has safeguards):

• ArrayPrototype.join
• ArrayPrototype.toLocaleString
• TypedArrayPrototype.join
• TypedArrayPrototype.toLocaleString

[lahma]

There's ObjectTraverseStack that could probably be used for this, adding TryEnter which wouldn't throw like the Enter does (Enter would TryEnter and throw).

[lahma]

Looking good, thank you for taking the time iterating!