UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Steps to reproduce the problem:
1. open a poc.html in chrome

What is the expected behavior?
maybe true

What went wrong?
crash occurs.

In v8, object.cc

  842 Maybe<bool> Object::IsArray(Handle<Object> object) {
  843   if (object->IsJSArray()) return Just(true);
  844   if (object->IsJSProxy()) {
  845     Handle<JSProxy> proxy = Handle<JSProxy>::cast(object);
  846     Isolate* isolate = proxy->GetIsolate();
  847     if (proxy->IsRevoked()) {
  848       isolate->Throw(*isolate->factory()->NewTypeError(
  849           MessageTemplate::kProxyRevoked,
  850           isolate->factory()->NewStringFromAsciiChecked("IsArray")));
  851       return Nothing<bool>();
  852     }
  853     return Object::IsArray(handle(proxy->target(), isolate)); // <<-- calls Object:IsArray infinitely
  854   }
  855   return Just(false);
  856 }

Crashed report ID: daffc851-27a2-41aa-af2f-185b3ae7699c

How much crashed? Just one tab

Is it a problem with a plugin? N/A 

Did this work before? N/A 

Chrome version: 58.0.3029.110  Channel: stable
OS Version: 10.0
Flash Version:
 

Deleted: poc.html 159 bytes

poc.html 159 bytes View Download