If a recursive JS Array is constructed and that array is trying to be converted into a string the entire application crashes with a stack overflow.

With the old QScriptEngine this simply produced a string, as do all tested browser implementations ("test: ,,,,,,," in case of the snippet below).

"QV4_CRASH_ON_STACKOVERFLOW" is not set.

The JS code to reproduce is the following:

function StackOverflow() {
    var ret = [];
    for (var i = 7; 0 <= i; --i) {
        ret.push(ret);
        }

    return "test: " + ret;
}
StackOverflow();