Haven't yet come up with a trivial example that leads to this occuring, but the following triggers it: var o = {toString:function(){ throw {}; return "wibble"; }}; o.bar = "bar"; o.__defineGetter__("foo", function(){ print("zomg"); return "wibble" }); try { print(o); } catch(e) { for (i in e) print("e[\""+i+"\"] = " + e[i]); }
Reduced to: var o; 1; // loads into tr0 for the end result try { o.b; } catch(e) { for (i in e); // tr0 isn't ref'd here, so is reused by the iterator. }
Created attachment 20712 [details] Patch o doom
Created attachment 20713 [details] patch #2
Comment on attachment 20713 [details] patch #2 r=me
Committed r32285