Bug 18642 - Iterator context may get placed into the return register, leading to much badness
Summary: Iterator context may get placed into the return register, leading to much bad...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P2 Normal
Assignee: Oliver Hunt
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-04-20 16:17 PDT by Oliver Hunt
Modified: 2008-04-20 19:58 PDT (History)
1 user (show)

See Also:


Attachments
Patch o doom (3.29 KB, patch)
2008-04-20 19:29 PDT, Oliver Hunt
no flags Details | Formatted Diff | Diff
patch #2 (2.33 KB, patch)
2008-04-20 19:54 PDT, Oliver Hunt
mjs: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2008-04-20 16:17:28 PDT
Haven't yet come up with a trivial example that leads to this occuring, but the following triggers it:
var o = {toString:function(){
    throw {};
    return "wibble";
}};
o.bar = "bar";
o.__defineGetter__("foo", function(){ print("zomg"); return "wibble" });
try {
print(o);
} catch(e) {
    for (i in e)
       print("e[\""+i+"\"] = " + e[i]);
}
Comment 1 Oliver Hunt 2008-04-20 16:24:09 PDT
Reduced to:

var o;
1; // loads into tr0 for the end result
try {
    o.b;
} catch(e) {
    for (i in e); // tr0 isn't ref'd here, so is reused by the iterator.
}
Comment 2 Oliver Hunt 2008-04-20 19:29:36 PDT
Created attachment 20712 [details]
Patch o doom
Comment 3 Oliver Hunt 2008-04-20 19:54:09 PDT
Created attachment 20713 [details]
patch #2
Comment 4 Maciej Stachowiak 2008-04-20 19:55:00 PDT
Comment on attachment 20713 [details]
patch #2

r=me
Comment 5 Oliver Hunt 2008-04-20 19:58:18 PDT
Committed r32285