Bug 18642 – Iterator context may get placed into the return register, leading to much badness

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Oliver Hunt]

Haven't yet come up with a trivial example that leads to this occuring, but the following triggers it:
var o = {toString:function(){
    throw {};
    return "wibble";
}};
o.bar = "bar";
o.__defineGetter__("foo", function(){ print("zomg"); return "wibble" });
try {
print(o);
} catch(e) {
    for (i in e)
       print("e[\""+i+"\"] = " + e[i]);
}

[Oliver Hunt]

Reduced to:

var o;
1; // loads into tr0 for the end result
try {
    o.b;
} catch(e) {
    for (i in e); // tr0 isn't ref'd here, so is reused by the iterator.
}

[Oliver Hunt]

Created attachment 20712 [details]
Patch o doom

[Oliver Hunt]

Created attachment 20713 [details]
patch #2

[Maciej Stachowiak]

Comment on attachment 20713 [details]
patch #2

r=me

[Oliver Hunt]

Committed r32285