Closed
Bug 1876520
Opened 2 years ago
Closed 2 years ago
An error caused by deleting property within a forin loop
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
DUPLICATE
of bug 1486656
People
(Reporter: mouchen, Unassigned)
Details
Attachments
(1 file)
|
165 bytes,
text/javascript
|
Details |
Steps to reproduce:
Execute the poc.js file.
./js poc.js
The loop iterates over the properties of the 'own' object and its prototype chain. In the first iteration of the loop, 'parent.c' is deleted, and it should not appear in the result. I believe this could lead to security issues. To verify correctness, I ran the code in other JavaScript engines, and the result was consistently 'a' in all cases.
Actual results:
output: a\nc
Expected results:
output: a
|
||
Updated•2 years ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Duplicate of bug: 1486656
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•