341828 - js1_5/Object/regress-338709.js - uncaught exception

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Bob Clary [:bc] (inactive)]

BUGNUMBER: 338709
STATUS: ReadOnly properties should not be overwritten by using Object and try..throw..catch
FAILED!: uncaught exception: 1990

I've tested on WinXP only so far: Neither 1.8.0.5, 1.8.1 builds from today have this error. Only trunk.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

So, the problem here is that we try to call the Object constructor to initialize the exception object. In this case, the object constructor is a scripted function (not native), so we try to enter the interpreter from it (a new interpreter, thanks to js_InvokeConstructor), and return early because there's already an exception pending on cx, namely the exception that we're trying to catch.

Comment 2

[Brendan Eich [:brendan]]

We should not fix this except by changing catch scope to be lexical (to use block scope in SpiderMonkey), which is the plan for ES4/JS2.

/be

Comment 3

[Igor Bukanov]

It does not run, 
for (i in [1,2,3]) print(i)
generates:
InternalError: unimplemented JavaScript bytecode 208

But *without* the patch SM does not compile at all with JS_HAS_GENERATORS == 0. So the patch improves the situation. Moreover, to test that GC works with JS_HAS_GENERATORS == 0 I have to make sure that at least SM compiles.

Comment 4

[Igor Bukanov]

(In reply to comment #3)

That was comments for the wrong bug, ignore them here!

Comment 5

[Bob Clary [:bc] (inactive)]

fixed by bug 336379

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060824 windows/mac*/linux