349482 - Decompiling "try/catch" in "for..in" or "with" crashes [@ js_SetRequiredSlot ] [@ js_puts]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060820 Minefield/3.0a1

This crashes [@ js_SetRequiredSlot]:
    javascript:function() { for(p in {})   try{}catch(e){}   }

This crashes [@ js_puts]:
    javascript:function() { with({})     { try{}catch(e){} } } 

Sorry if this should have been two separate bugs.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Minimal patch

Destructuring catch will hit this code pretty hard, I imagine (currently the decompiler asserts if you try it), but this patch accounts for the block depth that we added in bug 336379 comment 61.

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 234756 [details] [diff] [review]
Minimal patch

Oops.  No brainer, safe for beta 2 if there is time.

/be

Comment 3

[Brendan Eich [:brendan]]

Thanks for taking this, mrbkap.

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Fixed checked into trunk.

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-349482-01.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-349482-01.js,v  <--  regress-349482-01.js
initial revision: 1.1
done
RCS file: /cvsroot/mozilla/js/tests/js1_5/Regress/regress-349482-02.js,v
done
Checking in regress-349482-02.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-349482-02.js,v  <--  regress-349482-02.js
initial revision: 1.1

Comment 6

[Mike Schroepfer]

Comment on attachment 234756 [details] [diff] [review]
Minimal patch

a=schrep for drivers - approving all [181approval pending] bugs now that tree is open.

Comment 7

[Brendan Eich [:brendan]]

This patch depends on patches landed for bug 336379, so it will have to wait till that bug is fixed on the branch.  Actually, I'd rather do a mega-patch, once the small fry with approval have landed.

/be

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060824 windows/mac*/linux

Comment 9

[Brendan Eich [:brendan]]

Fix landed yesterday on the 1.8 branch as part of the destructuring/lexical catch var patch.

/be

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 1.8, 1.9 20060909 windows/mac*/linux