355053 - Site's code can execute during GC (using generators and exceptions)

Status: RESOLVED DUPLICATE of bug 380469

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> function gen() { try { yield true; } finally { throw 'foo'; } };

js> try { for(var p in gen()) throw this; } catch(e) { print("Caught: " + e); }

Caught: [object global]

js> print("*** Before GC"); gc(); print("*** After GC");

*** Before GC
uncaught exception: foo
before 9232, after 9232, break 01008000
*** After GC

"Site-specified code executing when it shouldn't" scares me, so tentatively marking security-sensitive even though I haven't been able to make it crash.

Comment 1

[Igor Bukanov]

Running finally during calls to JS_GC() or JS_MaybeGC() is a feature. See bug 352788 and its dependencies for reasoning why the current implementation is safe. 

Personally I do not like this feature of Python 2.5 iteration protocol, but alternatives would require to change JS 1.7 very significantly plus the current implementation seems to be sound.