618614 - Incorrect result for array, for-in without GC

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Consider this test case:
---
for(var i=0; i<3; i++) {
    var s = '';
    var a = [0, 1];
    a.b = 10;
    for (var x in a) {
	s += x;
	a.pop();
    }
    print(s);
    //gc();
}
---
This prints (interpreter/JM):
0b
01b
01b

Commenting out the gc() call makes the problem go away:
0b
0b
0b

Comment 1

[Jan de Mooij [:jandem]]

(In reply to comment #0)
> Commenting out the gc() call makes the problem go away:

s/commenting out/uncommenting

Comment 2

[Andreas Gal :gal]

Looks like a security bug.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

This is probably not sg:anything.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/abd854c5d634

Comment 5

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/abd854c5d634

Comment 7

[Daniel Veditz [:dveditz]]

not an exploit per comment 3