Closed
Bug 641224
Opened 13 years ago
Closed 13 years ago
TI: Crash [@ js::GetIterator]
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: gkw, Unassigned)
References
Details
(Keywords: crash, testcase, Whiteboard: fixed-in-jaegermonkey)
Crash Data
x = evalcx('lazy');
x.__iterator__ = Object.isFrozen
for each(x in x) {}
crashes js debug and opt shells on JM changeset bcf148dbce2f with -m, -a and -n at js::GetIterator
|
||
Comment 1•13 years ago
|
||
Did not handle usage of cross-compartment custom iterators. In such cases the bound variable is always marked as unknown (the bug came since we try to mark 'for in' iterators as binding strings, except when an Iterator/Generator object or object with a custom __iterator__ is used). http://hg.mozilla.org/projects/jaegermonkey/rev/f883ddc1ae95
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
|
||
Updated•13 years ago
|
Crash Signature: [@ js::GetIterator]
|
||
Comment 2•11 years ago
|
||
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug641224.js.
Flags: in-testsuite+
You need to log in
before you can comment on or make changes to this bug.
Description
•