Closed Bug 641224 Opened 9 years ago Closed 9 years ago

TI: Crash [@ js::GetIterator]

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, testcase, Whiteboard: fixed-in-jaegermonkey)

Crash Data

x = evalcx('lazy');
x.__iterator__ = Object.isFrozen
for each(x in x) {}

crashes js debug and opt shells on JM changeset bcf148dbce2f with -m, -a and -n at js::GetIterator
Did not handle usage of cross-compartment custom iterators.  In such cases the bound variable is always marked as unknown (the bug came since we try to mark 'for in' iterators as binding strings, except when an Iterator/Generator object or object with a custom __iterator__ is used).

http://hg.mozilla.org/projects/jaegermonkey/rev/f883ddc1ae95
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Whiteboard: fixed-in-jaegermonkey
Crash Signature: [@ js::GetIterator]
A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug641224.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.