738537 - IonMonkey: Crash [@ js::HeapPtr<js::Shape, unsigned int>::operator js::Shape*] or [@ js::CloseIterator] or [@ js::ion::HandleException]

Status: RESOLVED DUPLICATE of bug 732852

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: Stack

var a = []
Object.defineProperty(a, 0, {
  get: (function() {
    for (var v in i) {}
    a[0]
  })
})
var i = Iterator({}, true)
a[0]

crashes js debug shell on IonMonkey changeset 61129d29a377 with -m, -a, --ion and -n at js::HeapPtr<js::Shape, unsigned int>::operator js::Shape*

During the course of reduction, an opt crash at js::CloseIterator with js::ion::HandleException on the stack was also seen.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Thanks go out to Jesse and Nicolas for helping to reduce this testcase.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

IonMonkey's iterator handling is broken if an exception is thrown inside an iterator which is what happens here (this function is infinitely recursive so it will hit the stack check guard).

Comment 4

[Christian Holler (:decoder)]

A testcase for this bug was already added in the original bug (bug 732852).