Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-26 20:30:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1149510 - Don't try to read the result object when doing in-place debug mode bailout in a for-of loop. (r=jandem)

Browse Source
This commit is contained in:
Shu-yu Guo 2015-04-03 14:18:05 -07:00
parent b485a53afc
commit cff53ed7c9
2 changed files with 28 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
js/src/jit-test/tests/debug/onExceptionUnwind-15.js Normal file
View File

@ -0,0 +1,25 @@
// Test that Ion->Baseline in-place debug mode bailout can recover the iterator
// from the snapshot in a for-of loop.
g = newGlobal();
g.parent = this;
g.eval("Debugger(parent).onExceptionUnwind=(function() {})");
function throwInNext() {
yield 1;
yield 2;
yield 3;
throw 42;
}
function f() {
for (var o of new throwInNext);
}
var log = "";
try {
f();
} catch (e) {
log += e;
}
assertEq(log, "42");

8
js/src/jit/BaselineBailouts.cpp
View File

@ -487,12 +487,10 @@ HasLiveIteratorAtStackDepth(JSScript* script, jsbytecode* pc, uint32_t stackDept
if (tn->kind == JSTRY_FOR_IN && stackDepth == tn->stackDepth)
return true;
// For-of loops have both the iterator and the result on stack.
if (tn->kind == JSTRY_FOR_OF &&
(stackDepth == tn->stackDepth || stackDepth == tn->stackDepth - 1))
{
// For-of loops have both the iterator and the result object on
// stack. The iterator is below the result object.
if (tn->kind == JSTRY_FOR_OF && stackDepth == tn->stackDepth - 1)
return true;
}
}
return false;