wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-09 17:31:47 +09:00
Code Issues Projects Releases Packages Wiki Activity

1354527 - Crash [@ js::jit::RInstructionResults::operator[]]

Browse source 
1354527 - Recover the iterator object when closing during exception handling.
This commit is contained in:
win7-7 2026-01-07 01:09:51 +02:00 • committed by wuggy
commit 1f0c1ad851
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
js/src/jit/JitFrames.cpp
View file

@ -347,7 +347,8 @@ CloseLiveIteratorIon(JSContext* cx, const InlineFrameIterator& frame, JSTryNote*
for (unsigned i = 0; i < skipSlots; i++)
si.skip();
Value v = si.read();
MaybeReadFallback recover(cx, cx->activation()->asJit(), &frame.frame(), MaybeReadFallback::Fallback_DoNothing);
Value v = si.maybeRead(recover);
RootedObject iterObject(cx, &v.toObject());
if (isDestructuring) {