From 1f0c1ad8516d87edea78c47c3a33175667b392a8 Mon Sep 17 00:00:00 2001
From: win7-7 <win7-7@users.noreply.github.com>
Date: Wed, 7 Jan 2026 01:09:51 +0200
Subject: [PATCH] 1354527 -  Crash [@ js::jit::RInstructionResults::operator[]]

1354527 - Recover the iterator object when closing during exception handling.
---
 js/src/jit/JitFrames.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/JitFrames.cpp b/js/src/jit/JitFrames.cpp
index a6fee5dec6..47b6d107f6 100644
--- a/js/src/jit/JitFrames.cpp
+++ b/js/src/jit/JitFrames.cpp
@@ -347,7 +347,8 @@ CloseLiveIteratorIon(JSContext* cx, const InlineFrameIterator& frame, JSTryNote*
     for (unsigned i = 0; i < skipSlots; i++)
         si.skip();
 
-    Value v = si.read();
+    MaybeReadFallback recover(cx, cx->activation()->asJit(), &frame.frame(), MaybeReadFallback::Fallback_DoNothing);
+    Value v = si.maybeRead(recover);
     RootedObject iterObject(cx, &v.toObject());
 
     if (isDestructuring) {