Bug 1346862 - Fix IteratorClose due to non-local jumps being catchable by try statements inside for-of

Issue #74

1 files changed, 7 insertions, 13 deletions

diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 4d6ff6305..b2e48d7ea 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -2065,7 +2065,11 @@ class ForOfLoopControl : public LoopControl
 
     bool emitIteratorClose(BytecodeEmitter* bce,
                            CompletionKind completionKind = CompletionKind::Normal) {
-        return bce->emitIteratorClose(completionKind, allowSelfHosted_);
+        ptrdiff_t start = bce->offset();
+        if (!bce->emitIteratorClose(completionKind, allowSelfHosted_))
+            return false;
+        ptrdiff_t end = bce->offset();
+        return bce->tryNoteList.append(JSTRY_FOR_OF_ITERCLOSE, 0, start, end);
     }
 
     bool emitPrepareForNonLocalJump(BytecodeEmitter* bce, bool isTarget) {
@@ -2614,17 +2618,6 @@ BytecodeEmitter::emitUint32Operand(JSOp op, uint32_t operand)
     return true;
 }
 
-bool
-BytecodeEmitter::flushPops(int* npops)
-{
-    MOZ_ASSERT(*npops != 0);
-    if (!emitUint16Operand(JSOP_POPN, *npops))
-        return false;
-
-    *npops = 0;
-    return true;
-}
-
 namespace {
 
 class NonLocalExitControl
@@ -2718,8 +2711,9 @@ NonLocalExitControl::prepareForNonLocalJump(BytecodeEmitter::NestableControl* ta
     bool emitIteratorCloseAtTarget = emitIteratorClose && kind_ != Continue;
 
     auto flushPops = [&npops](BytecodeEmitter* bce) {
-        if (npops && !bce->flushPops(&npops))
+        if (npops && !bce->emitUint16Operand(JSOP_POPN, npops))
             return false;
+        npops = 0;
         return true;
     };