420012 - VerifyError on generated class

Status: RESOLVED FIXED

(Rhino Graveyard :: Compiler, defect)

Description

[Norris Boyd]

From newsgroup:

I am experiencing a problem with ClassCompiler with some of my scripts
using either rhino 1.6 or 1.7
js.jar manifests...

rhino 1.6 from 11/18/2006
Manifest-Version: 1.0
Ant-Version: Apache Ant 1.6.5
Created-By: 1.5.0_06-b05 (Sun Microsystems Inc.)
Main-Class: org.mozilla.javascript.tools.shell.Main
Class-Path: xbean.jar

rhino 1.7 from 8/19/2007
Manifest-Version: 1.0
Ant-Version: Apache Ant 1.6.5
Created-By: 1.5.0_07-b03 (Sun Microsystems Inc.)
Main-Class: org.mozilla.javascript.tools.shell.Main
Class-Path: xbean.jar

the following contrived code example exhibits the problem producing a
java.lang.VerifyError when a new instance is created.
verifyError.js

var o = new Object;
o.setX = function (id) {
   this.oid = id;
}

function setX(n) {
        if (n == "" || n == null)
                n = 0;

   var s = new Object;
   s.xyz = n;

        if(s != null) {
            o.setX(s.xyz);
        }
}

setX('x');

all compilations using jdk1.6...
> java -version

java version "1.6.0_01-ea"
Java(TM) SE Runtime Environment (build 1.6.0_01-ea-b03)
Java HotSpot(TM) Server VM (build 1.6.0_01-ea-b03, mixed mode)

> java org.mozilla.javascript.tools.jsc.Main -nosource -O 9 -version 160 verifyError.js
> java -classpath $classpath verifyError

Exception in thread "main" java.lang.VerifyError: (class: verifyError,
method: _c2 signature: (LverifyError;Lorg/mozilla/javascript/
Context;Lorg/mozilla/javascript/Scriptable;Lorg/mozilla/javascript/
Scriptable;Ljava/lang/Object;D[Ljava/lang/Object;)Ljava/lang/Object;)
Register 4 contains wrong type
at java.lang.Class.getDeclaredConstructors0(Native Method)
at java.lang.Class.privateGetDeclaredConstructors(Class.java:2389)
at java.lang.Class.getConstructor0(Class.java:2699)
at java.lang.Class.newInstance0(Class.java:326)
at java.lang.Class.newInstance(Class.java:308)

changing version to 120 or 140 has no effect...

> java org.mozilla.javascript.tools.jsc.Main -nosource -O 9 -version 140 verifyError.js
> java org.mozilla.javascript.tools.jsc.Main verifyError

Exception in thread "main" java.lang.VerifyError: (class: verifyError,
method: _c2 signature: (LverifyError;Lorg/mozilla/javascript/
Context;Lorg/mozilla/javascript/Scriptable;Lorg/mozilla/javascript/
Scriptable;Ljava/lang/Object;D[Ljava/lang/Object;)Ljava/lang/Object;)
Register 4 contains wrong type

changing optimization to 1 has no effect...

> java org.mozilla.javascript.tools.jsc.Main -nosource -O 1 -version 140 verifyError.js
> java org.mozilla.javascript.tools.jsc.Main verifyError

Exception in thread "main" java.lang.VerifyError: (class: verifyError,
method: _c2 signature: (LverifyError;Lorg/mozilla/javascript/
Context;Lorg/mozilla/javascript/Scriptable;Lorg/mozilla/javascript/
Scriptable;Ljava/lang/Object;D[Ljava/lang/Object;)Ljava/lang/Object;)
Register 4 contains wrong type

changing optimization to -1 or zero works...

> java org.mozilla.javascript.tools.jsc.Main -nosource -O 0 -version 140 verifyError.js
> java org.mozilla.javascript.tools.jsc.Main verifyError

no exception thrown.

oddly enough, certain minor code changes cure the problem.   e.g.

comment out...
/*
           if (n == "" || n == null)
                n = 0;
*/

or comment out...
//  o.setX(s.ID);

or change...
s.xyz = 1;

or...

change one of the function names so that they are different.

each of these trivial modifications cures the problem in all
compilation cases.

Comment 1

[Norris Boyd]

Attachment: Proposed patch

Comment 2

[Norris Boyd]

Fixed:

Checking in src/org/mozilla/javascript/optimizer/Codegen.java;
/cvsroot/mozilla/js/rhino/src/org/mozilla/javascript/optimizer/Codegen.java,v  <
--  Codegen.java
new revision: 1.261; previous revision: 1.260
done