Last Comment Bug 651627 - TI: incorrect result with try..catch, loops
: TI: incorrect result with try..catch, loops
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-04-20 14:18 PDT by Jan de Mooij [:jandem]
Modified: 2011-04-22 11:02 PDT (History)
4 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Testcase (247 bytes, application/x-javascript)
2011-04-20 14:20 PDT, Jan de Mooij [:jandem]
no flags Details

Description Jan de Mooij [:jandem] 2011-04-20 14:18:50 PDT
$ ./js -n -m test.js
test.js:5: Error: Assertion failed: got (void 0), expected 0
Comment 1 Jan de Mooij [:jandem] 2011-04-20 14:20:13 PDT
Created attachment 527379 [details]
Testcase
Comment 2 Brian Hackett (:bhackett) 2011-04-22 06:41:32 PDT
The problem here looks like when we enter from the interpreter, we don't fix up the type tags of variables which have a known type, and we then forget the constant type of 'j' after the 'try' so the resulting torn value passed to assertEq looks like an undefined.

This is fixed by the SSA patch, arriving shortly --- it removes the invariant we have that expects known type tags of locals to always be in sync (this invariant doesn't make much sense for SSA, as we can track different types for locals in different regions of the script).  Instead, we avoid stores of type tags for locals/args when we know their type is being preserved by a write, and issue the store when the var may be initially written.  (This could introduce extra memory traffic in nested loops or in branchy loops with vars that are not live around the backedge, but doesn't seem to affect benchmarks.  Could be fixed by not requiring vars with known type to have that type synced at join points).
Comment 3 Brian Hackett (:bhackett) 2011-04-22 11:02:23 PDT
Fixed by rev 90a7b141e0cf.

Note You need to log in before you can comment on or make changes to this bug.