Last Comment Bug 652314 - TI: Crash [@ js::types::TypeSet::add] or "Assertion failure: v.kind() != SSAValue::EMPTY && pv->value.kind() != SSAValue::EMPTY,"
: TI: Crash [@ js::types::TypeSet::add] or "Assertion failure: v.kind() != SSAV...
: assertion, crash, regression, testcase
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: x86 Mac OS X
-- critical (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: jsfunfuzz infer-regress 650715
  Show dependency treegraph
Reported: 2011-04-23 03:24 PDT by Gary Kwong [:gkw] [:nth10sd]
Modified: 2013-01-14 08:06 PST (History)
5 users (show)
choller: in‑testsuite+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Gary Kwong [:gkw] [:nth10sd] 2011-04-23 03:24:07 PDT
(function() {
    for (a in [0]) {
        try {
        } catch(e) {}

crashes js opt shell on JM changeset 90a7b141e0cf with -m, -a and -n at js::types::TypeSet::add and asserts js debug shell at Assertion failure: v.kind() != SSAValue::EMPTY && pv->value.kind() != SSAValue::EMPTY,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   68276:90a7b141e0cf
tag:         tip
user:        Brian Hackett
date:        Fri Apr 22 07:59:45 2011 -0700
summary:     [INFER] Bytecode SSA analysis, bug 650715.
Comment 1 User image Gary Kwong [:gkw] [:nth10sd] 2011-04-23 03:25:19 PDT
Another assertion message floating around is:

Assertion failure: v.kind() != SSAValue::EMPTY

but I'm assuming they're related.
Comment 2 User image Brian Hackett (:bhackett) 2011-04-23 22:41:08 PDT
Weird situation in scripts with switch or try blocks, 'for in' iterators and return statements within those iterators.  The SSA analysis doesn't track control flow for scripts with switch and try blocks (oversight which should be fixed), and assumes the stack is balanced within these opcodes, a property which does not hold if ENDITERs are introduced to handle return statements that close any iterators active outside the try/switch block.
Comment 3 User image Christian Holler (:decoder) 2013-01-14 08:06:50 PST
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug652314.js.

Note You need to log in before you can comment on or make changes to this bug.