The default bug view has changed. See this FAQ.

TI+JM: Assertion failure: v.kind() != SSAValue::EMPTY, at jsanalyze.cpp:1583

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 528169 [details]
Stack trace

This assert is triggered by Mochitest-4 layout/style/test/test_bug302186.html, on this line:
--
var _46f = MochiKit.Style.computedStyle.apply(d, arguments);
--
(gdb) call js_DumpPC(cx)
main:
    00042:4182  trace 0
    00045:4183  getgname "MochiKit"
    00048:4183  getprop "Style"
    00051:4183  getprop "computedStyle"
    00054:4183  callprop "apply"
    00057:4183  getlocal 0
    00060:4183  arguments
--> 00061:4183  funapply 2
    00064:4183  setlocal 2
The crash here is in the SSA analysis while compiling the function invoked by the apply.  For switch and try blocks we didn't propagate stack values to the possible branch targets, which manifested in the assert fixed in bug 652314.  That fix was a workaround, and insufficient to address the base problem of not knowing the stack at these targets --- if the only path to an exception handler occurs if an exception was actually thrown, we had no stack info at the handler's PC.  This fix removes the workaround and propagates the stack for switch and try blocks.

http://hg.mozilla.org/projects/jaegermonkey/rev/e5068d17c8e3
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.