652646 - TI+JM: Assertion failure: v.kind() != SSAValue::EMPTY, at jsanalyze.cpp:1583

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Stack trace

This assert is triggered by Mochitest-4 layout/style/test/test_bug302186.html, on this line:
--
var _46f = MochiKit.Style.computedStyle.apply(d, arguments);
--
(gdb) call js_DumpPC(cx)
main:
    00042:4182  trace 0
    00045:4183  getgname "MochiKit"
    00048:4183  getprop "Style"
    00051:4183  getprop "computedStyle"
    00054:4183  callprop "apply"
    00057:4183  getlocal 0
    00060:4183  arguments
--> 00061:4183  funapply 2
    00064:4183  setlocal 2

Comment 1

[Brian Hackett [Laid off!]]

The crash here is in the SSA analysis while compiling the function invoked by the apply.  For switch and try blocks we didn't propagate stack values to the possible branch targets, which manifested in the assert fixed in bug 652314.  That fix was a workaround, and insufficient to address the base problem of not knowing the stack at these targets --- if the only path to an exception handler occurs if an exception was actually thrown, we had no stack info at the handler's PC.  This fix removes the workaround and propagates the stack for switch and try blocks.

http://hg.mozilla.org/projects/jaegermonkey/rev/e5068d17c8e3