Closed Bug 673705 Opened 8 years ago Closed 8 years ago

TI: Assertion failure: until < var.lifetime->start, at jsanalyze.cpp:1250

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion)

Attachments

(2 files, 2 obsolete files)

--
function f() {
    var x;
    try {
    } catch (e) {
    } finally {
        print(x);
    }
}
f();
--
$ ./js -n -a test.js
Assertion failure: until < var.lifetime->start, at jsanalyze.cpp:1250

Revision 4fbb36c1c9a3, 32-bit OS X.
Attached patch fix (obsolete) — Splinter Review
Oops! The assert should be |until <= var.lifetime->start|, since x was already ensured at the |finally| exception entry, which overlaps into the |catch|.
Attached patch fix & testSplinter Review
Attachment #547937 - Attachment is obsolete: true
Attachment #547975 - Flags: review?(bhackett1024)
Attachment #547975 - Flags: review?(bhackett1024) → review+
Hmm, the new assertion is still tripping on some of the Mochitests.  Shu, do you mind building a browser and looking into this?
This testcase still asserts at revision 62f32efb087c.
--
function f(x) {
    try {
        try {
        } catch (e) {
        }
    } finally {
    }
    g(x);
}
f();
--
$ ./js -n -a test.js
Assertion failure: until <= var.lifetime->start, at jsanalyze.cpp:1250
Attached patch fix & test 2 (obsolete) — Splinter Review
ensureVariable shouldn't ensure variables that are already ensured. If variable is already ensured, should assert that it's to an even earlier point, since we walk the bytecode stream backwards.
Attached patch fix & test 2Splinter Review
accidentally included unrelated changes
Attachment #548515 - Attachment is obsolete: true
Attachment #548516 - Flags: review+
Fixed in JM:

http://hg.mozilla.org/projects/jaegermonkey/rev/058032661e2f
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.