673705 - TI: Assertion failure: until < var.lifetime->start, at jsanalyze.cpp:1250

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    var x;
    try {
    } catch (e) {
    } finally {
        print(x);
    }
}
f();
--
$ ./js -n -a test.js
Assertion failure: until < var.lifetime->start, at jsanalyze.cpp:1250

Revision 4fbb36c1c9a3, 32-bit OS X.

Comment 1

[Shu-yu Guo [:shu]]

Attachment: fix

Oops! The assert should be |until <= var.lifetime->start|, since x was already ensured at the |finally| exception entry, which overlaps into the |catch|.

Comment 2

[Shu-yu Guo [:shu]]

Attachment: fix & test

Comment 3

[Brian Hackett [Laid off!]]

Hmm, the new assertion is still tripping on some of the Mochitests.  Shu, do you mind building a browser and looking into this?

Comment 4

[Jan de Mooij [:jandem]]

This testcase still asserts at revision 62f32efb087c.
--
function f(x) {
    try {
        try {
        } catch (e) {
        }
    } finally {
    }
    g(x);
}
f();
--
$ ./js -n -a test.js
Assertion failure: until <= var.lifetime->start, at jsanalyze.cpp:1250

Comment 5

[Shu-yu Guo [:shu]]

Attachment: fix & test 2

ensureVariable shouldn't ensure variables that are already ensured. If variable is already ensured, should assert that it's to an even earlier point, since we walk the bytecode stream backwards.

Comment 6

[Shu-yu Guo [:shu]]

Attachment: fix & test 2

accidentally included unrelated changes

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Fixed in JM:

http://hg.mozilla.org/projects/jaegermonkey/rev/058032661e2f