787309 - IonMonkey: Crash [@ ExpressionDecompiler::decompilePC] or "Assertion failure: script->analysis()->getCode(pc).stackDepth == ((hpcdepth == unsigned(-1)) ? pcdepth : hpcdepth)," or "Assertion failure: pcdepth >= nuses,"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

+++ This bug was initially created as a clone of Bug #781660 +++

try {
    h
} catch (x
if gc()) {} finally {
    this.z.z
}

asserts 64-bit js debug shell on IonMonkey changeset 32b7b76d111c with --no-ti.

(function () {
    try {} catch (x if true) { } finally {
       3(__defineSetter__("x", encodeURIComponent))
    }
})()

crashes 64-bit js opt shell on IonMonkey changeset d794f23798f4 without any CLI arguments at ExpressionDecompiler::decompilePC

Spinning this off from bug 781660 comment 4 and bug 781660 comment 5.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

A half-patch is in bug 781660 comment 10.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Also assigning to Nicolas at his request.

Comment 3

[Nicolas B. Pierron [:nbp]]

Attachment: Follow try notes when we cannot follow gotos.

Add again this patch to this bug, with the r+ given by luke in Bug 781660, even if the patch by it-self cause more failures as it depends on Bug 787848.

Comment 4

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/95c4704589e1

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This went to Try previously:

https://tbpl.mozilla.org/?tree=Try&rev=b1ba09d0a184

Comment 6

[Ed Morley [:emorley]]

Push backed out for make check failures:
https://tbpl.mozilla.org/php/getParsedLog.php?id=15645062&tree=Mozilla-Inbound

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b903d1d1b861

Comment 7

[Nicolas B. Pierron [:nbp]]

Try server:
https://tbpl.mozilla.org/?tree=Try&rev=2e9b651cf28a

Minor fix:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9f22813d133f

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9f22813d133f

Comment 9

[Christian Holler (:decoder)]

JSBugMon: This bug has been automatically verified fixed.