797496 - Assertion failure: script->analysis()->getCode(pc).stackDepth == ((hpcdepth == unsigned(-1)) ? pcdepth : hpcdepth), at jsopcode.cpp:6409

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 13fd49ef7786 (run with ):


var set = Set(['a']);
var n = 5;
for (let v of set) {
    if (n === 0)
        break;
    let g = set(Set(0xffffffff, n), 1);
}

Comment 1

[Nicolas B. Pierron [:nbp]]

Attachment: Ignore hidden PC even with try notes.

Apparently I forgot a corner case, hopefully we have people dedicated at proving us wrong in this unforgiving world …

Comment 2

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   108619:9f22813d133f
user:        Nicolas B. Pierron
date:        Sat Sep 29 00:43:20 2012 -0700
summary:     Bug 787309 - Fallback on try notes after continuing on a goto. r=luke

This iteration took 85.330 seconds to run.

Comment 3

[Nicolas B. Pierron [:nbp]]

https://tbpl.mozilla.org/?tree=Try&rev=4fca9dd752f6 (Try, without test case)
https://hg.mozilla.org/integration/mozilla-inbound/rev/3b7a134bc3aa

Comment 4

[Nicolas B. Pierron [:nbp]]

Backout: (miss-leading local failure during push)
https://hg.mozilla.org/integration/mozilla-inbound/rev/66b4f2ea351d

Re-Push:
http://hg.mozilla.org/integration/mozilla-inbound/rev/f0ce5a01e4fc

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/f0ce5a01e4fc

Comment 6

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug797496.js.