Closed Bug 912152 Opened 6 years ago Closed 6 years ago

Assertion failure: !script()->analysis()->hasTryFinally(), at jit/IonBuilder.cpp

Categories

(Core :: JavaScript Engine, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla26

People

(Reporter: gkw, Assigned: bhackett)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [jsbugmon:update])

Attachments

(3 files)

Attached file stack
((function() {
    try {
        new(arguments.callee);
    } finally {}
})());

asserts js debug shell on m-c changeset 7ff96bd19c1c without any CLI arguments at Assertion failure: !script()->analysis()->hasTryFinally(), at jit/IonBuilder.cpp

My configure flags are:

--target=x86_64-apple-darwin11.4.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/abb25a18b5a5
user:        Brian Hackett
date:        Mon Sep 02 10:05:27 2013 -0700
summary:     Bug 906788 - Construct TypeObject newScript information using MIR, r=jandem.

Brian, is bug 906788 a possible regressor?
Flags: needinfo?(bhackett1024)
Attached patch patchSplinter Review
IonBuilder wanted its callers to check the script did not contain try-finally, which happened in IonCompile but not the definite properties analysis.  This moves the check to IonBuilder itself to avoid the fragility.
Assignee: general → bhackett1024
Attachment #801662 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)
Attachment #801662 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/f937dc17e5ac
Status: NEW → RESOLVED
Closed: 6 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Depends on: 915167
You need to log in before you can comment on or make changes to this bug.