912152 - Assertion failure: !script()->analysis()->hasTryFinally(), at jit/IonBuilder.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

((function() {
    try {
        new(arguments.callee);
    } finally {}
})());

asserts js debug shell on m-c changeset 7ff96bd19c1c without any CLI arguments at Assertion failure: !script()->analysis()->hasTryFinally(), at jit/IonBuilder.cpp

My configure flags are:

--target=x86_64-apple-darwin11.4.0 --enable-optimize --enable-debug --enable-profiling --enable-gczeal --enable-debug-symbols --enable-methodjit --enable-type-inference --disable-tests --with-ccache

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/abb25a18b5a5
user:        Brian Hackett
date:        Mon Sep 02 10:05:27 2013 -0700
summary:     Bug 906788 - Construct TypeObject newScript information using MIR, r=jandem.

Brian, is bug 906788 a possible regressor?

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch

IonBuilder wanted its callers to check the script did not contain try-finally, which happened in IonCompile but not the definite properties analysis.  This moves the check to IonBuilder itself to avoid the fragility.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f937dc17e5ac

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f937dc17e5ac