Closed Bug 673705 Opened 13 years ago Closed 13 years ago

TI: Assertion failure: until < var.lifetime->start, at jsanalyze.cpp:1250

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

References

Details

(Keywords: assertion)

Attachments

(2 files, 2 obsolete files)

-- function f() { var x; try { } catch (e) { } finally { print(x); } } f(); -- $ ./js -n -a test.js Assertion failure: until < var.lifetime->start, at jsanalyze.cpp:1250 Revision 4fbb36c1c9a3, 32-bit OS X.
Attached patch fix (obsolete) (deleted) — Splinter Review
Oops! The assert should be |until <= var.lifetime->start|, since x was already ensured at the |finally| exception entry, which overlaps into the |catch|.
Attached patch fix & test (deleted) — Splinter Review
Attachment #547937 - Attachment is obsolete: true
Attachment #547975 - Flags: review?(bhackett1024)
Attachment #547975 - Flags: review?(bhackett1024) → review+
Hmm, the new assertion is still tripping on some of the Mochitests. Shu, do you mind building a browser and looking into this?
This testcase still asserts at revision 62f32efb087c. -- function f(x) { try { try { } catch (e) { } } finally { } g(x); } f(); -- $ ./js -n -a test.js Assertion failure: until <= var.lifetime->start, at jsanalyze.cpp:1250
Attached patch fix & test 2 (obsolete) (deleted) — Splinter Review
ensureVariable shouldn't ensure variables that are already ensured. If variable is already ensured, should assert that it's to an even earlier point, since we walk the bytecode stream backwards.
Attached patch fix & test 2 (deleted) — Splinter Review
accidentally included unrelated changes
Attachment #548515 - Attachment is obsolete: true
Attachment #548516 - Flags: review+
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: