"ASSERTION FAILED: type != Continue" with do/while and try/finally

[Jesse Ruderman]

This script:

  do try { continue; } finally { } while (0);

triggers an assertion failure in a Debug ToT testksj:

ASSERTION FAILED: type != Continue
(/Users/jruderman/WebKit/JavaScriptCore/kjs/ExecState.h:117 void KJS::ExecState::setCompletionType(KJS::ComplType))

The script doesn't seem to cause any problems in a Release (as opposed to Debug) build.

[Mark Rowe (bdash)]

<rdar://problem/5806712>

[Mark Rowe (bdash)]

TryNode::execute saves the current completion type before executing the "finally" block, and then uses setCompletionType to restore it afterwards:

    if (m_finallyBlock) {
        ComplType savedCompletionType = exec->completionType();
        JSValue* finallyResult = m_finallyBlock->execute(exec);
        if (exec->completionType() != Normal)
            result = finallyResult;
        else
            exec->setCompletionType(savedCompletionType);
    }

setCompletionType is implemented thusly:
        // Only for use in the implementation of execute().
        void setCompletionType(ComplType type)
        {
            ASSERT(type != Break);
            ASSERT(type != Continue);
            m_completionType = type;
        }

I suspect that this could lead to an actual bug in a release build if a targeted break or continue was used inside the "finally" block, as the target is not saved and restored.

[Mark Rowe (bdash)]

Yup, the following code behaves differently in JSCore vs SpiderMonkey:

do {
  try {
    print('continuing outer loop');
    continue;
  } finally {
    innerLoop:
    while (1) {
      print('breaking out of innerLoop');
      break innerLoop;
    }
  }
} while (1);

JSCore prints:
continuing outer loop
breaking out of innerLoop

and then exits.  SpiderMonkey prints:
continuing outer loop
breaking out of innerLoop
continuing outer loop
breaking out of innerLoop
continuing outer loop
breaking out of innerLoop
[.. and so on ..]


When the outer DoWhileNode checks exec->breakOrContinueTarget(), the target is still set to "innerLoop" from the break statement within the "finally" block.

[Cameron Zwarich (cpst)]

This is fixed by SquirrelFish. I will write a layout test for this bug and some similar issues that came up during SquirrelFish development.

[Cameron Zwarich (cpst)]

Created attachment 21588 [details]
Test cases

Here are some test cases so we can close this bug.

[Oliver Hunt]

Comment on attachment 21588 [details]
Test cases

r=me

[Cameron Zwarich (cpst)]

Landed in r34461.