One thing seems to have been slightly overlooked in the handling of ignoredResult(). Many functions pass their value of dst to BytecodeGenerator::emitNode() and then put its return value into a RefPtr. Unfortunately, many emitBytecode() Node member functions return their passed value of dst, which leads to a crash when attempting to increase the reference count of ignoredResult(). Here is an example of this: function f() { do try { } catch (o) { } while (false) { } } It seems that this problem was known, because there are many emitBytecode() functions that do something like if (dst == ignoredResult()) dst = 0; However, this seems like a suboptimal solution to the problem.
Geoff told me a pretty good solution to this bug. Make ignoredResult() an instance-specific register off of BytecodeGenerator, so that reffing it is legal. I think I will implement that.
Created attachment 25556 [details] Proposed patch (without tests) I'm gonna make some tests now.
Created attachment 25586 [details] Proposed patch This includes all of the cases that will crash that I am aware of.
Comment on attachment 25586 [details] Proposed patch This looks sane to me. But one of the SFX folks should probably review it.
Comment on attachment 25586 [details] Proposed patch r=me
Landed in r38930.