crash with `isdefined` inside try block inside loop

[JeffBezanson]

function f(refs)
    local x
    for r in refs
        try
            error()
        catch e
            if !@isdefined(x)
                x = []
            end
            push!(x, 1)
        end
    end
end

f(Any[1])

gives

signal (11): Segmentation fault
in expression starting at REPL[2]:1
jl_array_grow_end at /home/jeff/src/julia/src/array.c:916
_growend! at ./array.jl:825 [inlined]
push! at ./array.jl:873 [inlined]
f at /home/jeff/src/julia/crash.jl:10

in all julia versions since 1.0.

[vtjnash]

It looks like the SSA construction analysis doesn't annotate the ϒ and φᶜ types correctly:

julia> ir = (@code_typed optimize=false f(Any[1]))[1];

julia> sv = Core.Compiler.OptimizationState(Core.Compiler.method_instances(f, (Vector{Any},))[1], ir, Core.Compiler.Params(Base.get_world_counter()))

julia> Core.Compiler.just_construct_ssa(ir, ir.code, 2, sv)
2  1 ──       nothing::Any
3  │    %2  = _2::Array{Any,1}
   │    %3  = Base.iterate(%2)::Union{Nothing, Tuple{Any,Int64}}
   │    %4  = (%3 === nothing)::Bool
   │    %5  = Base.not_int(%4)::Bool
   └───       goto #10 if not %5
   2 ┄─ %29 = φ (#1 => #undef, #9 => %28)::Core.Compiler.MaybeUndef(Array{Any,1})
   │    %30 = φ (#1 => %3, #9 => %21)::Union{Nothing, Tuple{Any,Int64}}
   │    %31 = π (%30, Tuple{Any,Int64})
   │    %7  = %31::Tuple{Any,Int64}
   │          Core.getfield(%7, 1)::Any
   └─── %9  = Core.getfield(%7, 2)::Int64
4  3 ── %32 = ϒ (%29)::Array{Any,1}
   └─── %10 = $(Expr(:enter, #5))
5  4 ──       Main.error()::Union{}
   └───       unreachable
   5 ── %27 = φᶜ (%32)::Array{Any,1}
   └───       $(Expr(:leave, 1))
   6 ──       $(Expr(:the_exception))::Any
7  │    %15 = $(Expr(:isdefined, :(%27)))::Bool
   │    %16 = !%15::Bool
   └───       goto #8 if not %16
8  7 ── %18 = Base.vect()::Array{Any,1}
10 8 ┄─ %28 = φ (#7 => %18, #6 => %27)::Array{Any,1}
   │          $(Expr(:undefcheck, :x, :(%28)))::Any
   │          Main.push!(%28, 1)::Any
   │          $(Expr(:pop_exception, :(%10)))::Any
   │    %21 = Base.iterate(%2, %9)::Union{Nothing, Tuple{Any,Int64}}
   │    %22 = (%21 === nothing)::Bool
   │    %23 = Base.not_int(%22)::Bool
   └───       goto #10 if not %23
   9 ──       goto #2
   10 ┄       return nothing

[oxinabox]

Oooh, I wonder if this was one of the causes of
oxinabox/MagneticReadHead.jl#56 (comment)