Closed Bug 737818 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: JSOp(*bodyStart) == JSOP_NOP, at IonBuilder.cpp:1758

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

jit-test/tests/ion/bug724975.js and box2d (bug 737647) trigger this assert.
Attached patch PatchSplinter Review
The bytecode was very confusing, I had to look at the emitter to understand what's happening. For-loops start with either a JSOP_POP or JSOP_NOP, and the extra JSOP_NOP is only inserted if the loop starts with a JSOP_POP.
Attachment #607927 - Flags: review?(nicolas.b.pierron)
Comment on attachment 607927 [details] [diff] [review]
Patch

Review of attachment 607927 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +1755,5 @@
>          bodyStart = GetNextPc(bodyStart);
>      } else {
>          // No loop condition, such as for(j = 0; ; j++)
> +        if (op != JSOP_NOP) {
> +            // If the loop starts with POP, we have to skip a NOP.

comment-for-myself:
This condition correspond to the code at frontend/BytecodeEmitter.cpp around line 4861 in EmitNormalFor function.

    if (forHead->pn_kid2) {
        /* Goto the loop condition, which branches back to iterate. */
        jmp = EmitJump(cx, bce, JSOP_GOTO, 0);
        if (jmp < 0)
            return false;
    } else {
        if (op != JSOP_NOP && Emit1(cx, bce, JSOP_NOP) < 0)
            return false;
    }
Attachment #607927 - Flags: review?(nicolas.b.pierron) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/083f0d4215c3
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: