673710 - Assertion failure: top != 0, at jsopcode.cpp:1154

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {
    a[1, 2]++;
}
f.toString();
--
$ ./js test.js
Assertion failure: top != 0, at jsopcode.cpp:1154

JM repository, revision 4fbb36c1c9a3, 32-bit OS X. 
I have not bisected this but I'm pretty sure it's bug 647624.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Here's another testcase:

+(function() {
    w([] = "", c--)()
})

Assertion failure: top != 0,

Comment 3

[Brian Hackett [Laid off!]]

Problem when decompiling portions of a script, where in the big switch we could end up in a situation where the pc points to an op which is followed by a decomposed version, but the case that has actually been processed was something totally different (from an '&&', '||' or ',' expression).  This fix just moves the decomposed check into the individual cases which have (or might have) decomposed versions.

It would be nice if the invariants in Decompile() were clearer.  There are several variables that look vaguely related to the current op (pc, len, oplen, op, cs), and it's not clear at all what relationships these have to one another.

http://hg.mozilla.org/projects/jaegermonkey/rev/7e5a5d2e28f8