The default bug view has changed. See this FAQ.

IonMonkey: Assertion failure: JSOp(*bodyStart) == JSOP_NOP, at IonBuilder.cpp:1758

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
jit-test/tests/ion/bug724975.js and box2d (bug 737647) trigger this assert.
(Assignee)

Comment 1

5 years ago
Created attachment 607927 [details] [diff] [review]
Patch

The bytecode was very confusing, I had to look at the emitter to understand what's happening. For-loops start with either a JSOP_POP or JSOP_NOP, and the extra JSOP_NOP is only inserted if the loop starts with a JSOP_POP.
Attachment #607927 - Flags: review?(nicolas.b.pierron)
Comment on attachment 607927 [details] [diff] [review]
Patch

Review of attachment 607927 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +1755,5 @@
>          bodyStart = GetNextPc(bodyStart);
>      } else {
>          // No loop condition, such as for(j = 0; ; j++)
> +        if (op != JSOP_NOP) {
> +            // If the loop starts with POP, we have to skip a NOP.

comment-for-myself:
This condition correspond to the code at frontend/BytecodeEmitter.cpp around line 4861 in EmitNormalFor function.

    if (forHead->pn_kid2) {
        /* Goto the loop condition, which branches back to iterate. */
        jmp = EmitJump(cx, bce, JSOP_GOTO, 0);
        if (jmp < 0)
            return false;
    } else {
        if (op != JSOP_NOP && Emit1(cx, bce, JSOP_NOP) < 0)
            return false;
    }
Attachment #607927 - Flags: review?(nicolas.b.pierron) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/083f0d4215c3
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.