846317 - OdinMonkey: Assertion failure: false (Unexpected asm.js return type), at ion/Lowering.cpp:2455

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on odinmonkey revision 81e75bf7046e (run with ):


var asm = (function(global, env, buffer) {
  'use asm';
  var abort=env.abort;
  function _free(i1) {
    i1 = i1 | 0;
    var i2 = 0, i4 = 0, i34 = 0;
    if (i4 >>> 0 < 256) {
      return abort();
    } while (0);
  }
  return {};
}, buffer);

Comment 1

[Luke Wagner [:luke]]

Ah, great find!  There are separate "return void" and "return value" instructions and the wrong one was being emitted for "return f()" where f() returns void.

http://hg.mozilla.org/users/lwagner_mozilla.com/odinmonkey/rev/64f1812ccb6c

Comment 2

[Jesse Ruderman]

> the wrong one was being emitted for "return f()" where f() returns void

But in this testcase, f() returns unknown, not void!  So we have a second bug here.

Filed bug 878526.