User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.1) Gecko/20090716 Ubuntu/9.04 (jaunty) Shiretoko/3.5.1 Build Identifier: The nanojit ARM backend does not support patching in jump targets for backwards conditional jumps. In debug builds, an assert is tripped. In non-debug builds, incorrect code is generated. Reproducible: Always Steps to Reproduce: 1. Set up an ARM environment. 2. Build a debug build of tracemonkey. 3. Try to use nanojit to generate code with a backwards conditional jump. Actual Results: The following assert is tripped: Assertion failed: (_t != 0) || (_c == AL) (../nanojit/NativeARM.cpp:1657) Expected Results: An assert not being tripped

Attached is a program that causes the ARM nanojit backend to fail. If it is placed in the js/src directory of tracemonkey, it can be built by running 'g++ -DDEBUG -g3 -Wno-invalid-offsetof -include js-confdefs.h -I dist/include/ -I.. -I ../nanojit -o backedge ../backedge.cpp libjs_static.a' in a tracemonkey debug object directory.

This only sort of blocks my inline threading work (Bug 506182). inline threading needs to make backwards conditional jumps, but I currently have a functional workaround (generating unconditional backwards jumps and jumping over them with a forwards conditional if we do not want to take the branch). Having to do this workaround is pretty unfortunate.

still issue? needs confirmation

Tracemonkey had this issue, but they recently (~Oct20th) absorbed tamarin patching code and so it has been fixed. see bug 523262 for details

Engineering work item. Marking as verified.