jit-test/tests/ion/bug724975.js and box2d (bug 737647) trigger this assert.

The bytecode was very confusing, I had to look at the emitter to understand what's happening. For-loops start with either a JSOP_POP or JSOP_NOP, and the extra JSOP_NOP is only inserted if the loop starts with a JSOP_POP.

Comment on attachment 607927 [details] [diff] [review] Patch Review of attachment 607927 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/IonBuilder.cpp @@ +1755,5 @@ > bodyStart = GetNextPc(bodyStart); > } else { > // No loop condition, such as for(j = 0; ; j++) > + if (op != JSOP_NOP) { > + // If the loop starts with POP, we have to skip a NOP. comment-for-myself: This condition correspond to the code at frontend/BytecodeEmitter.cpp around line 4861 in EmitNormalFor function. if (forHead->pn_kid2) { /* Goto the loop condition, which branches back to iterate. */ jmp = EmitJump(cx, bce, JSOP_GOTO, 0); if (jmp < 0) return false; } else { if (op != JSOP_NOP && Emit1(cx, bce, JSOP_NOP) < 0) return false; }