Subj : Crash: JSOP_IFEQX
To   : netscape.public.mozilla.jseng
From : Oscar
Date : Tue Sep 07 2004 07:16 pm

Hi all, Brendan especially

I mange, once again, to get SM to crash.



The scripts I am compiling are very small (they are derivatives of an
original script):

One version of the set of script is:



if (1 == 0) {
  a = a;
}
else {
  a=b.c.d;
  switch(e) {
  case 's':

//  case 't':
   break;
  }
}

Compilation does not complain (not that it should...) but during the
interpret phase of execution SM crash, asserts or behaves really strange.



The the OP Codes that are executed when interpreting the script above are:

JSOP_ONE
JSOP_ZERO
JSOP_EQ
JSOP_IFEQX (cond == JS_FALSE) and len = 11
JSOP_SETNAME  **********************  -> sm asserts



When running the same script without commenting the line "case 't'" i
instead get:



JSOP_ONE
JSOP_ZERO
JSOP_EQ
JSOP_IFEQX (cond == JS_FALSE) and len = 15
JSOP_GOTOX len = 42 *********** ->no more opcodes are executed since pc ==
end_pc



For a layman like me it is not obvious why the length of the IFEQX jump
should differ in the two examples above, I'm sure that this is completely
kosher, but I don't understand why. I wonder if anyone could point me in the
direction of some documentation of this part of SM?



Does this problem description ring a bell? Has it possibly been fixed? I
have looked through the release notes but havn't found anything.



Can anyone tell what the correct len of the IFEQX jump would be in the above
mentioned case and what OP CODE that should follow the jump?



It seems that the IFEQX code is set in optimizespandepth calls. Is there any
documentation of this function?



I am using SM 1.5 RC 5 (JavaScript-C 1.5 pre-release 5 2003-01-10)

Compiling using VC 6



Best regards

Oscar

.