Closed Bug 582884 Opened 11 years ago Closed 11 years ago

JM: "Assertion failure: !hasReg(reg),"

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: gkw, Unassigned)

References

Details

(Keywords: assertion, regression, testcase)

(function () {
    x ^ x++
    var x
})()

asserts js debug shell on JM changeset 3700c42a8e82 with -m at Assertion failure: !hasReg(reg), at ../methodjit/MachineRegs.h:209
Appears to be a storeLocal bug after the uncopy is hit, but I didn't make it all the way through to the root cause. I can try and finish, but I figure dvander might have a good idea of what it is at a glance. LMK if that's not the case and I'll take it.
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug582884.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.