582884 - JM: "Assertion failure: !hasReg(reg),"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(function () {
    x ^ x++
    var x
})()

asserts js debug shell on JM changeset 3700c42a8e82 with -m at Assertion failure: !hasReg(reg), at ../methodjit/MachineRegs.h:209

Comment 1

[Chris Leary [:cdleary] (not checking bugmail)]

Appears to be a storeLocal bug after the uncopy is hit, but I didn't make it all the way through to the root cause. I can try and finish, but I figure dvander might have a good idea of what it is at a glance. LMK if that's not the case and I'll take it.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/4e9eeb94a13a

Comment 3

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug582884.js.