Assertion failure: !hasReg(reg), at c:\sources\moo\js\src\methodjit/MachineRegs.h:209 TEST-UNEXPECTED-FAIL | /tests/content/canvas/test/test_canvas.html | Exited with code -1073741819 during test run
Created attachment 462612 [details] [diff] [review] Patch This bug happened inside the ImmutableSync machinery: 1. All registers were used, and a register was needed to sync a type. 2. The search for a register first tried eax, but that had already been allocated in the immutable sync. 3. The search next tried ecx. The frame entry in the regstate was 0, so it was taken without requiring any spilling. But this was wrong, because that register was actually pinned. 3. After picking ecx and using it, the immutable sync marked ecx free. 4. Later, when we tried to sync the item that had been using ecx (and had pinned it), we asserted because we tried to free ecx again when it had already been freed.