If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

JM: mochitest-plain assert on content/canvas/test/test_canvas.html

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: dmandelin, Assigned: dmandelin)

Tracking

Trunk
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

7 years ago
Assertion failure: !hasReg(reg), at c:\sources\moo\js\src\methodjit/MachineRegs.h:209
TEST-UNEXPECTED-FAIL | /tests/content/canvas/test/test_canvas.html | Exited with code -1073741819 during test run
(Assignee)

Comment 1

7 years ago
Created attachment 462612 [details] [diff] [review]
Patch

This bug happened inside the ImmutableSync machinery:

1. All registers were used, and a register was needed to sync a type.
2. The search for a register first tried eax, but that had already been allocated in the immutable sync.
3. The search next tried ecx. The frame entry in the regstate was 0, so it was taken without requiring any spilling. But this was wrong, because that register was actually pinned.
3. After picking ecx and using it, the immutable sync marked ecx free.
4. Later, when we tried to sync the item that had been using ecx (and had pinned it), we asserted because we tried to free ecx again when it had already been freed.
Attachment #462612 - Flags: review?(dvander)
Attachment #462612 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

7 years ago
http://hg.mozilla.org/projects/jaegermonkey/rev/cbcbca88f728
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.