583946 - JM: mochitest-plain assert on content/canvas/test/test_canvas.html

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

Assertion failure: !hasReg(reg), at c:\sources\moo\js\src\methodjit/MachineRegs.h:209
TEST-UNEXPECTED-FAIL | /tests/content/canvas/test/test_canvas.html | Exited with code -1073741819 during test run

Comment 1

[David Mandelin [:dmandelin]]

Attachment: Patch

This bug happened inside the ImmutableSync machinery:

1. All registers were used, and a register was needed to sync a type.
2. The search for a register first tried eax, but that had already been allocated in the immutable sync.
3. The search next tried ecx. The frame entry in the regstate was 0, so it was taken without requiring any spilling. But this was wrong, because that register was actually pinned.
3. After picking ecx and using it, the immutable sync marked ecx free.
4. Later, when we tried to sync the item that had been using ecx (and had pinned it), we asserted because we tried to free ecx again when it had already been freed.

Comment 2

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/projects/jaegermonkey/rev/cbcbca88f728