Closed Bug 646001 Opened 13 years ago Closed 13 years ago

TI: Assertion failure: a->freeRegs.hasReg(reg), at ./methodjit/FrameState.cpp:1712

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: assertion, testcase)

The following code asserts on TI tip (run with -n -m -a), tested on 64 bit:

function jit(on)
{
  if (on && !options().match(/tracejit/)) { }
}
test();
function test( 
 ) 
{
  for (var j=0;j<5;++j) { switch(1.1) { case 2: case NaN: } }
  jit(false);
  reportCompare('xxxxxxx'.test(new j('(x+)(x*)')));
}


I'm not exactly sure what purpose the options() call here serves, but I wasn't able to remove it.
Missing edge case in the register allocator (which is sensitive to the calls and flow of the script, the actual behavior of options() is probably irrelevant).  When an inlined script branches, we need to make sure that the registers from the parent it preserves are consistent at the join point.  We didn't handle eviction when a parent's register had been synced and then reallocated to a different slot.

http://hg.mozilla.org/projects/jaegermonkey/rev/2d030f5157e5
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug646001.js.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.