646001 - TI: Assertion failure: a->freeRegs.hasReg(reg), at ./methodjit/FrameState.cpp:1712

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following code asserts on TI tip (run with -n -m -a), tested on 64 bit:

function jit(on)
{
  if (on && !options().match(/tracejit/)) { }
}
test();
function test( 
 ) 
{
  for (var j=0;j<5;++j) { switch(1.1) { case 2: case NaN: } }
  jit(false);
  reportCompare('xxxxxxx'.test(new j('(x+)(x*)')));
}


I'm not exactly sure what purpose the options() call here serves, but I wasn't able to remove it.

Comment 1

[Brian Hackett [Laid off!]]

Missing edge case in the register allocator (which is sensitive to the calls and flow of the script, the actual behavior of options() is probably irrelevant).  When an inlined script branches, we need to make sure that the registers from the parent it preserves are consistent at the join point.  We didn't handle eviction when a parent's register had been synced and then reallocated to a different slot.

http://hg.mozilla.org/projects/jaegermonkey/rev/2d030f5157e5

Comment 2

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/jaeger/bug646001.js.