Last Comment Bug 658579 - TI+JM: Assertion failure: !fe->data.inRegister(), at FrameState-inl.h:949
: TI+JM: Assertion failure: !fe->data.inRegister(), at FrameState-inl.h:949
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: general
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: infer-regress
  Show dependency treegraph
Reported: 2011-05-20 10:14 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-21 06:54 PDT (History)
3 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Jan de Mooij [:jandem] 2011-05-20 10:14:23 PDT
(function () {
    var x = 1 || 1.2;
    true ? ~x : x;
    x >> x;
$ ./js -m -n -a test.js
Assertion failure: !fe->data.inRegister(), at FrameState-inl.h:949

Revision aec367836312, 32-bit OS X.
Comment 1 User image Brian Hackett (:bhackett) 2011-05-21 06:54:04 PDT
For GETLOCAL followed by POP where the POP has incoming jumps, we treated the operation as a dead use of the local.  (We do this for normal 'JSOP_GETLOCAL POP' sequences because this bytecode is emitted at the head of scripts for each local, which screws up liveness information if not special cased.  A JSOP_DEFLOCAL would be a nice opcode to have to simplify this stuff).  This is correct to do, but broke register allocation invariants when merging state at the POP.

Note You need to log in before you can comment on or make changes to this bug.