Closed Bug 669575 Opened 10 years ago Closed 10 years ago
Monkey: Assertion failure: is Register(), at Ion LIR .h:725
Asserts on attached test case on IonMonkey tip, 32-bit.
The attached reduced test case reproduces the assertion tripped in Comment 0. Manipulating this test case in obvious ways causes that failure point to oscillate between the original assertion and the new Assertion failure: !freeRegs_.has(to.reg()), at /home/sstangl/dev/ionmonkey/js/src/ion/shared/MoveEmitter-x86-shared.cpp:288
reduced from test case #1, still asserts
Assignee: general → dvander
Status: NEW → ASSIGNED
There were a few typos here to get these cases all working: (1) There was an inverted check, causing registers to be allocated when none were available. (2) There was a call to LAllocation::toRegister() without checking if it was a register. (3) The backedge handling of phis occurred after killing phis.
Attachment #551217 - Flags: review?(adrake)
Attachment #551217 - Flags: review?(adrake) → review+
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.