909276 - Assertion failure: *to != *moves_[i].to(), at jit/LIR.cpp:350 with backtracking register allocation

Status: RESOLVED DUPLICATE of bug 900683

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision 4887845b1142 (run with --ion-eager --ion-regalloc=backtracking):


function test() {
var actual = '';
for (var next = 0 of ignoreComments) {
  actual += a;
  for (var b in x) {
    actual += b.eval("args = [-0, NaN, -1/0]; this.f(-0, NaN, -1/0);");
  }
}
var y = Iterator([1,2,3], true);
for (var c in y) {}
} test();

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Related to bug 900683?

Comment 3

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 4

[Dan Gohman [:sunfish]]

Yes, I can confirm it's the same as bug 900683.