There is an ASSERT(!value); line at Source/JavaScriptCore/jit/JITOpcodes.cpp:1627 which works on most of the platforms but fails on MIPS as value == regT0 and regT0 is not the first register (int(regT0) != 0) on MIPS.
Created attachment 171088 [details] ASSERT fix. As value variable is const (const RegisterID value = regT0;) after quick look I would remove the ASSERT line but anyway I created a patch to make it work on MIPS in debug mode. Feel free to throw it out :)
Created attachment 173095 [details] ASSERT fix.
Comment on attachment 173095 [details] ASSERT fix. View in context: https://bugs.webkit.org/attachment.cgi?id=173095&action=review > Source/JavaScriptCore/jit/JITOpcodes.cpp:1631 > ASSERT(!value); Can't this just be ASSERT(value == regT0) ?
Created attachment 173099 [details] ASSERT fix. Simple fix :)
(In reply to comment #3) > (From update of attachment 173095 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=173095&action=review > > > Source/JavaScriptCore/jit/JITOpcodes.cpp:1631 > > ASSERT(!value); > > Can't this just be ASSERT(value == regT0) ? Yes, works, new patch added. Is this ASSERT useful for a const variable? Assembly code could hurt it?
Comment on attachment 173099 [details] ASSERT fix. The assertion is intended to prevent anyone from trying to use a different register for value, as the profiling logic in the baseline jit always assumes regT0 contains the value and t1 the tag (if appropriate)
Comment on attachment 173099 [details] ASSERT fix. Clearing flags on attachment: 173099 Committed r133950: <http://trac.webkit.org/changeset/133950>
All reviewed patches have been landed. Closing bug.