All TAGE-like branch predictors have an assertion which fails when the branch target is 0xffffffffffffffff. This actually happens in normal workloads. Consider the following O3CPU trace where the target of an indirect branch is unexpectedly set to 0xffffffffffffffff during speculative execution:
A simpler way to reproduce this assertion failure would be using the following piece of code which jumps to 0xffffffffffffffff intentionally. The correct result should be a translation fault reported by guest OS rather than an assertion failure.
Also reported in gem5-users.