716753 - IonMonkey: Stack allocation bugs in GRA

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Two more bugs in GRA stack allocation:
 (1) uses in snapshots are not held live across loops
 (2) we can accidentally free half of a nunbox as a normal stack slot (they must be freed as a whole)

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fixes

Comment 2

[Sean Stangl [:sstangl]]

Comment on attachment 587218 [details] [diff] [review]
fixes

Review of attachment 587218 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/GreedyAllocator.cpp
@@ +793,5 @@
> +            if (!a->isUse())
> +                continue;
> +            VirtualRegister *vr = getVirtualRegister(a->toUse());
> +            if (vr->def->virtualRegister() < lowerBound || vr->def->virtualRegister() > upperBound)
> +                allocateStack(vr);

Duplicates code above, which isn't fashionable.
void findLoopCarriedUses(LAllocation *, uint32, uint32)?

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/0a8aee9639cf w/ nits