1133203 - Ion: LICM AssertRange failures

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Douglas Crosher [:dougc]]

The compiler currently runs LICM before range analysis and before inserting AssertRange operations, but while exploring moving LICM after range analysis some runtime AssertRange failures occur. A quick look suggests it is related to them being hoisted, and removing setMovable() from the AssertRange initialization avoids these failures. Might be something to look into if LICM is ever moved after range analysis.

Comment 1

[Nicolas B. Pierron [:nbp]]

MAssertRange are based on the result of Beta nodes, which are temporary inserted based on the inferred range of branch conditions.

I think it would be good to prevent MAssertRange to be moved.

Comment 2

[Dan Gohman [:sunfish]]

Me too. MAssertRange instructions are only inserted as part of --ion-check-range-analysis, so we don't need to worry about theoretical lost optimization opportunities.

Comment 3

[Douglas Crosher [:dougc]]

Attachment: No not flag AssertRange as movable.

Comment 4

[Dan Gohman [:sunfish]]

Comment on attachment 8565661 [details] [diff] [review]
No not flag AssertRange as movable.

Review of attachment 8565661 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good.

Comment 5

[Douglas Crosher [:dougc]]

Requesting checkin. Try run:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=a3d890356c61

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ae1dcb146f54

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ae1dcb146f54