Closed Bug 1133203 Opened 5 years ago Closed 5 years ago

Ion: LICM AssertRange failures

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla38
Tracking Status
firefox38 --- fixed

People

(Reporter: dougc, Assigned: dougc)

Details

Attachments

(1 file)

The compiler currently runs LICM before range analysis and before inserting AssertRange operations, but while exploring moving LICM after range analysis some runtime AssertRange failures occur. A quick look suggests it is related to them being hoisted, and removing setMovable() from the AssertRange initialization avoids these failures. Might be something to look into if LICM is ever moved after range analysis.
MAssertRange are based on the result of Beta nodes, which are temporary inserted based on the inferred range of branch conditions.

I think it would be good to prevent MAssertRange to be moved.
Me too. MAssertRange instructions are only inserted as part of --ion-check-range-analysis, so we don't need to worry about theoretical lost optimization opportunities.
Assignee: nobody → dtc-moz
Attachment #8565661 - Flags: review?(sunfish)
Comment on attachment 8565661 [details] [diff] [review]
No not flag AssertRange as movable.

Review of attachment 8565661 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good.
Attachment #8565661 - Flags: review?(sunfish) → review+
https://hg.mozilla.org/mozilla-central/rev/ae1dcb146f54
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
You need to log in before you can comment on or make changes to this bug.