Closed Bug 1311287 Opened 3 years ago Closed 3 years ago

wasm: Baseline JIT forgets to free register after setglobal

Categories

(Core :: JavaScript Engine: JIT, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla52
Tracking Status
firefox52 --- fixed

People

(Reporter: lth, Assigned: lth)

References

Details

Attachments

(1 file)

Test case:

new WebAssembly.Module(wasmTextToBinary(`(module
 (global $mut_local (mut i32) (i32.const 0))
 (global $imm_local i32 (i32.const 37))
 (import $imported "globals" "x" (global i32))
 (func $get (result i32)
  i32.const 13
  set_global $mut_local
  get_global $imported
  get_global $mut_local
  i32.add
  get_global $imm_local
  i32.add
 )
 (export "run" $get)
)`));

This asserts:
Assertion failure: isAvailable(r), at /code/mozilla-inbound/js/src/asmjs/WasmBaselineCompile.cpp:657

The reason is that the joinReg is not available, and the reason it is not available is that it got used by setglobal but not freed.
Free the register after setGlobal.

(In general I think we want an assertion in the main decoding loop that checks that the registers are invariant: at the outset, we have some register set, and after each iteration the union of the available registers and the registers on the evaluation stack equals the initial register set.  That's followup work.)
Attachment #8802441 - Flags: review?(bbouvier)
Comment on attachment 8802441 [details] [diff] [review]
bug1311287-free-reg.patch

Review of attachment 8802441 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #8802441 - Flags: review?(bbouvier) → review+
https://hg.mozilla.org/mozilla-central/rev/e2da3bb6654f
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
You need to log in before you can comment on or make changes to this bug.