Closed Bug 1798246 Opened 2 years ago Closed 2 years ago

[loong64] Some jit-tests failed due to scratch register usage conflict: Assertion failure: !this->has(reg), at js/src/jit/RegisterSets.h:820

Categories

(Core :: JavaScript Engine: JIT, defect, P3)

Other
Unspecified
defect

Tracking

()

RESOLVED FIXED
108 Branch
Tracking Status
firefox-esr102 --- unaffected
firefox106 --- unaffected
firefox107 --- unaffected
firefox108 --- fixed

People

(Reporter: zhaojiazhong-hf, Assigned: zhaojiazhong-hf)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression)

Attachments

(1 file)

Some jit-tests failed on loongarch64 platform after Bug 1794439 - Inline HasNativeDataPropertyPure cache lookup in Ion r?jandem is landed:

basic/dictionary-delete-compact.js
cacheir/has.js
ion/hasOwn-megamorphic.js
ion/has-definite-folding.js
ion/testStringMatch.js
--enable-watchtower watchtower/megamorphic-long-proto-chain.js

js::jit::SpecializedRegSet<js::jit::AllocatableSetAccessors<js::jit::RegisterSet>, js::jit::RegisterSet>::add (this=<optimized out>, reg=...)
at /mnt/zjz/workspace/mozilla/mozilla-central/js/src/jit/RegisterSets.h:820
820 MOZ_ASSERT(!this->has(reg));

And it's because the patch introduced a new function MacroAssembler::loadAtomOrSymbolAndHash, which requires SecondScratchRegister twice on loongarch64 by ScratchTagScope and branchTest32.

  1. Change the scratch registers management strategy of loong64 port may fix it, but it's kind of big change, and needs time to implement.
  2. We can also work around this issue by adjust the MacroAssembler::loadAtomOrSymbolAndHash function, and reduce the scope of ScratchTagScope tag, so it could release SecondScratchRegister before function branchTest32 is called.

Currently, I prefer the second way.

Blocks: 1757272
Regressed by: 1794439

This is a workaround for scratch register usage conflict issue on loongarch64.

Assignee: nobody → zhaojiazhong-hf
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true

Set release status flags based on info from the regressing bug 1794439

Pushed by jdemooij@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/5dc6a7bca27e
Reduce ScratchTagScope in function loadAtomOrSymbolAndHash. r=dthayer,jandem
Severity: -- → S3
Priority: -- → P3
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 108 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: