TM: Deal with double/int mismatches between caller and callee trees.

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
10 years ago
10 years ago

People

(Reporter: gal, Unassigned)

Tracking

unspecified
x86
Mac OS X
Points:
---
Bug Flags:
in-testsuite -
in-litmus -

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

10 years ago
If the outer tree sinks an i2f promotion into the side exit, we have to undo that and actually store a float value if the called tree expects to see a double there. This patch tries to do that:

http://hg.mozilla.org/index.cgi/tracemonkey/rev/4ef12bfb7948

This patch is buggy though, since it changes what we store into a float, but the snapshot in prepareTreeCall still thinks is an int and stores it as int.

Also, the patch doesn't deal with the reverse situation, which is an inner tree with an int and the outer tree having the value in a double register. This seems to hit at least fannkuch.

Both cases need to be handled properly.
(Reporter)

Comment 1

10 years ago
Fix: http://hg.mozilla.org/tracemonkey/index.cgi/rev/9ce88c583712

Still doesn't solve double outer int inner. We should trash the inner tree and flag the slot in the oracle as double.
(Reporter)

Comment 2

10 years ago
Fixed for double outer int inner as well (test case in trace-test.js)

http://hg.mozilla.org/index.cgi/tracemonkey/rev/2f39c79606d9
Status: NEW → RESOLVED
Last Resolved: 10 years ago
Resolution: --- → FIXED
Flags: in-testsuite-
Flags: in-litmus-
You need to log in before you can comment on or make changes to this bug.