461612 - TM: false-positive demotions due to lack of isPromoteInt

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

Using the one-line patch in this bug I hit the assert in missingArgTest in trace-tests.js.

We check isPromoteInt in snapshot() but use isi2f() in verifyTypeStability.  This seems like an inconsistency.  I think we should be doing isPromoteInt and f2i in verifyTypeStability - will try a patch soon.



diff -r 70ee16681444 js/src/jstracer.cpp
--- a/js/src/jstracer.cpp       Fri Oct 24 22:47:29 2008 -0500
+++ b/js/src/jstracer.cpp       Fri Oct 24 23:59:37 2008 -0500
@@ -1904,6 +1904,7 @@
         if (!isNumber(v))
             return false; /* not a number? type mismatch */
         LIns* i = get(&v);
+        JS_ASSERT(isi2f(i) || !isPromoteInt(i));
         if (!isi2f(i)) {
             debug_only_v(printf("int slot is !isInt32, slot #%d, triggering re-compilation\n",
                                 !isGlobal(&v)

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

5ms perf win on my linux machine - linux machine is really crappy and inconsistent, you may wish to verify

Comment 2

[Andreas Gal :gal]

Comment on attachment 344724 [details] [diff] [review]
proposed fix

That code is from way back. The fix looks a lot more reasonable.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed changeset http://hg.mozilla.org/tracemonkey/rev/8f115498ac2a