Closed Bug 667601 Opened 10 years ago Closed 10 years ago

IonMonkey: assertion failure in register allocation

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: rpearl, Assigned: dvander)

References

Details

Attachments

(3 files)

The attached test-case causes an assertion failure while performing greedy register allocation. 

Configured with --enable-debug --disable-optimize, and yields:

Assertion failure: !has(reg), at /Users/rpearl/projects/ionmonkey/js/src/ion/IonAssembler.h:168
Attached file testcase
Attached patch fixSplinter Review
The discouraged set is a hint of which registers to avoid evicting. By default "add" asserts that the register is not already in the set, but we can the same input for both operands.
Attachment #542260 - Flags: review?
Attachment #542260 - Flags: review? → review?(adrake)
Attachment #542260 - Flags: review?(adrake) → review+
http://hg.mozilla.org/users/danderson_mozilla.com/ionmonkey/rev/b842614cdac7

I messed up the commit author and failed to notice, sorry!
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.