Closed Bug 667601 Opened 13 years ago Closed 13 years ago

IonMonkey: assertion failure in register allocation

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: rpearl, Assigned: dvander)

References

Details

Attachments

(3 files)

testcase
110 bytes, application/x-javascript
Details
More minimal (a bit...) test case.
73 bytes, application/x-javascript
Details
fix
818 bytes, patch
adrake
: review+
Details | Diff | Splinter Review 
The attached test-case causes an assertion failure while performing greedy register allocation. 

Configured with --enable-debug --disable-optimize, and yields:

Assertion failure: !has(reg), at /Users/rpearl/projects/ionmonkey/js/src/ion/IonAssembler.h:168
Attached file testcase — 

    
    

    
  

      
      
      
      

        Attached patch
          
          
        fix
        — 
          — Splinter Review
      

    


  
The discouraged set is a hint of which registers to avoid evicting. By default "add" asserts that the register is not already in the set, but we can the same input for both operands.

        Attachment #542260 -
        Flags: review?

        Attachment #542260 -
        Flags: review? → review?(adrake)

        Attachment #542260 -
        Flags: review?(adrake) → review+

    
    

    
  
http://hg.mozilla.org/users/danderson_mozilla.com/ionmonkey/rev/b842614cdac7

I messed up the commit author and failed to notice, sorry!
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED

          You need to log in
          before you can comment on or make changes to this bug.