IonMonkey: assertion failure in register allocation

RESOLVED FIXED

Status

()

RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: rpearl, Assigned: dvander)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

7 years ago
The attached test-case causes an assertion failure while performing greedy register allocation. 

Configured with --enable-debug --disable-optimize, and yields:

Assertion failure: !has(reg), at /Users/rpearl/projects/ionmonkey/js/src/ion/IonAssembler.h:168
(Reporter)

Comment 1

7 years ago
Created attachment 542257 [details]
testcase
(Reporter)

Comment 2

7 years ago
Created attachment 542259 [details]
More minimal (a bit...) test case.
Created attachment 542260 [details] [diff] [review]
fix

The discouraged set is a hint of which registers to avoid evicting. By default "add" asserts that the register is not already in the set, but we can the same input for both operands.
Attachment #542260 - Flags: review?
Attachment #542260 - Flags: review? → review?(adrake)

Updated

7 years ago
Attachment #542260 - Flags: review?(adrake) → review+
http://hg.mozilla.org/users/danderson_mozilla.com/ionmonkey/rev/b842614cdac7

I messed up the commit author and failed to notice, sorry!
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.