Closed Bug 669575 Opened 10 years ago Closed 10 years ago

IonMonkey: Assertion failure: isRegister(), at IonLIR.h:725

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: dvander)

References

(Blocks 1 open bug)

Details

Attachments

(4 files)

Attached file Test case
Asserts on attached test case on IonMonkey tip, 32-bit.
Blocks: IonMonkey
Duplicate of this bug: 669577
Attached file Reduced test case.
The attached reduced test case reproduces the assertion tripped in Comment 0. Manipulating this test case in obvious ways causes that failure point to oscillate between the original assertion and the new

Assertion failure: !freeRegs_.has(to.reg()), at /home/sstangl/dev/ionmonkey/js/src/ion/shared/MoveEmitter-x86-shared.cpp:288
Blocks: anion
No longer blocks: IonMonkey
Attached file test case 3
reduced from test case #1, still asserts
Assignee: general → dvander
Status: NEW → ASSIGNED
Attached patch fixesSplinter Review
There were a few typos here to get these cases all working:
 (1) There was an inverted check, causing registers to be allocated when none
     were available.
 (2) There was a call to LAllocation::toRegister() without checking if it was
     a register.
 (3) The backedge handling of phis occurred after killing phis.
Attachment #551217 - Flags: review?(adrake)
Attachment #551217 - Flags: review?(adrake) → review+
Blocks: IonMonkey
No longer blocks: anion
http://hg.mozilla.org/projects/ionmonkey/rev/4de8f1841fea
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.