IonMonkey: Assertion failure: isRegister(), at IonLIR.h:725

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: adrake, Assigned: dvander)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(4 attachments)

Reporter

Description

8 years ago
Posted file Test case
Asserts on attached test case on IonMonkey tip, 32-bit.
Reporter

Updated

8 years ago
Blocks: IonMonkey
Reporter

Updated

8 years ago
Duplicate of this bug: 669577
Posted file Reduced test case.
The attached reduced test case reproduces the assertion tripped in Comment 0. Manipulating this test case in obvious ways causes that failure point to oscillate between the original assertion and the new

Assertion failure: !freeRegs_.has(to.reg()), at /home/sstangl/dev/ionmonkey/js/src/ion/shared/MoveEmitter-x86-shared.cpp:288
Blocks: anion
No longer blocks: IonMonkey
Posted file test case 3
reduced from test case #1, still asserts
Assignee: general → dvander
Status: NEW → ASSIGNED
Posted patch fixesSplinter Review
There were a few typos here to get these cases all working:
 (1) There was an inverted check, causing registers to be allocated when none
     were available.
 (2) There was a call to LAllocation::toRegister() without checking if it was
     a register.
 (3) The backedge handling of phis occurred after killing phis.
Attachment #551217 - Flags: review?(adrake)
Reporter

Updated

8 years ago
Attachment #551217 - Flags: review?(adrake) → review+
Reporter

Updated

8 years ago
Blocks: IonMonkey
No longer blocks: anion
http://hg.mozilla.org/projects/ionmonkey/rev/4de8f1841fea
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.