669575 - IonMonkey: Assertion failure: isRegister(), at IonLIR.h:725

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Andrew Drake [:adrake]]

Attachment: Test case

Asserts on attached test case on IonMonkey tip, 32-bit.

Comment 2

[Sean Stangl [:sstangl]]

Attachment: Reduced test case.

The attached reduced test case reproduces the assertion tripped in Comment 0. Manipulating this test case in obvious ways causes that failure point to oscillate between the original assertion and the new

Assertion failure: !freeRegs_.has(to.reg()), at /home/sstangl/dev/ionmonkey/js/src/ion/shared/MoveEmitter-x86-shared.cpp:288

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: test case 3

reduced from test case #1, still asserts

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fixes

There were a few typos here to get these cases all working:
 (1) There was an inverted check, causing registers to be allocated when none
     were available.
 (2) There was a call to LAllocation::toRegister() without checking if it was
     a register.
 (3) The backedge handling of phis occurred after killing phis.

Comment 5

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/projects/ionmonkey/rev/4de8f1841fea