IonMonkey: Assertion "!hasFlags(1 << LoopInvariant)" during LICM

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: sstangl, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
The following on x86 trips an assertion during LICM when calling 'ins->setLoopInvariant()' in Loop::optimize():

js> function f() { while (1) while (1) return 0; }
js> f()
Assertion failure: !hasFlags(1 << LoopInvariant), at /home/sstangl/dev/ionmonkey/js/src/ion/MIR.h:294

Comment 1

6 years ago
Created attachment 548633 [details]
.cfg file for that test case

Could be a problem with MIR generation? The MIR CFG doesn't look correct to me.  There's only 1 backedge.  I could be wrong, though.

Comment 2

6 years ago
Fixed.  Not a problem with MIRGen.

http://hg.mozilla.org/projects/ionmonkey/rev/181d31b8aa2d
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.