Closed Bug 674506 Opened 13 years ago Closed 13 years ago

IonMonkey: Assertion failure: *from != *to, at CodeGenerator-x86-shared.cpp:213

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: dvander)

References

(Blocks 1 open bug)

Details

Attachments

(3 files, 1 obsolete file)

Attached file Test case
With greedy allocator enabled on x86 debug:

[adrake@reappropriated obj32]$ ./js --ion critical.js 
Assertion failure: *from != *to, at /home/adrake/moz/ionmonkey/js/src/ion/shared/CodeGenerator-x86-shared.cpp:213
Aborted (core dumped)
The assertion was caused by a stack -> stack move during phi node move resolution, when both stacks happened to be equal. Patch just doesn't emit a move, and adds an assertion to cause failure closer to point of use.
Attachment #549295 - Flags: review?(adrake)
Comment on attachment 549295 [details] [diff] [review]
Fix stack -> stack move where stacks are equal.

Review of attachment 549295 [details] [diff] [review]:
-----------------------------------------------------------------
Attachment #549295 - Flags: review?(adrake) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/18eaec755ec5
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attached file Test case 2
This test case trips the new assert -- seems to be caused by phi resolution as well.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Blocks: anion
No longer blocks: IonMonkey
Attached patch fixSplinter Review
There are two bugs here.
 * Greedy allocator relies on block->id() < graph.numBlocks() and this regressed.
 * The register assignments to defs was left lying around after processing each
   block. We could make this work, clearing it lazily via peeking at |state|, but
   that strikes me as error-prone and scary. So now we just clear register
   assignments leaving a block, and restore them when merging state.

I also introduced some asserts to catch errors earlier.
Assignee: general → dvander
Attachment #549295 - Attachment is obsolete: true
Status: REOPENED → ASSIGNED
Attachment #550835 - Flags: review?(adrake)
Comment on attachment 550835 [details] [diff] [review]
fix

Review of attachment 550835 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/GreedyAllocator.h
@@ +301,5 @@
>      RegisterSet allocatableRegs() const {
>          return RegisterSet::Intersect(state.free, RegisterSet::Not(disallowed));
>      }
>      BlockInfo *blockInfo(LBlock *block) {
> +        JS_ASSERT(block->mir()->id() < graph.numBlocks());

This should be graph.numBlockIds() for sparse block IDs.
Attachment #550835 - Flags: review?(adrake) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/2ee4cdc9856b
Status: ASSIGNED → RESOLVED
Closed: 13 years ago13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.