IonMonkey: Assertion failure: state[reg] == vr, at GreedyAllocator.cpp:252

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: adrake, Assigned: dvander)

Tracking

(Blocks: 2 bugs)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Reporter)

Description

7 years ago
Created attachment 548755 [details]
Test case

With greedy allocator enabled on x86 debug:

[adrake@reappropriated obj32]$ ./js --ion test.js
Assertion failure: state[reg] == vr, at /home/adrake/moz/ionmonkey/js/src/ion/GreedyAllocator.cpp:252
Aborted (core dumped)
(Reporter)

Comment 1

7 years ago
Created attachment 548913 [details]
Test case 2

This test case triggers the (I suspect) related assert:

Assertion failure: vr->reg() == reg, at GreedyAllocator.cpp:265

Updated

7 years ago
Blocks: 674689
No longer blocks: 650180
Created attachment 551277 [details] [diff] [review]
fix

The greedy allocator, since it allocates bottom-up, inserts restore code after each instruction that causes a spill. Unfortunately it could insert this code after control instructions which is totally wrong.

This patch refactors a little. The control instruction is allocated separately. If it causes any spills, the restores are inserted at the top of each outgoing edge that is not a backedge. Then, if the block is a backedge, its register state is captured for when we reach the header. (Before, it was captured earlier, but we don't want to insert a silly spill at the loop edge.)

Another option for this patch would be figuring out how to inject the moves in between the comparison and jump instruction, maybe by spilling control instructions up, but that sounds bleh.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #551277 - Flags: review?
Attachment #551277 - Flags: review? → review?(adrake)
(Reporter)

Updated

7 years ago
Blocks: 650180
Duplicate of this bug: 677074
(Reporter)

Updated

7 years ago
Attachment #551277 - Flags: review?(adrake) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/dba8607b243d
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.