Closed
Bug 674507
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: state[reg] == vr, at GreedyAllocator.cpp:252
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: adrake, Assigned: dvander)
References
(Blocks 2 open bugs)
Details
Attachments
(3 files)
With greedy allocator enabled on x86 debug: [adrake@reappropriated obj32]$ ./js --ion test.js Assertion failure: state[reg] == vr, at /home/adrake/moz/ionmonkey/js/src/ion/GreedyAllocator.cpp:252 Aborted (core dumped)
Reporter | ||
Comment 1•13 years ago
|
||
This test case triggers the (I suspect) related assert: Assertion failure: vr->reg() == reg, at GreedyAllocator.cpp:265
Updated•13 years ago
|
Assignee | ||
Comment 2•13 years ago
|
||
The greedy allocator, since it allocates bottom-up, inserts restore code after each instruction that causes a spill. Unfortunately it could insert this code after control instructions which is totally wrong. This patch refactors a little. The control instruction is allocated separately. If it causes any spills, the restores are inserted at the top of each outgoing edge that is not a backedge. Then, if the block is a backedge, its register state is captured for when we reach the header. (Before, it was captured earlier, but we don't want to insert a silly spill at the loop edge.) Another option for this patch would be figuring out how to inject the moves in between the comparison and jump instruction, maybe by spilling control instructions up, but that sounds bleh.
Assignee | ||
Updated•13 years ago
|
Attachment #551277 -
Flags: review? → review?(adrake)
Reporter | ||
Updated•13 years ago
|
Attachment #551277 -
Flags: review?(adrake) → review+
Assignee | ||
Comment 4•13 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/dba8607b243d
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•