Created attachment 548755 [details] Test case With greedy allocator enabled on x86 debug: [adrake@reappropriated obj32]$ ./js --ion test.js Assertion failure: state[reg] == vr, at /home/adrake/moz/ionmonkey/js/src/ion/GreedyAllocator.cpp:252 Aborted (core dumped)
Created attachment 548913 [details] Test case 2 This test case triggers the (I suspect) related assert: Assertion failure: vr->reg() == reg, at GreedyAllocator.cpp:265
Created attachment 551277 [details] [diff] [review] fix The greedy allocator, since it allocates bottom-up, inserts restore code after each instruction that causes a spill. Unfortunately it could insert this code after control instructions which is totally wrong. This patch refactors a little. The control instruction is allocated separately. If it causes any spills, the restores are inserted at the top of each outgoing edge that is not a backedge. Then, if the block is a backedge, its register state is captured for when we reach the header. (Before, it was captured earlier, but we don't want to insert a silly spill at the loop edge.) Another option for this patch would be figuring out how to inject the moves in between the comparison and jump instruction, maybe by spilling control instructions up, but that sounds bleh.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #551277 - Flags: review?
7 years ago
Attachment #551277 - Flags: review? → review?(adrake)
7 years ago
Duplicate of this bug: 677074
Attachment #551277 - Flags: review?(adrake) → review+
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.