Closed Bug 674507 Opened 8 years ago Closed 8 years ago

IonMonkey: Assertion failure: state[reg] == vr, at GreedyAllocator.cpp:252

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: dvander)

References

(Blocks 2 open bugs)

Details

Attachments

(3 files)

Attached file Test case
With greedy allocator enabled on x86 debug:

[adrake@reappropriated obj32]$ ./js --ion test.js
Assertion failure: state[reg] == vr, at /home/adrake/moz/ionmonkey/js/src/ion/GreedyAllocator.cpp:252
Aborted (core dumped)
Attached file Test case 2
This test case triggers the (I suspect) related assert:

Assertion failure: vr->reg() == reg, at GreedyAllocator.cpp:265
Blocks: anion
No longer blocks: IonMonkey
Attached patch fixSplinter Review
The greedy allocator, since it allocates bottom-up, inserts restore code after each instruction that causes a spill. Unfortunately it could insert this code after control instructions which is totally wrong.

This patch refactors a little. The control instruction is allocated separately. If it causes any spills, the restores are inserted at the top of each outgoing edge that is not a backedge. Then, if the block is a backedge, its register state is captured for when we reach the header. (Before, it was captured earlier, but we don't want to insert a silly spill at the loop edge.)

Another option for this patch would be figuring out how to inject the moves in between the comparison and jump instruction, maybe by spilling control instructions up, but that sounds bleh.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #551277 - Flags: review?
Attachment #551277 - Flags: review? → review?(adrake)
Blocks: IonMonkey
Duplicate of this bug: 677074
Attachment #551277 - Flags: review?(adrake) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/dba8607b243d
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.