Closed Bug 674664 Opened 13 years ago Closed 13 years ago

IonMonkey: Assertion failure: def->virtualRegister() < graph.numVirtualRegisters(), at GreedyAllocator.cpp:58

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: dvander)

References

(Blocks 1 open bug)

Details

Attachments

(3 files, 1 obsolete file)

Attached file Test case
Attached test case asserts on x86 debug builds.
Attached file Test case 2
This one triggers the (I suspect) related assertion:

Assertion failure: use->virtualRegister() < graph.numVirtualRegisters(), at GreedyAllocator.h:296
Blocks: anion
No longer blocks: IonMonkey
Attached patch fix (obsolete) — Splinter Review
Situation: a predecessor is merging the state of its left and right successors. The left side has R0=Def1, and the right side has R1=Def1. We accidentally ignored this case and Def1 became assigned to both R0 and R1. As a fix I inserted a move in the right-hand block from R0 -> R1.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #550867 - Flags: review?(adrake)
Attachment #550867 - Flags: review?(adrake) → review+
Attached patch v2: better fixSplinter Review
I found another test case that broke this, turns out I missed a case.
Attachment #550867 - Attachment is obsolete: true
Attachment #550938 - Flags: review?(adrake)
Attachment #550938 - Flags: review?(adrake) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/481ad202043b
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.