IonMonkey: Assertion failure: def->virtualRegister() < graph.numVirtualRegisters(), at GreedyAllocator.cpp:58

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: adrake, Assigned: dvander)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments, 1 obsolete attachment)

Reporter

Description

8 years ago
Posted file Test case
Attached test case asserts on x86 debug builds.
Reporter

Comment 1

8 years ago
Posted file Test case 2
This one triggers the (I suspect) related assertion:

Assertion failure: use->virtualRegister() < graph.numVirtualRegisters(), at GreedyAllocator.h:296
Reporter

Updated

8 years ago
Blocks: anion
No longer blocks: IonMonkey
Posted patch fix (obsolete) — Splinter Review
Situation: a predecessor is merging the state of its left and right successors. The left side has R0=Def1, and the right side has R1=Def1. We accidentally ignored this case and Def1 became assigned to both R0 and R1. As a fix I inserted a move in the right-hand block from R0 -> R1.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #550867 - Flags: review?(adrake)
Reporter

Updated

8 years ago
Attachment #550867 - Flags: review?(adrake) → review+
I found another test case that broke this, turns out I missed a case.
Attachment #550867 - Attachment is obsolete: true
Attachment #550938 - Flags: review?(adrake)
Reporter

Updated

8 years ago
Attachment #550938 - Flags: review?(adrake) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/481ad202043b
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.