Closed
Bug 676999
Opened 13 years ago
Closed 13 years ago
IonMonkey: Ensure phi length == numPredecessors().
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Assigned: sstangl)
Details
Attachments
(4 files)
The attached test case is represented by a graph (attached on next comment) wherein the terminal block has 3 predecessors (from the while, the break, and the other break) but its phi(y:undefined, y:x) node joins only two values, because we eliminate redundant phi entries. This causes us to index past the MPhi array bounds, when one of the predecessors attempts to peek into the phi.
Assignee | ||
Comment 1•13 years ago
|
||
Assignee | ||
Comment 2•13 years ago
|
||
Assignee | ||
Comment 3•13 years ago
|
||
This patch does not result in the generation of extraneous phi nodes, since the phi must have already been created in the first place for there to be redundancies.
Attachment #551212 -
Flags: review?(dvander)
Assignee | ||
Updated•13 years ago
|
Summary: IonMonkey: → IonMonkey: Ensure phi length == numPredecessors().
Comment on attachment 551212 [details] [diff] [review] Don't eliminate redundant arguments to phi nodes. Review of attachment 551212 [details] [diff] [review]: ----------------------------------------------------------------- Ah, I had completely misunderstood what you were referring to when you explained this bug to me. Yeah, this was totally wrong.
Attachment #551212 -
Flags: review?(dvander) → review+
Assignee | ||
Comment 5•13 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/8e87a05785d6
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•