677041 - IonMonkey: Wrong result with lsra

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

var f = function (y) {
    var x = y;
    for (var i = 0; i; i = i + 1) {
        x = x & i;
    }
    return x;
}
print(f(2));

Prints "NaN" instead of 2. There is a very weird exchange between ecx/edx on the edges of two branches and without that it looks correct.

Comment 1

[Andrew Drake [:adrake]]

Attachment: Patch v0

Fixes a thinko in the control flow resolution algorithm, as well as some related brain damage in live interval construction that I found in some other test cases.

I also added an assertion to catch escaping live registers, as I encountered several of these while debugging this problem, and they look a lot like LSRA bugs but are caused by emitAtUses brokenness. I will file a follow up bug for emitAtUses issues.

Comment 2

[Andrew Drake [:adrake]]

Filed bug 677066 for issues with emitAtUses.

Comment 3

[Andrew Drake [:adrake]]

http://hg.mozilla.org/projects/ionmonkey/rev/51da05c4a153