Closed Bug 677041 Opened 11 years ago Closed 11 years ago

IonMonkey: Wrong result with lsra

Categories

(Core :: JavaScript Engine, defect)

x86_64
Windows 7
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: dvander, Assigned: adrake)

References

Details

Attachments

(1 file)

var f = function (y) {
    var x = y;
    for (var i = 0; i; i = i + 1) {
        x = x & i;
    }
    return x;
}
print(f(2));

Prints "NaN" instead of 2. There is a very weird exchange between ecx/edx on the edges of two branches and without that it looks correct.
Attached patch Patch v0Splinter Review
Fixes a thinko in the control flow resolution algorithm, as well as some related brain damage in live interval construction that I found in some other test cases.

I also added an assertion to catch escaping live registers, as I encountered several of these while debugging this problem, and they look a lot like LSRA bugs but are caused by emitAtUses brokenness. I will file a follow up bug for emitAtUses issues.
Assignee: general → adrake
Status: NEW → ASSIGNED
Attachment #551302 - Flags: review?(dvander)
Filed bug 677066 for issues with emitAtUses.
Attachment #551302 - Flags: review?(dvander) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/51da05c4a153
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.