Closed Bug 677867 Opened 13 years ago Closed 13 years ago

IonMonkey: Assertion failure: lhs->type() == rhs->type(), at Lowering.cpp:203

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: rpearl)

References

(Blocks 1 open bug)

Details

Attachments

(2 files)

Attached file Test case
Attached test case asserts on ionmonkey tip, x86 debug build. Turning off gvn or licm prevents this problem from manifesting, and changing the testcase slightly results in the (seemingly) related assertion:

Assertion failure: lhs->type() == MIRType_Int32, at Lowering.cpp:206
This assert doesn't happen with --ion-gvn=off and it looks like it might be related. All adds are well-typed leaving type analysis and not well typed leaving GVN.
Attached patch patch v0Splinter Review
The issue is that if we create an unbox of some value, producing a double, and an unbox of the same value to, say, an int32, GVN will mark them as congruent, when they shouldn't be.

The proposed patch takes types into account when performing congruence checking.
Assignee: general → rpearl
Status: NEW → ASSIGNED
Attachment #552219 - Flags: review?(dvander)
Attachment #552219 - Flags: review?(dvander) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/d96d02901f81
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.