IonMonkey: Assertion failure: lhs->type() == rhs->type(), at Lowering.cpp:203

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: adrake, Assigned: rpearl)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

7 years ago
Created attachment 552043 [details]
Test case

Attached test case asserts on ionmonkey tip, x86 debug build. Turning off gvn or licm prevents this problem from manifesting, and changing the testcase slightly results in the (seemingly) related assertion:

Assertion failure: lhs->type() == MIRType_Int32, at Lowering.cpp:206
This assert doesn't happen with --ion-gvn=off and it looks like it might be related. All adds are well-typed leaving type analysis and not well typed leaving GVN.
(Assignee)

Comment 2

7 years ago
Created attachment 552219 [details] [diff] [review]
patch v0

The issue is that if we create an unbox of some value, producing a double, and an unbox of the same value to, say, an int32, GVN will mark them as congruent, when they shouldn't be.

The proposed patch takes types into account when performing congruence checking.
Assignee: general → rpearl
Status: NEW → ASSIGNED
Attachment #552219 - Flags: review?(dvander)
Attachment #552219 - Flags: review?(dvander) → review+
(Assignee)

Comment 3

7 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/d96d02901f81
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.