IonMonkey: GVN constant folding folds a^a + 1 to 0

RESOLVED FIXED

Status

()

defect
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: adrake, Assigned: rpearl)

Tracking

(Blocks 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

Reporter

Description

8 years ago
Posted file Test case
Attached test case returns undefined, and should spin forever (while(1);) on ionmonkey tip x86 debug builds with GVN enabled.
Assignee

Comment 1

8 years ago
The issue is that folding creates a new node, without a value number. So, we decide that the constants are equal. Patch forthcoming.
Status: NEW → ASSIGNED
Assignee

Updated

8 years ago
Depends on: 669793
Assignee

Comment 2

8 years ago
Posted patch patch v0Splinter Review
With Bug 669793 fixed, we can take advantage of the values map not being cleared at the end of every pass, and use that to give a number to newly generated nodes.
Assignee: general → rpearl
Attachment #554267 - Flags: review?(adrake)
Reporter

Updated

8 years ago
Attachment #554267 - Flags: review?(adrake) → review+
Assignee

Comment 3

8 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/ab6b2e8db887
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.