Closed
Bug 678798
Opened 14 years ago
Closed 13 years ago
IonMonkey: GVN constant folding folds a^a + 1 to 0
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: adrake, Assigned: rpearl)
References
Details
Attachments
(2 files)
|
69 bytes,
application/javascript
|
Details | |
|
3.97 KB,
patch
|
adrake
:
review+
|
Details | Diff | Splinter Review |
Attached test case returns undefined, and should spin forever (while(1);) on ionmonkey tip x86 debug builds with GVN enabled.
|
Assignee | |
Comment 1•14 years ago
|
||
The issue is that folding creates a new node, without a value number. So, we decide that the constants are equal. Patch forthcoming.
Status: NEW → ASSIGNED
|
|
Assignee | |
Comment 2•13 years ago
|
||
With Bug 669793 fixed, we can take advantage of the values map not being cleared at the end of every pass, and use that to give a number to newly generated nodes.
Assignee: general → rpearl
Attachment #554267 -
Flags: review?(adrake)
|
Reporter | |
Updated•13 years ago
|
Attachment #554267 -
Flags: review?(adrake) → review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•