All users were logged out of Bugzilla on October 13th, 2018

IonMonkey: GVN constant folding folds a^a + 1 to 0

RESOLVED FIXED

Status

()

RESOLVED FIXED
7 years ago
7 years ago

People

(Reporter: adrake, Assigned: rpearl)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

7 years ago
Created attachment 552945 [details]
Test case

Attached test case returns undefined, and should spin forever (while(1);) on ionmonkey tip x86 debug builds with GVN enabled.
(Assignee)

Comment 1

7 years ago
The issue is that folding creates a new node, without a value number. So, we decide that the constants are equal. Patch forthcoming.
Status: NEW → ASSIGNED
(Assignee)

Updated

7 years ago
Depends on: 669793
(Assignee)

Comment 2

7 years ago
Created attachment 554267 [details] [diff] [review]
patch v0

With Bug 669793 fixed, we can take advantage of the values map not being cleared at the end of every pass, and use that to give a number to newly generated nodes.
Assignee: general → rpearl
Attachment #554267 - Flags: review?(adrake)
(Reporter)

Updated

7 years ago
Attachment #554267 - Flags: review?(adrake) → review+
(Assignee)

Comment 3

7 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/ab6b2e8db887
Status: ASSIGNED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.