Closed Bug 678798 Opened 10 years ago Closed 10 years ago

IonMonkey: GVN constant folding folds a^a + 1 to 0

Categories

(Core :: JavaScript Engine, defect)

x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: adrake, Assigned: rpearl)

References

(Blocks 1 open bug)

Details

Attachments

(2 files)

Attached file Test case
Attached test case returns undefined, and should spin forever (while(1);) on ionmonkey tip x86 debug builds with GVN enabled.
The issue is that folding creates a new node, without a value number. So, we decide that the constants are equal. Patch forthcoming.
Status: NEW → ASSIGNED
Depends on: 669793
Attached patch patch v0Splinter Review
With Bug 669793 fixed, we can take advantage of the values map not being cleared at the end of every pass, and use that to give a number to newly generated nodes.
Assignee: general → rpearl
Attachment #554267 - Flags: review?(adrake)
Attachment #554267 - Flags: review?(adrake) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/ab6b2e8db887
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.