679794 - IonMonkey: Assertion failure: a.isGeneralReg(), at shared/CodeGenerator-shared-inl.h:51 (inside CodeGeneratorX64::visitDouble)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Nicolas B. Pierron [:nbp]]

Attachment: Test case

Asserts on attached test case on IonMonkey, 64-bit with greedy register allocator.

Comment 1

[Nicolas B. Pierron [:nbp]]

Attachment: Fix reported bug, temporary use a normal register to load immediate to xmm register.

Comment 2

[Nicolas B. Pierron [:nbp]]

Attachment: Greedy register allocator stack use DOUBLE_SLOT stack when the definition is a double.

previous patch cause the following failure lately.  The patch attached fix this new assertions and the test case is now running as expected.

Assertion failure: from->isDouble() == to->isDouble(), at /mnt/data/home/nicolas/mozilla/ionmonkey/js/src/ion/shared/CodeGenerator-x86-shared.cpp:292

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 553836 [details] [diff] [review]
Fix reported bug, temporary use a normal register to load immediate to xmm register.

Nice catch.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

The second patch appears to be empty - 

No review needed for test cases, just fold them into a patch. You can throw them in js/src/jit-tests/tests/ion

Comment 5

[Nicolas B. Pierron [:nbp]]

Attachment: Add test case and fix for x86_64.

This patch contains the test case and the 2 previous patches (including the content of the missing one).

This fix the bug for the greedy allocator on x86_64, It does not fix the assertion [1] raised when used with the linear scan register allocator.

[1] Assertion failure: a.isFloatReg(), at ../ion/shared/CodeGenerator-shared-inl.h:70

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

(Turns out the temp-double part of the patch had been obsoleted by bug 677339, but the rest applied.)

http://hg.mozilla.org/projects/ionmonkey/rev/6050e64e2903