Closed Bug 697906 Opened 13 years ago Closed 12 years ago

IonMonkey: MoveResolver does not handle hairy cycles well

Categories

(Core :: JavaScript Engine, defect)

All
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: mjrosenb, Unassigned)

Details

Attachments

(1 file, 1 obsolete file)

Attached patch handle hairy cycles (obsolete) — Splinter Review
If we have the set of moves:
a -> b
b -> a
b -> c

depending on the ordering of the moves, we can emit 
b -> temp
a -> b
b -> c
temp -> a
which is wrong; we end up with the original value of a in c rather than the original value of b.
This happens by first choosing |b -> a|, then choosing |a->b|, since it conflicts, and in fact forms a cycle, and since it forms a cycle, we short circuit and immediately emit the |a->b| part of the cycle, then resolving the rest of the checks, never seeing if anything conflicts with |a->b|.
The patch removes this short circuiting.

Ideally, we won't use the temp at all, and just use the copied value of b, however that will require more thorough algorithmic changes.
Attachment #570128 - Flags: review?(dvander)
Patch is empty - wrong file?
Attachment #570128 - Attachment is obsolete: true
Attachment #570435 - Flags: review?(dvander)
Attachment #570435 - Flags: review?(dvander) → review+
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.