Closed
Bug 697906
Opened 13 years ago
Closed 12 years ago
IonMonkey: MoveResolver does not handle hairy cycles well
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: mjrosenb, Unassigned)
Details
Attachments
(1 file, 1 obsolete file)
2.26 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
If we have the set of moves: a -> b b -> a b -> c depending on the ordering of the moves, we can emit b -> temp a -> b b -> c temp -> a which is wrong; we end up with the original value of a in c rather than the original value of b. This happens by first choosing |b -> a|, then choosing |a->b|, since it conflicts, and in fact forms a cycle, and since it forms a cycle, we short circuit and immediately emit the |a->b| part of the cycle, then resolving the rest of the checks, never seeing if anything conflicts with |a->b|. The patch removes this short circuiting. Ideally, we won't use the temp at all, and just use the copied value of b, however that will require more thorough algorithmic changes.
Attachment #570128 -
Flags: review?(dvander)
Patch is empty - wrong file?
Updated•13 years ago
|
Attachment #570128 -
Flags: review?(dvander)
Reporter | ||
Comment 2•13 years ago
|
||
Attachment #570128 -
Attachment is obsolete: true
Attachment #570435 -
Flags: review?(dvander)
Updated•13 years ago
|
Attachment #570435 -
Flags: review?(dvander) → review+
Updated•12 years ago
|
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•