The default bug view has changed. See this FAQ.

IonMonkey: MoveResolver does not handle hairy cycles well

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: mjrosenb, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

6 years ago
Created attachment 570128 [details] [diff] [review]
handle hairy cycles

If we have the set of moves:
a -> b
b -> a
b -> c

depending on the ordering of the moves, we can emit 
b -> temp
a -> b
b -> c
temp -> a
which is wrong; we end up with the original value of a in c rather than the original value of b.
This happens by first choosing |b -> a|, then choosing |a->b|, since it conflicts, and in fact forms a cycle, and since it forms a cycle, we short circuit and immediately emit the |a->b| part of the cycle, then resolving the rest of the checks, never seeing if anything conflicts with |a->b|.
The patch removes this short circuiting.

Ideally, we won't use the temp at all, and just use the copied value of b, however that will require more thorough algorithmic changes.
Attachment #570128 - Flags: review?(dvander)
Patch is empty - wrong file?
Attachment #570128 - Flags: review?(dvander)
(Reporter)

Comment 2

6 years ago
Created attachment 570435 [details] [diff] [review]
Handle hairy cycles (for real)
Attachment #570128 - Attachment is obsolete: true
Attachment #570435 - Flags: review?(dvander)
Attachment #570435 - Flags: review?(dvander) → review+
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.