Last Comment Bug 701508 - IonMonkey: Incorrect result from CallGeneric on x64
: IonMonkey: Incorrect result from CallGeneric on x64
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86_64 Linux
: -- normal (vote)
: ---
Assigned To: David Anderson [:dvander]
:
Mentors:
: 701554 (view as bug list)
Depends on:
Blocks: 677337
  Show dependency treegraph
 
Reported: 2011-11-10 13:51 PST by David Anderson [:dvander]
Modified: 2011-11-11 14:49 PST (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (3.45 KB, patch)
2011-11-10 17:20 PST, David Anderson [:dvander]
sstangl: review+
Details | Diff | Review
Fix typo in previous fix typo. (2.95 KB, patch)
2011-11-11 11:58 PST, Nicolas B. Pierron [:nbp]
sstangl: review+
Details | Diff | Review

Description David Anderson [:dvander] 2011-11-10 13:51:03 PST
This is failing jit-tests/tests/ion/bug670484.js on IM TBPL, x64 only, with --ion --ion-eager --ion-gvn=off. It might be a register allocation bug:

      9 callgeneric ([x:9 (=rcx)]) (=rdx) t=([p:7 (=rbp)], [p:8 (=rbx)]) <|@
      0 movegroup ()[=rax -> =rcx] <|@
      10 return () (=rcx) <|@

This movegroup looks bad - it clobbers the outgoing return register with something bogus.
Comment 1 David Anderson [:dvander] 2011-11-10 17:18:35 PST
*** Bug 701554 has been marked as a duplicate of this bug. ***
Comment 2 David Anderson [:dvander] 2011-11-10 17:20:21 PST
Created attachment 573707 [details] [diff] [review]
fix

My fault. I botched JSClobberMask last week.
Comment 3 David Anderson [:dvander] 2011-11-10 17:38:04 PST
http://hg.mozilla.org/projects/ionmonkey/rev/736d52cc985c
Comment 4 Nicolas B. Pierron [:nbp] 2011-11-11 11:58:17 PST
Created attachment 573877 [details] [diff] [review]
Fix typo in previous fix typo.
Comment 5 Sean Stangl [:sstangl] 2011-11-11 14:49:21 PST
http://hg.mozilla.org/projects/ionmonkey/rev/ab790991e91f

Note You need to log in before you can comment on or make changes to this bug.