Closed Bug 714393 Opened 12 years ago Closed 12 years ago

IonMonkey: integer-2 fails with type inference assert

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: dvander, Assigned: dvander)

References

Details

Attachments

(1 file)

The bug is that we're respecializing integer math to double math which TI doesn't expect.
TypeAnalyzer::analyze should probably not call determineSpecializations if TI is enabled, since we can get more precise information from TI. With this change, we will no longer call the "respecialize" and "specializeInputs" type policy methods, which I believe are responsible for propagating double types here.

Type analysis will still call insertConversions / TypePolicy::adjustInputs to insert conversion instructions, but that seems fine (and necessary).
Attached patch fixSplinter Review
I don't really see the point of this analysis pass with TI. We could keep it for non-TI, but it's fairly complicated and not serving a useful purpose.

This patch removes all of it, save for phi specialization which was valuable.

 7 files changed, 105 insertions(+), 538 deletions(-)
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #585642 - Flags: review?(sstangl)
Comment on attachment 585642 [details] [diff] [review]
fix

Review of attachment 585642 [details] [diff] [review]:
-----------------------------------------------------------------

One of my favorite patches.

::: js/src/ion/IonAnalysis.cpp
@@ +183,5 @@
> +//
> +// Phi adjustment: If a phi's inputs are all the same type, the phi is
> +// specialized to return that type.
> +//
> +// Input adjustment: Each input is asked to apply conversion operations its

nit: to its

@@ +232,5 @@
> +        if (in->isPhi() && !in->toPhi()->triedToSpecialize())
> +            continue;
> +        if (type == MIRType_None)
> +            type = in->type();
> +        if (type != in->type())

nit: else if
Attachment #585642 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/7d3ba6b88798
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.