IonMonkey: integer-2 fails with type inference assert

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: dvander, Assigned: dvander)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
The bug is that we're respecializing integer math to double math which TI doesn't expect.
TypeAnalyzer::analyze should probably not call determineSpecializations if TI is enabled, since we can get more precise information from TI. With this change, we will no longer call the "respecialize" and "specializeInputs" type policy methods, which I believe are responsible for propagating double types here.

Type analysis will still call insertConversions / TypePolicy::adjustInputs to insert conversion instructions, but that seems fine (and necessary).
(Assignee)

Comment 2

5 years ago
Created attachment 585642 [details] [diff] [review]
fix

I don't really see the point of this analysis pass with TI. We could keep it for non-TI, but it's fairly complicated and not serving a useful purpose.

This patch removes all of it, save for phi specialization which was valuable.

 7 files changed, 105 insertions(+), 538 deletions(-)
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #585642 - Flags: review?(sstangl)
Comment on attachment 585642 [details] [diff] [review]
fix

Review of attachment 585642 [details] [diff] [review]:
-----------------------------------------------------------------

One of my favorite patches.

::: js/src/ion/IonAnalysis.cpp
@@ +183,5 @@
> +//
> +// Phi adjustment: If a phi's inputs are all the same type, the phi is
> +// specialized to return that type.
> +//
> +// Input adjustment: Each input is asked to apply conversion operations its

nit: to its

@@ +232,5 @@
> +        if (in->isPhi() && !in->toPhi()->triedToSpecialize())
> +            continue;
> +        if (type == MIRType_None)
> +            type = in->type();
> +        if (type != in->type())

nit: else if
Attachment #585642 - Flags: review?(sstangl) → review+
(Assignee)

Comment 4

5 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/7d3ba6b88798
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Depends on: 772795
You need to log in before you can comment on or make changes to this bug.