Closed
Bug 714393
Opened 12 years ago
Closed 12 years ago
IonMonkey: integer-2 fails with type inference assert
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: dvander, Assigned: dvander)
References
Details
Attachments
(1 file)
33.53 KB,
patch
|
sstangl
:
review+
|
Details | Diff | Splinter Review |
The bug is that we're respecializing integer math to double math which TI doesn't expect.
Comment 1•12 years ago
|
||
TypeAnalyzer::analyze should probably not call determineSpecializations if TI is enabled, since we can get more precise information from TI. With this change, we will no longer call the "respecialize" and "specializeInputs" type policy methods, which I believe are responsible for propagating double types here. Type analysis will still call insertConversions / TypePolicy::adjustInputs to insert conversion instructions, but that seems fine (and necessary).
Assignee | ||
Comment 2•12 years ago
|
||
I don't really see the point of this analysis pass with TI. We could keep it for non-TI, but it's fairly complicated and not serving a useful purpose. This patch removes all of it, save for phi specialization which was valuable. 7 files changed, 105 insertions(+), 538 deletions(-)
Comment 3•12 years ago
|
||
Comment on attachment 585642 [details] [diff] [review] fix Review of attachment 585642 [details] [diff] [review]: ----------------------------------------------------------------- One of my favorite patches. ::: js/src/ion/IonAnalysis.cpp @@ +183,5 @@ > +// > +// Phi adjustment: If a phi's inputs are all the same type, the phi is > +// specialized to return that type. > +// > +// Input adjustment: Each input is asked to apply conversion operations its nit: to its @@ +232,5 @@ > + if (in->isPhi() && !in->toPhi()->triedToSpecialize()) > + continue; > + if (type == MIRType_None) > + type = in->type(); > + if (type != in->type()) nit: else if
Attachment #585642 -
Flags: review?(sstangl) → review+
Assignee | ||
Comment 4•12 years ago
|
||
http://hg.mozilla.org/projects/ionmonkey/rev/7d3ba6b88798
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•