Last Comment Bug 714393 - IonMonkey: integer-2 fails with type inference assert
: IonMonkey: integer-2 fails with type inference assert
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
-- normal (vote)
: ---
Assigned To: David Anderson [:dvander]
: Jason Orendorff [:jorendorff]
Depends on: 772795
Blocks: 677337
  Show dependency treegraph
Reported: 2011-12-30 17:10 PST by David Anderson [:dvander]
Modified: 2012-07-12 17:14 PDT (History)
2 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

fix (33.53 KB, patch)
2012-01-03 20:08 PST, David Anderson [:dvander]
sstangl: review+
Details | Diff | Splinter Review

Description User image David Anderson [:dvander] 2011-12-30 17:10:31 PST
The bug is that we're respecializing integer math to double math which TI doesn't expect.
Comment 1 User image Jan de Mooij [:jandem] 2011-12-31 09:54:45 PST
TypeAnalyzer::analyze should probably not call determineSpecializations if TI is enabled, since we can get more precise information from TI. With this change, we will no longer call the "respecialize" and "specializeInputs" type policy methods, which I believe are responsible for propagating double types here.

Type analysis will still call insertConversions / TypePolicy::adjustInputs to insert conversion instructions, but that seems fine (and necessary).
Comment 2 User image David Anderson [:dvander] 2012-01-03 20:08:27 PST
Created attachment 585642 [details] [diff] [review]

I don't really see the point of this analysis pass with TI. We could keep it for non-TI, but it's fairly complicated and not serving a useful purpose.

This patch removes all of it, save for phi specialization which was valuable.

 7 files changed, 105 insertions(+), 538 deletions(-)
Comment 3 User image Sean Stangl [:sstangl] 2012-01-04 13:36:43 PST
Comment on attachment 585642 [details] [diff] [review]

Review of attachment 585642 [details] [diff] [review]:

One of my favorite patches.

::: js/src/ion/IonAnalysis.cpp
@@ +183,5 @@
> +//
> +// Phi adjustment: If a phi's inputs are all the same type, the phi is
> +// specialized to return that type.
> +//
> +// Input adjustment: Each input is asked to apply conversion operations its

nit: to its

@@ +232,5 @@
> +        if (in->isPhi() && !in->toPhi()->triedToSpecialize())
> +            continue;
> +        if (type == MIRType_None)
> +            type = in->type();
> +        if (type != in->type())

nit: else if
Comment 4 User image David Anderson [:dvander] 2012-01-05 13:51:04 PST

Note You need to log in before you can comment on or make changes to this bug.