Last Comment Bug 714393 - IonMonkey: integer-2 fails with type inference assert
: IonMonkey: integer-2 fails with type inference assert
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: David Anderson [:dvander]
:
Mentors:
Depends on: 772795
Blocks: 677337
  Show dependency treegraph
 
Reported: 2011-12-30 17:10 PST by David Anderson [:dvander]
Modified: 2012-07-12 17:14 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
fix (33.53 KB, patch)
2012-01-03 20:08 PST, David Anderson [:dvander]
sstangl: review+
Details | Diff | Review

Description David Anderson [:dvander] 2011-12-30 17:10:31 PST
The bug is that we're respecializing integer math to double math which TI doesn't expect.
Comment 1 Jan de Mooij [:jandem] 2011-12-31 09:54:45 PST
TypeAnalyzer::analyze should probably not call determineSpecializations if TI is enabled, since we can get more precise information from TI. With this change, we will no longer call the "respecialize" and "specializeInputs" type policy methods, which I believe are responsible for propagating double types here.

Type analysis will still call insertConversions / TypePolicy::adjustInputs to insert conversion instructions, but that seems fine (and necessary).
Comment 2 David Anderson [:dvander] 2012-01-03 20:08:27 PST
Created attachment 585642 [details] [diff] [review]
fix

I don't really see the point of this analysis pass with TI. We could keep it for non-TI, but it's fairly complicated and not serving a useful purpose.

This patch removes all of it, save for phi specialization which was valuable.

 7 files changed, 105 insertions(+), 538 deletions(-)
Comment 3 Sean Stangl [:sstangl] 2012-01-04 13:36:43 PST
Comment on attachment 585642 [details] [diff] [review]
fix

Review of attachment 585642 [details] [diff] [review]:
-----------------------------------------------------------------

One of my favorite patches.

::: js/src/ion/IonAnalysis.cpp
@@ +183,5 @@
> +//
> +// Phi adjustment: If a phi's inputs are all the same type, the phi is
> +// specialized to return that type.
> +//
> +// Input adjustment: Each input is asked to apply conversion operations its

nit: to its

@@ +232,5 @@
> +        if (in->isPhi() && !in->toPhi()->triedToSpecialize())
> +            continue;
> +        if (type == MIRType_None)
> +            type = in->type();
> +        if (type != in->type())

nit: else if
Comment 4 David Anderson [:dvander] 2012-01-05 13:51:04 PST
http://hg.mozilla.org/projects/ionmonkey/rev/7d3ba6b88798

Note You need to log in before you can comment on or make changes to this bug.