IonMonkey: Assertion failure: (live->empty()), at LinearScan.cpp:632

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Assigned: dvander)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
ion/inlining/inline-callarg-bailout-phi.js triggers this assert with --ion -n
(Reporter)

Comment 1

6 years ago
This is a GVN bug. The greedy allocator does not assert but gives incorrect results for the following testcase:
--
function add(x, y) {
    var z;
    if (x & 0x1)
        z = x + y;
    else
        z = x + y;
    return z;
}

for(var i=0; i<100; i++) {
    print(add(i, i));
}
--
GVN removes the second x + y, which seems bogus.
(Reporter)

Comment 2

6 years ago
MPhi::foldsTo looks at the value numbers of its operands, and if they are equal, the MPhi is folded to the first operand. The problem is, unlike ValueNumberer::findDominatingDef, this does not consider the dominator tree. So, for the testcase in comment 1, the phi is replaced with the first "x + y"...
(Reporter)

Updated

6 years ago
Assignee: jdemooij → general
Status: ASSIGNED → NEW
(Assignee)

Comment 3

6 years ago
Created attachment 589329 [details] [diff] [review]
fix

Let's do the easy fix for now and just only eliminate phis based on ssa name, rather than value numbers.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #589329 - Flags: review?(jdemooij)
(Reporter)

Updated

6 years ago
Attachment #589329 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 4

6 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/1d622f8be014
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.