Closed Bug 714727 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: (live->empty()), at LinearScan.cpp:632

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: dvander)

References

Details

Attachments

(1 file)

ion/inlining/inline-callarg-bailout-phi.js triggers this assert with --ion -n
This is a GVN bug. The greedy allocator does not assert but gives incorrect results for the following testcase:
--
function add(x, y) {
    var z;
    if (x & 0x1)
        z = x + y;
    else
        z = x + y;
    return z;
}

for(var i=0; i<100; i++) {
    print(add(i, i));
}
--
GVN removes the second x + y, which seems bogus.
MPhi::foldsTo looks at the value numbers of its operands, and if they are equal, the MPhi is folded to the first operand. The problem is, unlike ValueNumberer::findDominatingDef, this does not consider the dominator tree. So, for the testcase in comment 1, the phi is replaced with the first "x + y"...
Assignee: jdemooij → general
Status: ASSIGNED → NEW
Attached patch fixSplinter Review
Let's do the easy fix for now and just only eliminate phis based on ssa name, rather than value numbers.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #589329 - Flags: review?(jdemooij)
Attachment #589329 - Flags: review?(jdemooij) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/1d622f8be014
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.