Closed Bug 723139 Opened 12 years ago Closed 12 years ago

IonMonkey: Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at ../jsval.h:416

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

Attached patch PatchSplinter Review
sunspider/check-3d-cube.js triggers this assert with --ion -n.

Tricky LSRA edge caase. If a block has multiple phis, and one phi reuses the dead stack slot of an input to another phi, we could add two conflicting moves to the predecessor exit movegroup, and we could move the new value to the stack slot before moving the (dead) stack value into a register.
Attachment #593468 - Flags: review?(dvander)
Comment on attachment 593468 [details] [diff] [review]
Patch

Review of attachment 593468 [details] [diff] [review]:
-----------------------------------------------------------------

Yuck. nice catch
Attachment #593468 - Flags: review?(dvander) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/835388761e17
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.