Note: There are a few cases of duplicates in user autocompletion which are being worked on.

IonMonkey: Assertion failure: JSVAL_IS_DOUBLE_IMPL(l), at ../jsval.h:416

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
Created attachment 593468 [details] [diff] [review]
Patch

sunspider/check-3d-cube.js triggers this assert with --ion -n.

Tricky LSRA edge caase. If a block has multiple phis, and one phi reuses the dead stack slot of an input to another phi, we could add two conflicting moves to the predecessor exit movegroup, and we could move the new value to the stack slot before moving the (dead) stack value into a register.
Attachment #593468 - Flags: review?(dvander)
Comment on attachment 593468 [details] [diff] [review]
Patch

Review of attachment 593468 [details] [diff] [review]:
-----------------------------------------------------------------

Yuck. nice catch
Attachment #593468 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

6 years ago
http://hg.mozilla.org/projects/ionmonkey/rev/835388761e17
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.