880512 - ARM: Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp with "use asm"

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

(function () {
    "use asm";
    function f(d0, d1) {
        d0 = +d0;
        d1 = +d1
    }
    return f
})()

asserts js debug shell on m-c changeset 7e3a4ebcf067 with --ion-eager --ion-regalloc=backtracking at Assertion failure: !minimalInterval(interval), at ion/BacktrackingAllocator.cpp

Setting needinfo from Brian as this involves --ion-regalloc=backtracking.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   http://hg.mozilla.org/mozilla-central/rev/8f3f965dc116
user:        Douglas Crosher
date:        Mon Mar 25 18:22:45 2013 +1100
summary:     Bug 840285 - ARM support for Ion asm.js (r=luke,mjrosenb also landing some of doug crosher's patches)

(not sure if this is correct)

Comment 2

[Douglas Crosher [:dougc]]

This patch was the first time that asm.js was enabled for the ARM, and helps confirm that the issue is related to the asm.js specific code paths.  Something to look into, thanks.

Comment 3

[Dan Gohman [:sunfish]]

The arm backend has d1 as the second floating-point argument register, however d1 is the scratch register and is not marked allocatable. LinearScan seems to cope with this somehow, but Backtracking is not happy about it.

One approach might be to teach the Backtracking allocator to copy the argument into a different register immediately, but that seems unfortunate. How feasible would it be to make the ARM backend use a different register for its floating-point scratch register? One of d8 through d14, so that it isn't an argument register or the NaN register?

Comment 4

[Dan Gohman [:sunfish]]

I can now confirm that the patch in bug 937944 is sufficient to fix this testcase.

Comment 5

[Dan Gohman [:sunfish]]

With bug 937944 fixed, this is now fixed.