Current SIMD implementation in Ion creates a lot of temporary objects (because of SimdBox and SimdUnbox), which leads LSRA to become crazy. In particular, I've hit a case where regalloc sees that all registers are busy at some point; then it chooses a register which is used fairly far away. But it never saves the value of the register onto the stack, nor does it reload it just before the far away use! Will post a few logs. This happens only with LSRA, not backtracking. Fortunately, backtracking is to become the default regalloc engine soon, but there are some chances that fuzzers hit this sometimes if/when they test LSRA...

This patch applies atop of mozilla-inbound 65a968102d6d To reproduce the issue, build and then run jit_test.py --tbpl ./dist/bin/js SIMD/ On my machine, a few test cases fail with LSRA, not with backtracking: FAILURES: --ion-eager --ion-offthread-compile=off /home/ben/code/moz/repo/js/src/jit-test/tests/SIMD/float32x4-binary-bitwise.js --ion-eager --ion-offthread-compile=off --ion-check-range-analysis --no-sse3 --no-threads /home/ben/code/moz/repo/js/src/jit-test/tests/SIMD/float32x4-binary-bitwise.js --ion-eager --ion-offthread-compile=off /home/ben/code/moz/repo/js/src/jit-test/tests/SIMD/float32x4-binary-arith.js --ion-eager --ion-offthread-compile=off --ion-check-range-analysis --no-sse3 --no-threads /home/ben/code/moz/repo/js/src/jit-test/tests/SIMD/float32x4-binary-arith.js

I'm sorry I can't give more than this file, which is a record of my gdb session. I've added breakpoints on the lane W accesses, the last one being the one that faults. Somehow, a register is clobbered while it shouldn't be, or the register isn't reloaded from the stack. Look for "HINT" in the log, there are two places where it matters: - at one place, a SimdExtractElementF:lane Z, which is working correctly, reloading the input from the stack just before the actual shuffle. - on the other place, a SimdExtractElementF:lane W, which isn't working correctly, as it doesn't reload the value before the shuffle instruction. Fortunately, bug 1112158 should mitigate this, by removing redundant SimdUnbox, which are the reason why so many registers are allocated here...

nbp says that might be helping those who have the gift of understanding the regalloc spew :)