With greedy allocator enabled on x86 debug: [adrake@reappropriated obj32]$ ./js --ion critical.js Assertion failure: *from != *to, at /home/adrake/moz/ionmonkey/js/src/ion/shared/CodeGenerator-x86-shared.cpp:213 Aborted (core dumped)

The assertion was caused by a stack -> stack move during phi node move resolution, when both stacks happened to be equal. Patch just doesn't emit a move, and adds an assertion to cause failure closer to point of use.

Comment on attachment 549295 [details] [diff] [review] Fix stack -> stack move where stacks are equal. Review of attachment 549295 [details] [diff] [review]: -----------------------------------------------------------------

This test case trips the new assert -- seems to be caused by phi resolution as well.

There are two bugs here. * Greedy allocator relies on block->id() < graph.numBlocks() and this regressed. * The register assignments to defs was left lying around after processing each block. We could make this work, clearing it lazily via peeking at |state|, but that strikes me as error-prone and scary. So now we just clear register assignments leaving a block, and restore them when merging state. I also introduced some asserts to catch errors earlier.

Comment on attachment 550835 [details] [diff] [review] fix Review of attachment 550835 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/GreedyAllocator.h @@ +301,5 @@ > RegisterSet allocatableRegs() const { > return RegisterSet::Intersect(state.free, RegisterSet::Not(disallowed)); > } > BlockInfo *blockInfo(LBlock *block) { > + JS_ASSERT(block->mir()->id() < graph.numBlocks()); This should be graph.numBlockIds() for sparse block IDs.