Closed
Bug 674664
Opened 13 years ago
Closed 13 years ago
IonMonkey: Assertion failure: def->virtualRegister() < graph.numVirtualRegisters(), at GreedyAllocator.cpp:58
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: adrake, Assigned: dvander)
References
(Blocks 1 open bug)
Details
Attachments
(3 files, 1 obsolete file)
Attached test case asserts on x86 debug builds.
|
Reporter | |
Comment 1•13 years ago
|
||
This one triggers the (I suspect) related assertion:
Assertion failure: use->virtualRegister() < graph.numVirtualRegisters(), at GreedyAllocator.h:296
|
|
Reporter | |
Updated•13 years ago
|
|
Assignee | |
Comment 2•13 years ago
|
||
Situation: a predecessor is merging the state of its left and right successors. The left side has R0=Def1, and the right side has R1=Def1. We accidentally ignored this case and Def1 became assigned to both R0 and R1. As a fix I inserted a move in the right-hand block from R0 -> R1.
|
|
Reporter | |
Updated•13 years ago
|
Attachment #550867 -
Flags: review?(adrake) → review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
I found another test case that broke this, turns out I missed a case.
Attachment #550867 -
Attachment is obsolete: true
Attachment #550938 -
Flags: review?(adrake)
|
|
Reporter | |
Updated•13 years ago
|
Attachment #550938 -
Flags: review?(adrake) → review+
|
|
Assignee | |
Comment 4•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•