Closed Bug 701508 Opened 13 years ago Closed 13 years ago

IonMonkey: Incorrect result from CallGeneric on x64

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: dvander, Assigned: dvander)

References

Details

Attachments

(2 files)

fix
(deleted), patch
sstangl
: review+
Details | Diff | Splinter Review
Fix typo in previous fix typo.
(deleted), patch
sstangl
: review+
Details | Diff | Splinter Review
This is failing jit-tests/tests/ion/bug670484.js on IM TBPL, x64 only, with --ion --ion-eager --ion-gvn=off. It might be a register allocation bug: 9 callgeneric ([x:9 (=rcx)]) (=rdx) t=([p:7 (=rbp)], [p:8 (=rbx)]) <|@ 0 movegroup ()[=rax -> =rcx] <|@ 10 return () (=rcx) <|@ This movegroup looks bad - it clobbers the outgoing return register with something bogus.
Attached patch fix (deleted) — — Splinter Review
My fault. I botched JSClobberMask last week.
Assignee: general → dvander
Status: NEW → ASSIGNED
Attachment #573707 - Flags: review?(sstangl)
Attachment #573707 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/736d52cc985c
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Attached patch Fix typo in previous fix typo. (deleted) — — Splinter Review
Attachment #573877 - Flags: review?(sstangl)
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Attachment #573877 - Flags: review?(sstangl) → review+
http://hg.mozilla.org/projects/ionmonkey/rev/ab790991e91f
Status: REOPENED → RESOLVED
Closed: 13 years ago → 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: