Bug 1248503 - Fix initial heap assertion. r=nbp
authorJakob Stoklund Olesen <jolesen@mozilla.com>
Wed, 17 Feb 2016 10:17:49 -0800
changeset 284629 4d724d04700543803fa334e413a0373050bbda89
parent 284628 4e2494d7a16160ee139afdca2e6e487ccecca155
child 284630 0f1977ad30c69b233e837f275b9e8c20b8b148d7
push id17681
push usercbook@mozilla.com
push dateThu, 18 Feb 2016 13:04:48 +0000
treeherderfx-team@c0353b6aa70b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs1248503
milestone47.0a1
Bug 1248503 - Fix initial heap assertion. r=nbp Two MSimdBox instructions with the same SimdType must have identical template objects, but they do not need to have identical initial heaps. One could represent a pre-tenured SIMD object allocation. MozReview-Commit-ID: ITymizUKjlN
js/src/jit-test/tests/SIMD/bug1248503.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/SIMD/bug1248503.js
@@ -0,0 +1,13 @@
+function assertEqVec(v, w) {
+    [0].forEach(i => v, w);
+    function assertEqX4(...opts) {}
+}
+gczeal(1);
+function f() {
+    SIMD.Float32x4();
+    var i1 = SIMD.Int32x4();
+    for (j = 0; j < 100000; ++j, eval.eval)
+        assertEqVec(SIMD.Int32x4.check(i1), i1);
+}
+f();
+
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3476,17 +3476,19 @@ class MSimdBox
     }
 
     bool congruentTo(const MDefinition* ins) const override {
         if (!congruentIfOperandsEqual(ins))
             return false;
         const MSimdBox* box = ins->toSimdBox();
         if (box->simdType() != simdType())
             return false;
-        MOZ_ASSERT(box->initialHeap() == initialHeap());
+        MOZ_ASSERT(box->templateObject() == templateObject());
+        if (box->initialHeap() != initialHeap())
+            return false;
         return true;
     }
 
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
 
     void printOpcode(GenericPrinter& out) const override;