Bug 1248503 - Fix initial heap assertion. r?nbp draft
authorJakob Stoklund Olesen <jolesen@mozilla.com>
Tue, 16 Feb 2016 11:13:30 -0800
changeset 331333 1d8db27f3ed828ec74b2b0b75f6c981a23583ee2
parent 331332 73eef28fd4e74dd528c20d86a1ccc7b01ab118e1
child 514355 745b14f38bcf6ebc2ff0c0ccc4ddf2e51742578c
push id10956
push userjolesen@mozilla.com
push dateTue, 16 Feb 2016 19:12:12 +0000
reviewersnbp
bugs1248503
milestone47.0a1
Bug 1248503 - Fix initial heap assertion. r?nbp Two MSimdBox instructions with the same SimdType must have identical template objects, but they do not need to have identical initial heaps. One could represent a pre-tenured SIMD object allocation. MozReview-Commit-ID: 5yEyArfFeNm
js/src/jit-test/tests/SIMD/bug1248503.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/SIMD/bug1248503.js
@@ -0,0 +1,13 @@
+function assertEqVec(v, w) {
+    [0].forEach(i => v, w);
+    function assertEqX4(...opts) {}
+}
+gczeal(1);
+function f() {
+    SIMD.Float32x4();
+    var i1 = SIMD.Int32x4();
+    for (j = 0; j < 100000; ++j, eval.eval)
+        assertEqVec(SIMD.Int32x4.check(i1), i1);
+}
+f();
+
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3476,17 +3476,19 @@ class MSimdBox
     }
 
     bool congruentTo(const MDefinition* ins) const override {
         if (!congruentIfOperandsEqual(ins))
             return false;
         const MSimdBox* box = ins->toSimdBox();
         if (box->simdType() != simdType())
             return false;
-        MOZ_ASSERT(box->initialHeap() == initialHeap());
+        MOZ_ASSERT(box->templateObject() == templateObject());
+        if (box->initialHeap() != initialHeap())
+            return false;
         return true;
     }
 
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
 
     void printOpcode(GenericPrinter& out) const override;