Bug 1248503 - Fix initial heap assertion. r=nbp
Two MSimdBox instructions with the same SimdType must have identical template
objects, but they do not need to have identical initial heaps. One could
represent a pre-tenured SIMD object allocation.
MozReview-Commit-ID: ITymizUKjlN
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/SIMD/bug1248503.js
@@ -0,0 +1,13 @@
+function assertEqVec(v, w) {
+ [0].forEach(i => v, w);
+ function assertEqX4(...opts) {}
+}
+gczeal(1);
+function f() {
+ SIMD.Float32x4();
+ var i1 = SIMD.Int32x4();
+ for (j = 0; j < 100000; ++j, eval.eval)
+ assertEqVec(SIMD.Int32x4.check(i1), i1);
+}
+f();
+
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3476,17 +3476,19 @@ class MSimdBox
}
bool congruentTo(const MDefinition* ins) const override {
if (!congruentIfOperandsEqual(ins))
return false;
const MSimdBox* box = ins->toSimdBox();
if (box->simdType() != simdType())
return false;
- MOZ_ASSERT(box->initialHeap() == initialHeap());
+ MOZ_ASSERT(box->templateObject() == templateObject());
+ if (box->initialHeap() != initialHeap())
+ return false;
return true;
}
AliasSet getAliasSet() const override {
return AliasSet::None();
}
void printOpcode(GenericPrinter& out) const override;