Bug 1248503 - Fix initial heap assertion. r=nbp draft
authorJakob Stoklund Olesen <jolesen@mozilla.com>
Wed, 17 Feb 2016 10:17:49 -0800
changeset 331634 f130b356de408bbaeecf3ff1070266e0223d4aaa
parent 331633 b72d256b0623c662db460481ecea8786f818aed4
child 514416 bfb6d8b538c76590c14a55d2213bc605d92a36dc
push id11020
push userjolesen@mozilla.com
push dateWed, 17 Feb 2016 18:16:38 +0000
reviewersnbp
bugs1248503
milestone47.0a1
Bug 1248503 - Fix initial heap assertion. r=nbp Two MSimdBox instructions with the same SimdType must have identical template objects, but they do not need to have identical initial heaps. One could represent a pre-tenured SIMD object allocation. MozReview-Commit-ID: ITymizUKjlN
js/src/jit-test/tests/SIMD/bug1248503.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/SIMD/bug1248503.js
@@ -0,0 +1,13 @@
+function assertEqVec(v, w) {
+    [0].forEach(i => v, w);
+    function assertEqX4(...opts) {}
+}
+gczeal(1);
+function f() {
+    SIMD.Float32x4();
+    var i1 = SIMD.Int32x4();
+    for (j = 0; j < 100000; ++j, eval.eval)
+        assertEqVec(SIMD.Int32x4.check(i1), i1);
+}
+f();
+
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -3476,17 +3476,19 @@ class MSimdBox
     }
 
     bool congruentTo(const MDefinition* ins) const override {
         if (!congruentIfOperandsEqual(ins))
             return false;
         const MSimdBox* box = ins->toSimdBox();
         if (box->simdType() != simdType())
             return false;
-        MOZ_ASSERT(box->initialHeap() == initialHeap());
+        MOZ_ASSERT(box->templateObject() == templateObject());
+        if (box->initialHeap() != initialHeap())
+            return false;
         return true;
     }
 
     AliasSet getAliasSet() const override {
         return AliasSet::None();
     }
 
     void printOpcode(GenericPrinter& out) const override;