Bug 863867 - Don't assume that two MDefs with the same value number are in the same congruence class (r=sstangl)
authorMarty Rosenberg <mjrosenb@mozilla.com>
Wed, 01 May 2013 10:01:55 -0700
changeset 141439 fab7a1635246e1a18d113c8d48208ba72d1b2b9d
parent 141438 c19ddcb42f6e2150347d5a1228d23a64fb09a19e
child 141440 95993aae5d96683971f22d8a06beca27ff1be599
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssstangl
bugs863867
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 863867 - Don't assume that two MDefs with the same value number are in the same congruence class (r=sstangl)
js/src/ion/ValueNumbering.h
js/src/jit-test/tests/asm.js/testBug863867.js
--- a/js/src/ion/ValueNumbering.h
+++ b/js/src/ion/ValueNumbering.h
@@ -104,18 +104,23 @@ class ValueNumberData : public TempObjec
     }
 
     uint32_t valueNumber() {
         return number;
     }
     // Set the class of this to the given representative value.
     void setClass(MDefinition *thisDef, MDefinition *rep) {
         JS_ASSERT(thisDef->valueNumberData() == this);
-        // If this value should already be in the given set, don't do anything
-        if (number == rep->valueNumber())
+        // If we are attempting to insert ourself, then nothing needs to be done.
+        // However, if the definition to be inserted already has the correct value number,
+        // it still needs to be inserted, since the value number needs to be updated lazily.
+        // this updating tactic can leave the world in a state where thisDef is not in the
+        // equivalence class of rep, but it has the same value number. Defs in this state
+        // need to be re-processed.
+        if (this == rep->valueNumberData())
             return;
 
         if (classNext)
             classNext->valueNumberData()->classPrev = classPrev;
         if (classPrev)
             classPrev->valueNumberData()->classNext = classNext;
 
 
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/testBug863867.js
@@ -0,0 +1,34 @@
+assertEq((function() {
+  'use asm';
+  function _main() {
+    var $1=0, $2=0, $3=0, $4=0, $5=0, $6=0, $7=0, $8=0, $9=0, $10=0, label=0;
+    label = 1;
+    while (1) {
+      switch (label | 0) {
+       case 1:
+        $2 = $1 + 14 | 0;
+        $3 = $1;
+        label = 20;
+        break;
+       case 20:
+        $5 = $2;
+        $4 = $3;
+        label = 24;
+        break;
+       case 24:
+        $7 = $5 + 1 | 0;
+        $8 = $4 + 1 | 0;
+        return $8|0;
+       case 49:
+        $9 = $6 + 1 | 0;
+        if ($10) {
+          $6 = $9;
+          break;
+        }
+        return 0;
+      }
+    }
+    return 0;
+  }
+  return _main;
+})()(), 1);