Backed out changeset c19247505a48 (bug 1357024) for crashes in test_ShortestPaths_01.html.
authorRyan VanderMeulen <ryanvm@gmail.com>
Wed, 26 Apr 2017 11:51:57 -0400
changeset 396058 70012c15c9428d2c8186befaa8da038dd28257ee
parent 396057 c19247505a48b4353ba4f4115daa88181d66108e
child 396059 9831b9a4dcdcae70ed4eecffd58ee9aadf17b435
push id1468
push userasasaki@mozilla.com
push dateMon, 05 Jun 2017 19:31:07 +0000
treeherdermozilla-release@0641fc6ee9d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1357024
milestone54.0
backs outc19247505a48b4353ba4f4115daa88181d66108e
Backed out changeset c19247505a48 (bug 1357024) for crashes in test_ShortestPaths_01.html.
js/src/jit-test/tests/cacheir/bug1357024.js
js/src/jit/CacheIRCompiler.cpp
deleted file mode 100644
--- a/js/src/jit-test/tests/cacheir/bug1357024.js
+++ /dev/null
@@ -1,12 +0,0 @@
-function f() {
-    var o = {};
-    for (var j = 0; j < 15; j++) {
-        try {
-            o.__proto__ = o || j;
-        } catch(e) {
-            continue;
-        }
-        throw "Fail";
-    }
-}
-f();
--- a/js/src/jit/CacheIRCompiler.cpp
+++ b/js/src/jit/CacheIRCompiler.cpp
@@ -454,29 +454,25 @@ CacheRegisterAllocator::fixupAliasedInpu
         if (!loc1.isInRegister())
             continue;
 
         for (size_t j = 0; j < i; j++) {
             OperandLocation& loc2 = operandLocations_[j];
             if (!loc1.aliasesReg(loc2))
                 continue;
 
-            // loc1 and loc2 alias so we spill one of them. If one is a
-            // ValueReg and the other is a PayloadReg, we have to spill the
-            // PayloadReg: spilling the ValueReg instead would leave its type
-            // register unallocated on 32-bit platforms.
             if (loc1.kind() == OperandLocation::ValueReg) {
                 MOZ_ASSERT_IF(loc2.kind() == OperandLocation::ValueReg,
                               loc1 == loc2);
-                spillOperandToStack(masm, &loc2);
-            } else {
-                MOZ_ASSERT(loc1.kind() == OperandLocation::PayloadReg);
                 spillOperandToStack(masm, &loc1);
-                break; // Spilled loc1, so nothing else will alias it.
+                break;
             }
+
+            MOZ_ASSERT(loc1.kind() == OperandLocation::PayloadReg);
+            spillOperandToStack(masm, &loc2);
         }
     }
 }
 
 GeneralRegisterSet
 CacheRegisterAllocator::inputRegisterSet() const
 {
     MOZ_ASSERT(origInputLocations_.length() == writer_.numInputOperands());