Merged r13891 into 3.16 branch.
Fixed register allocation corner case.
BUG=177883
R=verwaest@chromium.org
Review URL: https://codereview.chromium.org/12684013
git-svn-id: http://v8.googlecode.com/svn/branches/3.16@13981 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/src/lithium-allocator.cc b/src/lithium-allocator.cc
index dcfbead..e3b9a88 100644
--- a/src/lithium-allocator.cc
+++ b/src/lithium-allocator.cc
@@ -206,9 +206,6 @@
bool LiveRange::CanBeSpilled(LifetimePosition pos) {
- // TODO(kmillikin): Comment. Now.
- if (pos.Value() <= Start().Value() && HasRegisterAssigned()) return false;
-
// We cannot spill a live range that has a use requiring a register
// at the current or the immediate next position.
UsePosition* use_pos = NextRegisterPosition(pos);
@@ -1917,12 +1914,6 @@
if (pos.Value() < register_use->pos().Value()) {
// All registers are blocked before the first use that requires a register.
// Spill starting part of live range up to that use.
- //
- // Corner case: the first use position is equal to the start of the range.
- // In this case we have nothing to spill and SpillBetween will just return
- // this range to the list of unhandled ones. This will lead to the infinite
- // loop.
- ASSERT(current->Start().Value() < register_use->pos().Value());
SpillBetween(current, current->Start(), register_use->pos());
return;
}
@@ -2072,7 +2063,7 @@
void LAllocator::SpillBetween(LiveRange* range,
LifetimePosition start,
LifetimePosition end) {
- ASSERT(start.Value() < end.Value());
+ CHECK(start.Value() < end.Value());
LiveRange* second_part = SplitRangeAt(range, start);
if (!AllocationOk()) return;
diff --git a/src/version.cc b/src/version.cc
index 3614838..499a6b7 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 16
#define BUILD_NUMBER 14
-#define PATCH_LEVEL 7
+#define PATCH_LEVEL 8
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
diff --git a/test/mjsunit/compiler/regress-177883.js b/test/mjsunit/compiler/regress-177883.js
new file mode 100644
index 0000000..d5af584
--- /dev/null
+++ b/test/mjsunit/compiler/regress-177883.js
@@ -0,0 +1,179 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// A regression test for a register allocation bug triggered by
+// http://n3emscripten.appspot.com/dragons_asmjs.html. Note that the test is
+// very fragile, but without a proper testing infrastructure for the register
+// allocator we can't really do much better.
+//
+// The code below is a slighty modified version of Emscripten-translated C++
+// code for the standard textbook algorithm for frustum culling of an object
+// with a given bounding box.
+//
+// The key problem for the underlying bug was a value with a long live range
+// which is used often (a context) and a lot of live ranges starting at the same
+// point. The bug was that none of the ranges were allowed to be spilled, so the
+// allocator was splitting a live range at its start and re-added the very same
+// range into the list of unallocated ranges, making no progress.
+
+(function () {
+ function __ZNK4Math5plane3dotERKNS_6float4E(i1, i2) {
+ i1 = i1 | 0;
+ i2 = i2 | 0;
+ return +(+HEAPF32[i1 >> 2] * +HEAPF32[i2 >> 2] + +HEAPF32[i1 + 4 >> 2] * +HEAPF32[i2 + 4 >> 2] + +HEAPF32[i1 + 8 >> 2] * +HEAPF32[i2 + 8 >> 2] + +HEAPF32[i1 + 12 >> 2] * +HEAPF32[i2 + 12 >> 2]);
+ }
+
+ function __ZNK4Math7frustum8clipmaskERKNS_5pointE(i1, i2) {
+ i1 = i1 | 0;
+ i2 = i2 | 0;
+ var i3 = 0, i4 = 0;
+ i3 = i2 | 0;
+ i2 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 | 0, i3) > 0.0 & 1;
+ i4 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 16 | 0, i3) > 0.0 ? i2 | 2 : i2;
+ i2 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 32 | 0, i3) > 0.0 ? i4 | 4 : i4;
+ i4 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 48 | 0, i3) > 0.0 ? i2 | 8 : i2;
+ i2 = +__ZNK4Math5plane3dotERKNS_6float4E(i1 + 64 | 0, i3) > 0.0 ? i4 | 16 : i4;
+ return (+__ZNK4Math5plane3dotERKNS_6float4E(i1 + 80 | 0, i3) > 0.0 ? i2 | 32 : i2) | 0;
+ }
+
+ function __ZNK4Math7frustum10clipstatusERKNS_4bboxE(i1, i2) {
+ i1 = i1 | 0;
+ i2 = i2 | 0;
+ var i3 = 0, i4 = 0, i5 = 0, i6 = 0, i7 = 0, i8 = 0, i9 = 0, i10 = 0, i11 = 0, i12 = 0, i13 = 0, i14 = 0, i15 = 0, i16 = 0, d17 = 0.0, d18 = 0.0, i19 = 0, i20 = 0, i21 = 0, i22 = 0;
+ i3 = STACKTOP;
+ STACKTOP = STACKTOP + 16 | 0;
+ i4 = i3 | 0;
+ i5 = i4 | 0;
+ HEAPF32[i5 >> 2] = 0.0;
+ i6 = i4 + 4 | 0;
+ HEAPF32[i6 >> 2] = 0.0;
+ i7 = i4 + 8 | 0;
+ HEAPF32[i7 >> 2] = 0.0;
+ i8 = i4 + 12 | 0;
+ HEAPF32[i8 >> 2] = 1.0;
+ i9 = i2 | 0;
+ i10 = i2 + 4 | 0;
+ i11 = i2 + 8 | 0;
+ i12 = i2 + 20 | 0;
+ i13 = i2 + 16 | 0;
+ i14 = i2 + 24 | 0;
+ i2 = 65535;
+ i15 = 0;
+ i16 = 0;
+ while (1) {
+ if ((i16 | 0) == 1) {
+ d17 = +HEAPF32[i12 >> 2];
+ d18 = +HEAPF32[i11 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = d17;
+ HEAPF32[i7 >> 2] = d18;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 4) {
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = +HEAPF32[i12 >> 2];
+ HEAPF32[i7 >> 2] = +HEAPF32[i14 >> 2];
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 6) {
+ d18 = +HEAPF32[i10 >> 2];
+ d17 = +HEAPF32[i14 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = d18;
+ HEAPF32[i7 >> 2] = d17;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 5) {
+ d17 = +HEAPF32[i12 >> 2];
+ d18 = +HEAPF32[i14 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = d17;
+ HEAPF32[i7 >> 2] = d18;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 3) {
+ d18 = +HEAPF32[i10 >> 2];
+ d17 = +HEAPF32[i11 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = d18;
+ HEAPF32[i7 >> 2] = d17;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 0) {
+ HEAPF32[i5 >> 2] = +HEAPF32[i9 >> 2];
+ HEAPF32[i6 >> 2] = +HEAPF32[i10 >> 2];
+ HEAPF32[i7 >> 2] = +HEAPF32[i11 >> 2];
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 2) {
+ d17 = +HEAPF32[i12 >> 2];
+ d18 = +HEAPF32[i11 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = d17;
+ HEAPF32[i7 >> 2] = d18;
+ HEAPF32[i8 >> 2] = 1.0;
+ } else if ((i16 | 0) == 7) {
+ d18 = +HEAPF32[i10 >> 2];
+ d17 = +HEAPF32[i14 >> 2];
+ HEAPF32[i5 >> 2] = +HEAPF32[i13 >> 2];
+ HEAPF32[i6 >> 2] = d18;
+ HEAPF32[i7 >> 2] = d17;
+ HEAPF32[i8 >> 2] = 1.0;
+ }
+ i19 = __ZNK4Math7frustum8clipmaskERKNS_5pointE(i1, i4) | 0;
+ i20 = i19 & i2;
+ i21 = i19 | i15;
+ i19 = i16 + 1 | 0;
+ if ((i19 | 0) == 8) {
+ break;
+ } else {
+ i2 = i20;
+ i15 = i21;
+ i16 = i19;
+ }
+ }
+ if ((i21 | 0) == 0) {
+ i22 = 0;
+ STACKTOP = i3;
+ return i22 | 0;
+ }
+ i22 = (i20 | 0) == 0 ? 2 : 1;
+ STACKTOP = i3;
+ return i22 | 0;
+ }
+
+ // -----------------------------------------------------------------
+
+ var STACKTOP = 0;
+ var HEAPF32 = new Float32Array(1000);
+
+ for (var i = 0; i < HEAPF32.length; i++) {
+ HEAPF32[i] = 1.0;
+ }
+
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+ %OptimizeFunctionOnNextCall(__ZNK4Math7frustum10clipstatusERKNS_4bboxE);
+ __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
+})();
