linear-scan.log

Starting dump of JIT expression tree
====================================
digraph {
  n_0001 [label="LOCAL"];
  n_0002 [label="ADDR(0xd8)"];
    n_0002 -> n_0001;
  n_0008 [label="TC"];
  n_0009 [label="ADDR(0x1b0)"];
    n_0009 -> n_0008;
  n_0012 [label="LOAD(0x8)"];
    n_0012 -> n_0009;
  n_0015 [label="ADDR(0x78)"];
    n_0015 -> n_0012;
  n_0018 [label="LOAD(0x8)"];
    n_0018 -> n_0015;
  n_0005 [label="CONST(0x14, 0x2)"];
  n_0021 [label="IDX(0x8)"];
    n_0021 -> n_0018;
    n_0021 -> n_0005;
  n_0025 [label="LOAD(0x8)"];
    n_0025 -> n_0021;
  n_0176 [label="STORE(0x8)"];
    n_0176 -> n_0002;
    n_0176 -> n_0025;
  n_0028 [label="LOCAL"];
  n_0029 [label="ADDR(0xe8)"];
    n_0029 -> n_0028;
  n_0032 [label="LOCAL"];
  n_0033 [label="ADDR(0x78)"];
    n_0033 -> n_0032;
  n_0036 [label="LOAD(0x8)"];
    n_0036 -> n_0033;
  n_0045 [label="ADDR(0x18)"];
    n_0045 -> n_0036;
  n_0048 [label="LOAD(0x8)"];
    n_0048 -> n_0045;
  n_0051 [label="DISCARD"];
    n_0051 -> n_0048;
  n_0184 [label="LOAD(0x8)"];
    n_0184 -> n_0045;
  n_0053 [label="NZ"];
    n_0053 -> n_0184;
  n_0055 [label="ADDR(0x18)"];
    n_0055 -> n_0036;
  n_0058 [label="IF"];
    n_0058 -> n_0053;
    n_0058 -> n_0048;
    n_0058 -> n_0055;
  n_0062 [label="DO"];
    n_0062 -> n_0051;
    n_0062 -> n_0058;
  n_0039 [label="CONST(0x28, 0x2)"];
  n_0066 [label="ADD"];
    n_0066 -> n_0062;
    n_0066 -> n_0039;
  n_0072 [label="DISCARD"];
    n_0072 -> n_0066;
  n_0069 [label="LOAD(0x8)"];
    n_0069 -> n_0066;
  n_0074 [label="DISCARD"];
    n_0074 -> n_0069;
  n_0076 [label="NZ"];
    n_0076 -> n_0069;
  n_0078 [label="TC"];
  n_0079 [label="ADDR(0x1b0)"];
    n_0079 -> n_0078;
  n_0082 [label="LOAD(0x8)"];
    n_0082 -> n_0079;
  n_0085 [label="ADDR(0x78)"];
    n_0085 -> n_0082;
  n_0088 [label="LOAD(0x8)"];
    n_0088 -> n_0085;
  n_0042 [label="CONST(0xd, 0x2)"];
  n_0091 [label="IDX(0x8)"];
    n_0091 -> n_0088;
    n_0091 -> n_0042;
  n_0095 [label="LOAD(0x8)"];
    n_0095 -> n_0091;
  n_0098 [label="DISCARD"];
    n_0098 -> n_0095;
  n_0100 [label="ADDR(0xc)"];
    n_0100 -> n_0036;
  n_0103 [label="LOAD(0x2)"];
    n_0103 -> n_0100;
  n_0106 [label="CONST(0x10, 0x2)"];
  n_0109 [label="AND"];
    n_0109 -> n_0103;
    n_0109 -> n_0106;
  n_0112 [label="NZ"];
    n_0112 -> n_0109;
  n_0187 [label="LOAD(0x8)"];
    n_0187 -> n_0091;
  n_0114 [label="NZ"];
    n_0114 -> n_0187;
  n_0116 [label="ADDR(0xc)"];
    n_0116 -> n_0095;
  n_0119 [label="LOAD(0x2)"];
    n_0119 -> n_0116;
  n_0122 [label="CONST(0x10, 0x2)"];
  n_0125 [label="AND"];
    n_0125 -> n_0119;
    n_0125 -> n_0122;
  n_0128 [label="ZR"];
    n_0128 -> n_0125;
  n_0130 [label="ALL"];
    n_0130 -> n_0112;
    n_0130 -> n_0114;
    n_0130 -> n_0128;
  n_0135 [label="CONST(0x7f644252c1c0, 0x8)"];
  n_0138 [label="TC"];
  n_0139 [label="CARG(0x5)"];
    n_0139 -> n_0138;
  n_0142 [label="CARG(0x5)"];
    n_0142 -> n_0036;
  n_0145 [label="ARGLIST"];
    n_0145 -> n_0139;
    n_0145 -> n_0142;
  n_0149 [label="CALLV"];
    n_0149 -> n_0135;
    n_0149 -> n_0145;
  n_0152 [label="WHEN"];
    n_0152 -> n_0130;
    n_0152 -> n_0149;
  n_0155 [label="STORE(0x8)"];
    n_0155 -> n_0066;
    n_0155 -> n_0095;
  n_0159 [label="COPY"];
    n_0159 -> n_0095;
  n_0161 [label="DO"];
    n_0161 -> n_0098;
    n_0161 -> n_0152;
    n_0161 -> n_0155;
    n_0161 -> n_0159;
  n_0167 [label="IF"];
    n_0167 -> n_0076;
    n_0167 -> n_0069;
    n_0167 -> n_0161;
  n_0171 [label="DO"];
    n_0171 -> n_0072;
    n_0171 -> n_0074;
    n_0171 -> n_0167;
  n_0180 [label="STORE(0x8)"];
    n_0180 -> n_0029;
    n_0180 -> n_0171;
}
End dump of JIT expression tree
====================================
Starting tile list log
======================
Block{0} [0-14)
    0: (local)
    1: (tc)
    2: (load (addr reg $ofs) $size)
    3: (load (addr reg $ofs) $size)
    4: (const $val $size)
    5: (load (idx reg reg $scale) $size)
    6: (store (addr reg $ofs) reg $size)
    7: (local)
    8: (local)
    9: (load (addr reg $ofs) $size)
    10: (load (addr reg $ofs) $size)
    11: (discard reg)
    12: (nz (load (addr reg $ofs) $size))
    13: (conditional-branch: fail)
-> { 1, 2 }
Block{1} [14-15)
    14: (branch :after)
-> { 3 }
Block{2} [15-17)
    15: (label :fail)
    16: (addr reg $ofs)
-> { 3 }
Block{3} [17-26)
    17: (branch :after)
    18: (if flag reg)
    19: (do void reg)
    20: (add reg (const $val $size))
    21: (discard reg)
    22: (load reg $size)
    23: (discard reg)
    24: (nz reg)
    25: (conditional-branch: fail)
-> { 4, 5 }
Block{4} [26-27)
    26: (branch :after)
-> { 10 }
Block{5} [27-36)
    27: (label :fail)
    28: (tc)
    29: (load (addr reg $ofs) $size)
    30: (load (addr reg $ofs) $size)
    31: (const $val $size)
    32: (load (idx reg reg $scale) $size)
    33: (discard reg)
    34: (nz (and (load (addr reg $ofs) $size) (const $val $size)))
    35: (conditional-branch :fail)
-> { 6, 9 }
Block{6} [36-38)
    36: (nz (load (idx reg reg $scl) $size))
    37: (conditional-branch :fail)
-> { 7, 9 }
Block{7} [38-40)
    38: (zr (and (load (addr reg $ofs) $size) (const $val $size)))
    39: (conditional-branch :fail)
-> { 8, 9 }
Block{8} [40-44)
    40: (all flag)
    41: (tc)
    42: (arglist (carg reg))
    43: (callv (const $ptr $sz) c_args)
-> { 9 }
Block{9} [44-49)
    44: (label :fail)
    45: (when flag void)
    46: (store reg reg $size)
    47: (copy reg)
    48: (do void reg)
-> { 10 }
Block{10} [49-53)
    49: (branch :after)
    50: (if flag reg)
    51: (do void reg)
    52: (store (addr reg $ofs) reg $size)
-> {}
End of tile list log
======================
Assigned type: 8

Assigned type: 8

Merging live ranges (20-22) and (32-32)
Merging live ranges (44-48) and (64-92)
Assigned type: 8

Opened hole in live range 12 at 64
Closed hole in live range 12 at 52
Opened hole in live range 9 at 32
Closed hole in live range 9 at 28
STARTING LINEAR SCAN: 52/4
Processing live range 0 (first ref 0, last ref 12)
Processing live range 1 (first ref 2, last ref 4)
Processing live range 2 (first ref 4, last ref 6)
Processing live range 3 (first ref 6, last ref 10)
Live range 2 is out of scope (last ref 6, 6) and releasing register 1
Processing live range 4 (first ref 8, last ref 10)
Processing live range 5 (first ref 10, last ref 12)
Live range 3 is out of scope (last ref 10, 10) and releasing register 2
Live range 4 is out of scope (last ref 10, 10) and releasing register 6
Processing live range 6 (first ref 14, last ref 104)
Live range 5 is out of scope (last ref 12, 14) and releasing register 7
Processing live range 7 (first ref 16, last ref 18)
Processing live range 8 (first ref 18, last ref 86)
Processing live range 9 (first ref 20, last ref 40)
Processing live range 11 (first ref 40, last ref 92)
Live range 9 is out of scope (last ref 40, 40) and releasing register 9
Processing live range 12 (first ref 44, last ref 104)
Processing live range 13 (first ref 56, last ref 58)
Processing live range 14 (first ref 58, last ref 60)
Processing live range 15 (first ref 60, last ref 72)
Live range 14 is out of scope (last ref 60, 60) and releasing register 1
Processing live range 16 (first ref 62, last ref 72)
Processing live range 18 (first ref 82, last ref 86)
Live range 15 is out of scope (last ref 72, 82) and releasing register 2
Live range 16 is out of scope (last ref 72, 82) and releasing register 6
prepare_call: Got 2 args
Spilling 11 to 400 at 86
Spilling 12 to 408 at 86
Transfer Rq(7) -> Rq(14)
Transfer Rq(6) -> Rq(8)
2 transfers required
Directly transfer 8 -> 6
Directly transfer 14 -> 7
Insert move (toposort): Rq(8) -> Rq(6)
Insert move (toposort): Rq(14) -> Rq(7)
Live range 8 is out of scope (last ref 86, 107) and releasing register 8
VM Register 50 for live range 11 can be released
VM Register 51 for live range 12 can be released
END OF LINEAR SCAN

miscompile.asm

label_042:  mov rcx,QWORD PTR [r14+0x1b0]
	;; sp_getspehsslot
            mov rdx,QWORD PTR [rcx+0x78]
            mov rsi,0x14
            mov rdi,QWORD PTR [rdx+rsi*8]
            mov QWORD PTR [rbx+0xd8],rdi
        ;; sp_sp6ogetvt_o
            mov r8,QWORD PTR [rbx+0x78] ; the object
            mov r9,QWORD PTR [r8+0x18]
            cmp QWORD PTR [r8+0x18],0x0
            je label_043
            jmp label_044
label_043:  lea r9,[r8+0x18] 
label_044:  mov r10,r9
            add r10,0x28        ; $addr = (add (^p6obody $1) $2)

            mov QWORD PTR [rbx+0x190],r10 ;spill, looks like
            mov r10,QWORD PTR [rbx+0x190] ;huh?
            mov r10,QWORD PTR [rbx+0x190] ;double restore?
            mov r11,QWORD PTR [r10]       ;read from pointer $addr
            mov QWORD PTR [rbx+0x198],r11 ;spill as well
            mov r11,QWORD PTR [rbx+0x198]
            mov r11,QWORD PTR [rbx+0x198] ;restore twice?
            test r11,r11                  
            je label_045        ;nz $val
            jmp label_047
label_045:  mov rcx,QWORD PTR [r14+0x1b0]
            mov rdx,QWORD PTR [rcx+0x78]
            mov rsi,0xd
            mov r11,QWORD PTR [rdx+rsi*8] ; spesh_slot(13)
            mov QWORD PTR [rbx+0x198],r11 ;overwrite $val, because it isn't useful anymore
            mov r11,QWORD PTR [rbx+0x198]
            test WORD PTR [r8+0xc],0x10 ;write barrier
            je label_046
            cmp QWORD PTR [rdx+rsi*8],0x0 ;wth is rsi? (spesh slot value)
            je label_046
            mov r11,QWORD PTR [rbx+0x198]
            test WORD PTR [r11+0xc],0x10 ; is gen2?
            jne label_046
            mov rsi,r8          ;obj
            mov rdi,r14         ;rdi
            call QWORD PTR label_186 # rip ;write barrier
label_046:  mov rax,QWORD PTR [rbx+0x190]  ;wait, what?
            mov rax,QWORD PTR [rbx+0x198]  ;wait, what's more?
            mov QWORD PTR [r10],r11        ;this isn't right?
label_047:  mov rax,QWORD PTR [rbx+0x198]  ; my atomic-ranges aren't allocated a register
            mov QWORD PTR [rbx+0xe8],r11   ;but they are used (order_nr error maybe?)