456833 - TM: aborts on loop edge not returning to header

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

JS shell testcase attached.   I'm sorry about all the other stuff going on here; it might be minimizable.  With that testcase I get a trace abort:

loop edge 148 -> 23, header 1124
Abort recording (line 3, pc 148): Loop edge does not return to header.

Comment 1

[Brendan Eich [:brendan]]

Andreas said he'd confirm that this is a dup of bug 456431 or else fix.

/be

Comment 2

[Robert Sayre]

Looks like a perf edge case rather than a correctness bug, so not going to block... let me know if I'm missing something.

Comment 3

[Andreas Gal :gal]

This has been fixed a long time ago. 456431 was a related fix. Marking this fixed.

Comment 4

[Boris Zbarsky [:bzbarsky]]

So.... I still get a trace abort on that testcase:

Abort recording of tree /Users/bzbarsky/test.js:22@87 at /Users/bzbarsky/test.js:3@23: No compatible inner tree.

Should I file a followup bug on that?  Or is that sort of expected?

Comment 5

[Andreas Gal :gal]

Is that a single abort and we catch it later, or do we fail to construct traces for the test case? The former is expected. We don't find a matching tree, compile one, trace the outer parts again, and everything is happy. If not, file a follow-up bug.

Comment 6

[Boris Zbarsky [:bzbarsky]]

There is a single abort; I'm not sure whether we end up compiling a trace for the outermost loop here...  Would there be at least two aborts if we do not?

Comment 7

[Andreas Gal :gal]

I would think so, yes.