463490 - TM: Fatal assert on JS raytracer testcase: Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at ../jstracer.cpp:2797

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Boris Zbarsky [:bzbarsky]]

The JS shell testcase is the one from bug 463487.  When running that JS file in a debug shell with -j but without -b, I get:

Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at ../jstracer.cpp:2797

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: proposed fix

Explanation of the bug: Say a tree with typemap [int, int] is stable, and another tree with typemap [int, double] was created and closed.  If we entered the initial tree and extended an [int, double] branch, it wouldn't be connected to the second tree.

This was simply another hole in the heuristics.  The patch now searches for stable peers in all instability cases before falling back on leaving unclosed, undemotable exits.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 346805 [details] [diff] [review]
proposed fix


>-            /* If we got here, there was a successful match. */
>+            /*
>+             * There was a successful match.  We don't care about restoring the saved staging, but 
>+             * we do need to clear the original undemote list.
>+             */

Whoops, ignore this comment, it's stale.

Comment 3

[Brendan Eich [:brendan]]

Does the patch give a speedup as well as assertion relief?

/be

Comment 4

[Boris Zbarsky [:bzbarsky]]

Bug 463487 covers the perf issues on this testcase.  Offhand, the patch doesn't seem to help on that.

Comment 5

[Andreas Gal :gal]

Comment on attachment 346805 [details] [diff] [review]
proposed fix

Good test case.

Comment 6

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed fix as changeset: http://hg.mozilla.org/tracemonkey/rev/ef137cf05203

Comment 7

[Bob Clary [:bc] (inactive)]

test already in js1_8_1/trace/trace-test.js

Comment 8

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2