565241 - TM: abort traces when fused backedges reach a different loop header

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[David Anderson [:dvander] - inactive, e-mail if emergency]

We abort traces when we see a back edge that reaches a loop header different than the one that started the trace.

This mechanism is completely bypassed when opcodes are fused. This wasn't a correctness bug until the new iterator patch landed, where an ENDITER can be traced without the preceding correct loop header which would have guarded on the iterator type.

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

So this bug was mislabeled, it should really have been "untaken back edge", for example:

L2:
 ...
L1:
 goto 7
 moreiter
 ifne L1
 enditer
 ifne L2

If we record L2, and walk past the first IFNE, we'll have inlined the inner loop. This is actually desirable though, there's no need to abort. Better to just fix 565199 directly.