Closed Bug 565241 Opened 10 years ago Closed 10 years ago

TM: abort traces when fused backedges reach a different loop header

Categories

(Core :: JavaScript Engine, defect)

x86
Linux
defect
Not set

Tracking

()

RESOLVED INVALID

People

(Reporter: dvander, Assigned: dvander)

References

Details

We abort traces when we see a back edge that reaches a loop header different than the one that started the trace.

This mechanism is completely bypassed when opcodes are fused. This wasn't a correctness bug until the new iterator patch landed, where an ENDITER can be traced without the preceding correct loop header which would have guarded on the iterator type.
So this bug was mislabeled, it should really have been "untaken back edge", for example:

L2:
 ...
L1:
 goto 7
 moreiter
 ifne L1
 enditer
 ifne L2

If we record L2, and walk past the first IFNE, we'll have inlined the inner loop. This is actually desirable though, there's no need to abort. Better to just fix 565199 directly.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.