566639 - Recursion limit differs between TM and interpreter, take 3

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

var x = 0;
try {
  (function r(d) { x++; if (d > 0) r(d - 1); })(4500);
} catch(e) { }
print(x);

Interpreter: 3000
TM: 3001

Previously fixed bugs: bug 520498, bug 522136.

This isn't a serious bug on its own, but it interferes with jsfunfuzz's ability to test for other TM/interpreter inconsistency bugs, which often *are* serious.

Comment 1

[Robert Sayre]

dvander's patch for bug 565373 broke this. it also broke the trace-test for bug 522136, which seems to be testing the same issue. not sure why it is still there, keeping the tree orange.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

This test case is silly, as is the requirement that recursion limits be precisely identical between every mode of execution. Maintaining this invariant is tricky in JM and will break there under certain circumstances. jsfunfuzz should learn how to work around it.

In the meantime, this should patch won't execute traces if they could bump the inline call count past the interpreter's limit.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

http://hg.mozilla.org/tracemonkey/rev/49da92b4c672

sorry for orange.

Comment 4

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/49da92b4c672

Comment 5

[Christian Holler (:decoder)]

Filter on qa-project-auto-change:

Bug in removed tracer code, setting in-testsuite- flag.