639759 - TI: scripts hangs with type inference enabled

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Test

Attached file hangs for me with -n -a or -m -n -a.

Comment 1

[Jan de Mooij [:jandem]]

Sharks says all time is spent under js::types::CondenseTypeObjectList.

Comment 2

[Brian Hackett [Laid off!]]

Ooof, under DestroyScript we used the compartment associated with the cx rather than the script.  cx->compartment is usually totally wrong (big pitfall imo for GC code) so type objects created in one compartment get entrained on another compartment and chaos ensues.

http://hg.mozilla.org/projects/jaegermonkey/rev/75d5794ab88a

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

On TM, we set cx->compartment to NULL during GC. That should catch things like this. You might want to merge that line over to JM.

Comment 4

[Brian Hackett [Laid off!]]

Hmm, I did a TM -> JM merge last week and picked up that change (SwitchToCompartment(NULL) in GCUntilDone, right?).  Unfortunately that didn't catch this use due to a quirk of C++ semantics, which I filed bug 639954 for.