657890 - TI+JM: Assertion failure: !types->unknown(), at Compiler.cpp:7163

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

--
function f() {};
var x;
for(var i=0; i<200; i++) {
    x = f.bind(x, x, 2);
    gc();
}
--
$ ./js -n -m test.js
Assertion failure: !types->unknown(), at Compiler.cpp:7163

With -n -a -m it throws:
test.js:4: InternalError: too much recursion

Revision 5d1cbc94bc42, 32-bit OS X.

Comment 1

[Brian Hackett [Laid off!]]

The assert was because we were testing the pushed type set rather than the type set which barriers are assigned for (if the bytecode types are unknown there shouldn't be any barriers).  These are identical except when we hit a threshold which marks type sets as unknown once objects have been propagated to too many places.

The recursion error is stickier.  The basic problem is due to the interpoline, that we can repeatedly enter the method JIT on the same stack frame, by compiling, throwing away the code and reentering the interpreter, reentering the method JIT at a backedge, and so on.  This patch just puts a threshold on such recursion, but we should have a better solution (need to think some more about the best approach to take here).

http://hg.mozilla.org/projects/jaegermonkey/rev/bcd868ff18d4