The default bug view has changed. See this FAQ.

TI+JM: Assertion failure: !types->unknown(), at Compiler.cpp:7163

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Unassigned)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

6 years ago
--
function f() {};
var x;
for(var i=0; i<200; i++) {
    x = f.bind(x, x, 2);
    gc();
}
--
$ ./js -n -m test.js
Assertion failure: !types->unknown(), at Compiler.cpp:7163

With -n -a -m it throws:
test.js:4: InternalError: too much recursion

Revision 5d1cbc94bc42, 32-bit OS X.
The assert was because we were testing the pushed type set rather than the type set which barriers are assigned for (if the bytecode types are unknown there shouldn't be any barriers).  These are identical except when we hit a threshold which marks type sets as unknown once objects have been propagated to too many places.

The recursion error is stickier.  The basic problem is due to the interpoline, that we can repeatedly enter the method JIT on the same stack frame, by compiling, throwing away the code and reentering the interpreter, reentering the method JIT at a backedge, and so on.  This patch just puts a threshold on such recursion, but we should have a better solution (need to think some more about the best approach to take here).

http://hg.mozilla.org/projects/jaegermonkey/rev/bcd868ff18d4
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.