Last Comment Bug 657890 - TI+JM: Assertion failure: !types->unknown(), at Compiler.cpp:7163
: TI+JM: Assertion failure: !types->unknown(), at Compiler.cpp:7163
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-05-18 02:43 PDT by Jan de Mooij [:jandem]
Modified: 2011-05-18 11:02 PDT (History)
3 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Jan de Mooij [:jandem] 2011-05-18 02:43:34 PDT
--
function f() {};
var x;
for(var i=0; i<200; i++) {
    x = f.bind(x, x, 2);
    gc();
}
--
$ ./js -n -m test.js
Assertion failure: !types->unknown(), at Compiler.cpp:7163

With -n -a -m it throws:
test.js:4: InternalError: too much recursion

Revision 5d1cbc94bc42, 32-bit OS X.
Comment 1 Brian Hackett (:bhackett) 2011-05-18 11:02:38 PDT
The assert was because we were testing the pushed type set rather than the type set which barriers are assigned for (if the bytecode types are unknown there shouldn't be any barriers).  These are identical except when we hit a threshold which marks type sets as unknown once objects have been propagated to too many places.

The recursion error is stickier.  The basic problem is due to the interpoline, that we can repeatedly enter the method JIT on the same stack frame, by compiling, throwing away the code and reentering the interpreter, reentering the method JIT at a backedge, and so on.  This patch just puts a threshold on such recursion, but we should have a better solution (need to think some more about the best approach to take here).

http://hg.mozilla.org/projects/jaegermonkey/rev/bcd868ff18d4

Note You need to log in before you can comment on or make changes to this bug.