685377 - IonMonkey: Incorrect bailout during argument construction.

Status: RESOLVED DUPLICATE of bug 691603

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

Attachment: Bail out during argument construction.

The attached test case trips the following assertion on x86/x64 with --ion-eager:
> Assertion failure: GlobalIonContext, at /home/sstangl/dev/ionmonkey/js/src/ion/Ion.cpp:126

Some recent patches caused a reduced version of this testcase to unexpectedly pass.

Comment 1

[Sean Stangl [:sstangl]]

Note that the problem is most likely due to a ResumePoint that is not at the start of the function call -- this is the first time we have non-idempotent instructions. Calling take_snapshot() (aliased to "h") creates a new ResumePoint.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: fix

I can't reproduce the original bug, but the current crash is because bailout contexts can't stack, and we appear to be re-entering Ion code.

Comment 3

[Sean Stangl [:sstangl]]

Comment on attachment 560366 [details] [diff] [review]
fix

Review of attachment 560366 [details] [diff] [review]:
-----------------------------------------------------------------

This patch is fine, but seems unrelated to this bug -- I can still reproduce it on x86 and x64.

::: js/src/tests/ecma_5/extensions/extension-methods-reject-null-undefined-this.js
@@ -1,1 @@
> -/*

This file probably shouldn't be removed? I'm unclear on why this is removed, and how it's related to this patch.

::: js/src/tests/ecma_5/misc/builtin-methods-reject-null-undefined-this.js
@@ -1,1 @@
> -/*

This file too.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Are you sure? I can't reproduce it after this patch, which does address the assert in comment #0

Comment 5

[Sean Stangl [:sstangl]]

Oh, you're right. That's strange: the original problem involved overflowing %rax, then attempting to restore the pre-overflow value from %rax for a bailout. I don't remember any patch in the interim addressing this problem... but can't complain.