Note: There are a few cases of duplicates in user autocompletion which are being worked on.

IonMonkey: Eager+GCZeal: Infinite loop of compile, bailout, Interpreter, GC, follow JSOP_GOTO and compile … (./jit-test/tests/basic/bug713226.js)

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: nbp, Assigned: nbp)

Tracking

Other Branch
x86_64
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
This issue can be reproduce with --ion-eager.

gczeal(4);
for (var i = 0; i < 0;)
    ;

We hit a typebarrier when we read "i" and bailout to a point where we can start a new compilation cycle without any updated type information.

I made a work around which check that the bailout does not return to an OSR point and skip the next compilation if this is the case.
Would this be fixed by bug 746691?
In fact, until bug 746691 we should probably consider gczeal to be unsupported with --ion-eager.
(Assignee)

Comment 3

5 years ago
Created attachment 620539 [details] [diff] [review]
Skip next OSR if a GC remove the forbidOSR just after the bailout.

Skip all JSOP_GOTO and the next JSOP_LOOPENTRY to avoid the first OSR after a bailout.
Attachment #620539 - Flags: review?(dvander)
Attachment #620539 - Flags: review?(dvander) → review+
(Assignee)

Comment 4

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/89dc67e65016
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.