Closed Bug 751383 Opened 9 years ago Closed 9 years ago

IonMonkey: Eager+GCZeal: Infinite loop of compile, bailout, Interpreter, GC, follow JSOP_GOTO and compile … (./jit-test/tests/basic/bug713226.js)

Categories

(Core :: JavaScript Engine, defect)

Other Branch
x86_64
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: nbp, Assigned: nbp)

References

Details

Attachments

(1 file)

This issue can be reproduce with --ion-eager.

gczeal(4);
for (var i = 0; i < 0;)
    ;

We hit a typebarrier when we read "i" and bailout to a point where we can start a new compilation cycle without any updated type information.

I made a work around which check that the bailout does not return to an OSR point and skip the next compilation if this is the case.
In fact, until bug 746691 we should probably consider gczeal to be unsupported with --ion-eager.
Skip all JSOP_GOTO and the next JSOP_LOOPENTRY to avoid the first OSR after a bailout.
Attachment #620539 - Flags: review?(dvander)
Attachment #620539 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/89dc67e65016
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.