819727 - IonMonkey: Identical recompilation*s* caused by GetPropertyCache & fun_resolve

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Nicolas B. Pierron [:nbp]]

Attachment: GDB stack trace of the origin of the recompilation.

With a patch for Bug 803710, With the following command line:

$ IONFLAGS=logs,scripts,aborts ./_build/js-bug803710-dbg-x64-gcc45 --ion-crash-on-unexpected-disable  --ion-eager ./jit-test/tests/basic/bug630865-6.js

And once IonGraph has finished the logs, “du” gives an hint of the number of identical compilation happening before the crash.  Also “diff” cannot make any difference of either *.gv files or *.png files produced for the top-level script.

$ du func*-pass16-*.png
680K    func00-pass16-Allocate Registers [LSRA]-lir.gv.png
660K    func01-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func02-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func03-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func04-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func05-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func06-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func07-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func08-pass16-Allocate Registers [LSRA]-lir.gv.png
576K    func09-pass16-Allocate Registers [LSRA]-lir.gv.png

In all cases, the compiled script is ./jit-test/tests/basic/bug630865-6.js:1 , and even with --ion-eager, we should never invalidate to produce the same result except in case of a GC, which is not the case here.

I've attached the stack trace blaming GetPropertyCache as being the reason behind the invalidation of the script which is running this GetPropertyCache.

The problem of this test case seems to be that TI is freezing on the shape of the lambda, which is altered by the GetPropertyCache of the “prototype” property.