Closed Bug 835792 Opened 9 years ago Closed 9 years ago
Assertion failure during Reflow
Type Info after bailout: JS _ASSERT(type() == Ion Frame _Optimized JS);
Stack trace: http://pastebin.mozilla.org/2094801. Reverting bug 825379 fixes the problem. On IRC, nbp says: 13:49 nbp nmatsakis: the problem is the same we had in a Bailouts, iterating the stack during a bailout is not handled. 13:49 nbp nmatsakis: or not well handled. 13:50 nbp nmatsakis: the bailout should have unwind the Ion frame when reflow is aking to iterate over the stack. 13:50 nbp nmatsakis: so after the bailout this is supposed to be fine. 13:51 nbp nmatsakis: but I don't think we are resetting the ionTop when we update the exit frame. 13:51 nbp nmatsakis: I think that we should update the ionTop from the C++ when we unwind the last frame. 13:52 nbp nmatsakis: I guess we should update it in EnsureExitFrame 13:53 nbp nmatsakis: or support iterating from a Bailed_frame. When the assertion failure occurs: - type is: js::ion::IonFrame_Entry - CalleeTokenTag is: js::ion::CalleeToken_Function
I should add: the assertion failure occurs when running a test from the ParallelArray branch. The specific ingredients seem to be that a bailout occurs when ion-generated code encounters an intrinsic that is not known. This triggers a type bailout, when leads to callsite cloning, which leads to the assertion failure.
To clarify, it's lazy self hosted script cloning, not callsite cloning.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 835499
You need to log in before you can comment on or make changes to this bug.