835792 - Assertion failure during ReflowTypeInfo after bailout: JS_ASSERT(type() == IonFrame_OptimizedJS);

Status: RESOLVED DUPLICATE of bug 835499

(Core :: JavaScript Engine, defect)

Description

[Niko Matsakis [:nmatsakis]]

Stack trace: http://pastebin.mozilla.org/2094801.

Reverting bug 825379 fixes the problem.

On IRC, nbp says:

13:49	nbp	nmatsakis: the problem is the same we had in a Bailouts, iterating the stack during a bailout is not handled.
13:49	nbp	nmatsakis: or not well handled.
13:50	nbp	nmatsakis: the bailout should have unwind the Ion frame when reflow is aking to iterate over the stack.
13:50	nbp	nmatsakis: so after the bailout this is supposed to be fine.
13:51	nbp	nmatsakis: but I don't think we are resetting the ionTop when we update the exit frame.
13:51	nbp	nmatsakis: I think that we should update the ionTop from the C++ when we unwind the last frame.
13:52	nbp	nmatsakis: I guess we should update it in EnsureExitFrame
13:53	nbp	nmatsakis: or support iterating from a Bailed_frame.

When the assertion failure occurs:
- type is: js::ion::IonFrame_Entry
- CalleeTokenTag is: js::ion::CalleeToken_Function

Comment 1

[Niko Matsakis [:nmatsakis]]

I should add: the assertion failure occurs when running a test from the ParallelArray branch. The specific ingredients seem to be that a bailout occurs when ion-generated code encounters an intrinsic that is not known.  This triggers a type bailout, when leads to callsite cloning, which leads to the assertion failure.

Comment 2

[Shu-yu Guo [:shu]]

To clarify, it's lazy self hosted script cloning, not callsite cloning.