Closed Bug 835792 Opened 9 years ago Closed 9 years ago

Assertion failure during ReflowTypeInfo after bailout: JS_ASSERT(type() == IonFrame_OptimizedJS);

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED DUPLICATE of bug 835499

People

(Reporter: nmatsakis, Unassigned)

References

Details

Stack trace: http://pastebin.mozilla.org/2094801.

Reverting bug 825379 fixes the problem.

On IRC, nbp says:

13:49	nbp	nmatsakis: the problem is the same we had in a Bailouts, iterating the stack during a bailout is not handled.
13:49	nbp	nmatsakis: or not well handled.
13:50	nbp	nmatsakis: the bailout should have unwind the Ion frame when reflow is aking to iterate over the stack.
13:50	nbp	nmatsakis: so after the bailout this is supposed to be fine.
13:51	nbp	nmatsakis: but I don't think we are resetting the ionTop when we update the exit frame.
13:51	nbp	nmatsakis: I think that we should update the ionTop from the C++ when we unwind the last frame.
13:52	nbp	nmatsakis: I guess we should update it in EnsureExitFrame
13:53	nbp	nmatsakis: or support iterating from a Bailed_frame.

When the assertion failure occurs:
- type is: js::ion::IonFrame_Entry
- CalleeTokenTag is: js::ion::CalleeToken_Function
I should add: the assertion failure occurs when running a test from the ParallelArray branch. The specific ingredients seem to be that a bailout occurs when ion-generated code encounters an intrinsic that is not known.  This triggers a type bailout, when leads to callsite cloning, which leads to the assertion failure.
Blocks: PJS
To clarify, it's lazy self hosted script cloning, not callsite cloning.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 835499
You need to log in before you can comment on or make changes to this bug.