875774 - Assertion failure: lastStub->isFallback(), at ion/BaselineIC.h:705

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on mozilla-central revision df526497d949 (no options required):


eval("(function () {\
  const scaler = 5;\
  const numRows = 600;\
  const numCols = 600;\
  const colorNames = [\
    'black',\
    'green',\
  ];\
  const threshold = (colorNames.length - 1) * scaler;\
  function escapeNorm2(normZ) {\
    return normZ > 4;\
  }\
  function fuzzyColors(i) {\
    return Math.floor(i / scaler) + 1;\
  }\
  function computeEscapeSpeedDoubles(real, imag) {\
    var r = real;\
    var i = imag;\
    var absC = Math.sqrt(real * real + imag * imag);\
    for (var j = 0; j < threshold; ++j) {\
      var r2 = r * r;\
      var i2 = i * i;\
      if (escape(r2 + i2, absC))\
        return colorMap(j);\
      i = 2 * r * i + imag;\
    }\
  }\
  var computeEscapeSpeed = computeEscapeSpeedDoubles;\
  var escape = escapeNorm2;\
  var colorMap = fuzzyColors;\
    var realRange = { min: -2.1, max: 1 };\
    var imagRange = { min: -1.5, max: 1.5 };\
    var realStep = (realRange.max - realRange.min)/numCols;\
    var imagStep = (imagRange.min - imagRange.max)/numRows;\
    for (var i = 0, curReal = realRange.min; i < numCols; ++i, curReal += realStep)\
      for (var j = 0, curImag = imagRange.max; j < numRows; ++j, curImag += imagStep)\
        var n = computeEscapeSpeed(curReal, curImag);\
" + "})();");

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Christian Holler (:decoder)]

Marked this s-s because the testcase is quite fragile and it's in IC code, I cannot judge what the impact is. If this is harmless, feel free to unhide :)

Comment 3

[Christian Holler (:decoder)]

JSBugMon: Bisection requested, result:
autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   132759:b9beff192aa2
user:        Brian Hackett
date:        Thu May 23 05:59:53 2013 -0600
summary:     Bug 864218 - Improve performance when accessing variables defined in run-once closures, r=luke,jandem.

This iteration took 0.808 seconds to run.

Comment 4

[Christian Holler (:decoder)]

Brian, can you take a look based on comment 3? Thanks.

Comment 5

[Christian Holler (:decoder)]

JSBugMon: The testcase found in this bug no longer reproduces (tried revision 7a2f7a45819a).

Comment 6

[Andrew McCreight [:mccr8]]

Looks like it went away when bug 864218 was backed out.

Comment 7

[Brian Hackett [Laid off!]]

Attachment: patch

Using getStaticName for accesses to run once closures could cause Ion to end up generating a GetName cache for a GETALIASEDVAR op, which baseline couldn't figure out how to hook up to after a bailout (since it doesn't use a normal IC for GETALIASEDVAR).  This patch causes us to fall back to the normal GETALIASEDVAR path if type information is too imprecise.

Comment 8

[Brian Hackett [Laid off!]]

Opening this up since 864218 is no longer in the tree.

Comment 9

[Jan de Mooij [:jandem]]

Got fixed as part of bug 864218.