Fix crash with OSR after isolate reload.

runtime/vm/code_generator.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/code_generator.h"
 
 #include "vm/assembler.h"
 #include "vm/ast.h"
 #include "vm/code_patcher.h"
 #include "vm/compiler.h"
@@ skipping 1323 matching lines @@
     UNREACHABLE();
   }
 
   if ((stack_overflow_flags & Thread::kOsrRequest) != 0) {
     ASSERT(FLAG_use_osr);
     DartFrameIterator iterator;
     StackFrame* frame = iterator.NextFrame();
     ASSERT(frame != NULL);
     const Code& code = Code::ZoneHandle(frame->LookupDartCode());
     ASSERT(!code.IsNull());
+    ASSERT(!code.is_optimized());
     const Function& function = Function::Handle(code.function());
     ASSERT(!function.IsNull());
     // Since the code is referenced from the frame and the ZoneHandle,
     // it cannot have been removed from the function.
     ASSERT(function.HasCode());
     // Don't do OSR on intrinsified functions: The intrinsic code expects to be
     // called like a regular function and can't be entered via OSR.
     if (!Compiler::CanOptimizeFunction(thread, function) ||
         function.is_intrinsic()) {
       return;
     }
 
     // The unoptimized code is on the stack and should never be detached from
     // the function at this point.
     ASSERT(function.unoptimized_code() != Object::null());
     intptr_t osr_id =
         Code::Handle(function.unoptimized_code()).GetDeoptIdForOsr(frame->pc());
-    ASSERT(osr_id != Compiler::kNoOSRDeoptId);
+    if (osr_id == Compiler::kNoOSRDeoptId) {
+      // The unoptimized code can have been reset to the lazy-compile stub

[rmacnak, 2016/07/06 17:31:57]

As discussed offline, this should be

if (frame.code != frame.code.function.unoptimizedcode) {
  bailout, the frame's code is old, probably from before a reload.
  compiling osr may result in code with different deopt ids.
}

+      // by an isolate reload. We can't do OSR in this invocation.
+      ASSERT(function.unoptimized_code() ==
+             StubCode::LazyCompile_entry()->code());
+      return;
+    }
     if (FLAG_trace_osr) {
       OS::Print("Attempting OSR for %s at id=%" Pd ", count=%" Pd "\n",
                 function.ToFullyQualifiedCString(),
                 osr_id,
                 function.usage_counter());
     }
 
     const Code& original_code = Code::Handle(function.CurrentCode());
     // Since the code is referenced from the frame and the ZoneHandle,
     // it cannot have been removed from the function.
@@ skipping 510 matching lines @@
   const intptr_t elm_size = old_data.ElementSizeInBytes();
   const TypedData& new_data =
       TypedData::Handle(TypedData::New(cid, new_size, Heap::kOld));
   TypedData::Copy(new_data, 0, old_data, 0, old_size * elm_size);
   typed_data_cell.SetAt(0, new_data);
   arguments.SetReturn(new_data);
 }
 
 
 }  // namespace dart