v8/test/mjsunit/regress/regress-crbug-980183.js

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

40 lines
723 B
JavaScript
Raw Normal View History

[turbofan] Track field owner maps during load elimination This CL adds additional information in PropertyAccessInfos and FieldAccesses about the map that introduced the accessed field. We use this information to prevent load elimination from incorrectly optimizing certain accesses marked const. Prior to this CL, load elimination simply stored information about eliminatable field accesses based on objects (identified by nodes in the graph) and offsets (i.e., statically known ones). In the presence of const stores and loads this is insufficient, since a single object (in the above sense) may contain distinct *const* properties at the same offset throughout its lifetime. As an example, consider the following piece of code: let obj = {}; obj.a = 0; obj[1024] = 1; // An offset of >=1024 forces an elements-kind transition delete obj.a; obj.b = 2; assertEquals(obj.b, 2); In this scenario, *both* the first ('obj.a = 0') and the second ('obj.b = 2') store to a field will be marked const by the runtime. The reason that storing to 'a' above ends up being marked const, is that 'a' before and after the elements-kind transition is encoded in separate transition trees. Removing 'a' ('delete obj.a') only invalidates const-ness in the dictionary-elements transition tree; not the holey-elements one used at the time of 'obj.a = 0'. The above situation on its own violates an invariant in load elimination. Namely, we assume that for the same object and offset, we will never encounter two const stores. One can extend the above snippet to coax load-elimination into producing incorrect results. For instance, by "hiding" 'obj.b = 2' in an unoptimized function call, the consecutive load from 'b' will incorrectly produce 0, violating the assert. R=neis@chromium.org, tebbi@chromium.org Bug: chromium:980183, chromium:983764 Change-Id: I576a9c7efd416fa9db6daff1f42d483e4bd369b4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1751346 Commit-Queue: Georg Schmid <gsps@google.com> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#63226}
2019-08-16 14:30:11 +00:00
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function f() {
const o = {};
// The order of the following operations is significant
o.a = 0;
o[1024] = 1; // An offset of >=1024 is required
delete o.a;
o.b = 2;
return o.b;
}
%PrepareFunctionForOptimization(f);
f();
f();
%OptimizeFunctionOnNextCall(f);
f();
function g(o) {
o.b = 2;
}
function h() {
const o = {};
o.a = 0;
o[1024] = 1;
delete o.a;
g(o);
assertEquals(o.b, 2);
}
%NeverOptimizeFunction(g);
%PrepareFunctionForOptimization(h);
h();
h();
%OptimizeFunctionOnNextCall(h);
h();