AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[heap-profiler] remove bogus DCHECK

Browse Source 
A map’s `constructor_or_backpointer` can be any kind of value,
because `fn.prototype = foo` sets that field to `foo` if the
latter is not a `JSReceiver`; so the `DCHECK` that is being
removed here was invalid.

Refs: https://github.com/nodejs/node/issues/18223
Bug: node:18223
Change-Id: Ia6449c07bb724e515d73b162369ab36ab1d89c6b
Reviewed-on: https://chromium-review.googlesource.com/874472
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50735}
This commit is contained in:
Anna Henningsen 2018-01-18 22:22:55 +01:00 committed by Commit Bot
parent fb9e22123d
commit 55b48798eb
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/profiler/heap-snapshot-generator.cc
View File

@ -1113,8 +1113,6 @@ void V8HeapExplorer::ExtractMapReferences(int entry, Map* map) {
constructor_or_backpointer,
Map::kConstructorOrBackPointerOffset);
} else {
DCHECK(constructor_or_backpointer->IsJSFunction() ||
constructor_or_backpointer->IsNull(map->GetIsolate()));
SetInternalReference(map, entry, "constructor", constructor_or_backpointer,
Map::kConstructorOrBackPointerOffset);
}

11
test/cctest/test-heap-profiler.cc
View File

@ -3160,3 +3160,14 @@ TEST(SamplingHeapProfilerLargeInterval) {
heap_profiler->StopSamplingHeapProfiler();
}
TEST(HeapSnapshotPrototypeNotJSReceiver) {
LocalContext env;
v8::HandleScope scope(env->GetIsolate());
v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
CompileRun(
"function object() {}"
"object.prototype = 42;");
const v8::HeapSnapshot* snapshot = heap_profiler->TakeHeapSnapshot();
CHECK(ValidateSnapshot(snapshot));
}