AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[CloneObjectIC] overwrite monomorphic/polymorphic feedback if deprecated

Browse Source 
An object with a deprecated Map which has already been cached in
CloneObjectIC feedback is still a valid Map for fast cloning --- but
to be consistent with other ICs, deprecated maps are ignored, and are
expected to be transitioned away from.

If the source object has a deprecated map, the instance is migrated.

BUG=v8:7611, chromium:867958
R=jkummerow@chromium.org, mvstanton@chromium.org

Change-Id: I9771b00400fb4dda45a62e874a31d9b50630d847
Reviewed-on: https://chromium-review.googlesource.com/1152414
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#54758}
This commit is contained in:
Caitlin Potter 2018-07-27 08:42:31 -04:00 committed by Commit Bot
parent 4792240096
commit 670fa86fd1
3 changed files with 23 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/feedback-vector.cc
View File

@ -756,13 +756,14 @@ void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
SetFeedbackExtra(*result_map);
break;
case MONOMORPHIC:
if (maybe_feedback->IsClearedWeakHeapObject()) {
if (maybe_feedback->IsClearedWeakHeapObject() ||
Map::cast(*feedback)->is_deprecated()) {
// Remain in MONOMORPHIC state if previous feedback has been collected.
SetFeedback(HeapObjectReference::Weak(*source_map));
SetFeedbackExtra(*result_map);
} else {
// Transition to POLYMORPHIC.
DCHECK_NE(*source_map, *feedback);
DCHECK(!source_map.is_identical_to(feedback));
Handle<WeakFixedArray> array =
EnsureArrayOfSize(2 * kCloneObjectPolymorphicEntrySize);
array->Set(0, maybe_feedback);
@ -778,10 +779,12 @@ void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
Handle<WeakFixedArray> array = Handle<WeakFixedArray>::cast(feedback);
int i = 0;
for (; i < array->length(); i += kCloneObjectPolymorphicEntrySize) {
if (array->Get(i)->IsClearedWeakHeapObject()) {
MaybeObjectHandle feedback(array->Get(i), isolate);
if (feedback->IsClearedWeakHeapObject() ||
Map::cast(*feedback.object())->is_deprecated()) {
break;
}
DCHECK_NE(array->Get(i)->GetHeapObject(), *source_map);
DCHECK(!feedback.object().is_identical_to(source_map));
}
if (i >= array->length()) {

3
src/ic/ic.cc
View File

@ -2549,6 +2549,9 @@ RUNTIME_FUNCTION(Runtime_CloneObjectIC_Miss) {
DCHECK_EQ(4, args.length());
Handle<HeapObject> source = args.at<HeapObject>(0);
int flags = args.smi_at(1);
MigrateDeprecated(source);
FeedbackSlot slot = FeedbackVector::ToSlot(args.smi_at(2));
Handle<FeedbackVector> vector = args.at<FeedbackVector>(3);

13
test/mjsunit/es9/regress/regress-867958.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Check that encountering deprecated Maps does not cause CloneObjectIC to
// crash.
var obj1 = { x: 1 };
var obj2 = { x: 2 }; // same map
obj2.x = null; // deprecate map
function f() { return { ...obj1 } };
assertEquals({ x: 1 }, f()); // missed, object migrated to cached new map
assertEquals({ x: 1 }, f()); // monomorphic cache-hit