AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix flaky Array#reduce mjsunit test

Browse Source 
This CL fixes a flaky mjsunit test, that exercises Array#reduce with
sealed arrays in TurboFan. The flake was caused by temporary objects,
whos maps didn't live long enough. The code object of the function
under test holds weakly onto this maps. With a low enough gc interval,
the maps, and thus the code object, get cleaned up before the
{assertOptimized} can execute.

The fix is simply to assign these temporary objects to variables.

Bug: v8:9374
Change-Id: I43da8ba6b0194872b176e27617d9ca7fbfe43ec2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666989
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62269}
This commit is contained in:
Simon Zünd 2019-06-19 07:41:10 +02:00 committed by Commit Bot
parent 3663e83424
commit 6df0af84e2
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
test/mjsunit/sealed-array-reduce.js
View File

@ -1414,11 +1414,18 @@ assertEquals(undefined, Object.seal(arr).reduceRight(function(val) { return val
function r(a) {
return a.reduce((acc, i) => {acc[0]});
};
// Hold on to the objects, otherwise their maps might be garbage
// collected and {r} will get deoptmized before the {assertOptimized}.
const object1 = Object.seal([[0]]);
const object2 = Object.seal([0,,]);
const object3 = Object.seal([,0,0]);
%PrepareFunctionForOptimization(r);
assertEquals(r(Object.seal([[0]])), [0]);
assertEquals(r(Object.seal([[0]])), [0]);
assertEquals(r(Object.seal([0,,])), 0);
assertEquals(r(object1), [0]);
assertEquals(r(object1), [0]);
assertEquals(r(object2), 0);
%OptimizeFunctionOnNextCall(r);
assertEquals(r(Object.seal([,0,0])), undefined);
assertEquals(r(object3), undefined);
assertOptimized(r);
})();