AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[Turboprop] Fix Arm64 dynamic map deoptimization.

Browse Source 
BUG=chromium:1225561

Change-Id: Ia81127e489b6e790d20f73f7a4a047b6808eb81d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3001177
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75536}
This commit is contained in:
Ross McIlroy 2021-07-02 16:21:01 +01:00 committed by V8 LUCI CQ
parent f53406da00
commit 6f9b389b39
2 changed files with 29 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/backend/arm64/code-generator-arm64.cc
View File

@ -3397,13 +3397,14 @@ void CodeGenerator::PrepareForDeoptimizationExits(
__ bind(&jump_deoptimization_or_resume_entry_labels_[j]);
__ LoadEntryFromBuiltin(Deoptimizer::GetDeoptWithResumeBuiltin(reason),
scratch);
__ Jump(scratch);
}
} else {
__ bind(&jump_deoptimization_entry_labels_[i]);
__ LoadEntryFromBuiltin(Deoptimizer::GetDeoptimizationEntry(kind),
scratch);
__ Jump(scratch);
}
__ Jump(scratch);
}
}

27
test/mjsunit/regress/regress-1225561.js Normal file
View File

@ -0,0 +1,27 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --turboprop --turbo-dynamic-map-checks
function bar(obj) {
return Object.getPrototypeOf(obj);
}
function foo(a, b) {
try {
a.a;
} catch (e) {}
try {
b[bar()] = 1;
} catch (e) {}
}
var arg = {
a: 10,
};
%PrepareFunctionForOptimization(foo);
foo(arg);
%OptimizeFunctionOnNextCall(foo);
foo();