From 78049e9c4837f053575d6c71e53ae12fec99f1aa Mon Sep 17 00:00:00 2001 From: hablich Date: Mon, 11 Apr 2016 08:35:22 -0700 Subject: [PATCH] Revert of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1869693003/ ) Reason for revert: Blocks current roll: https://codereview.chromium.org/1876713002/ according to bisect: https://codereview.chromium.org/1872353002/#ps80001 Original issue's description: > [compiler] Make feedback vector cope with flag changes. > > This fixes corner cases where the layout of feedback vectors baked into > the snapshot is different from the expected layout, depending on some > runtime flags. We make sure the feedback vector is regenereated for > functions that are not compiled. Flag changes of this kind are only > allowed when code is not serialized. > > An alternative solution would be to not serialize the feedback vector > for such cases in the first place. That solution however would have a > higher overhead, as it would required the serializer to be able to > recognize feedback vectors while generating a snapshot. > > R=mvstanton@chromium.org > TEST=mjsunit/regress/regress-crbug-600995 > BUG=chromium:600995 > LOG=n > > Committed: https://crrev.com/460bff5fb6af2bd79e610f89afdf6da9dba3cf0c > Cr-Commit-Position: refs/heads/master@{#35339} TBR=mvstanton@chromium.org,mstarzinger@chromium.org BUG=chromium:600995 LOG=N NOTRY=true Review URL: https://codereview.chromium.org/1876103002 Cr-Commit-Position: refs/heads/master@{#35392} --- src/compiler.cc | 8 +++----- test/mjsunit/regress/regress-crbug-600995.js | 10 ---------- 2 files changed, 3 insertions(+), 15 deletions(-) delete mode 100644 test/mjsunit/regress/regress-crbug-600995.js diff --git a/src/compiler.cc b/src/compiler.cc index e80dacef5c..205a85eb9f 100644 --- a/src/compiler.cc +++ b/src/compiler.cc @@ -524,11 +524,9 @@ void EnsureFeedbackVector(CompilationInfo* info) { if (!info->has_shared_info()) return; // If no type feedback vector exists, we create one now. At this point the - // AstNumbering pass has already run. Note the snapshot can contain outdated - // vectors for a different configuration, hence we also recreate a new vector - // when the function is not compiled (i.e. no code was serialized). - if (info->shared_info()->feedback_vector()->is_empty() || - !info->shared_info()->is_compiled()) { + // AstNumbering pass has already run. Note that we should reuse any existing + // feedback vector rather than creating a new one. + if (info->shared_info()->feedback_vector()->is_empty()) { Handle feedback_metadata = TypeFeedbackMetadata::New( info->isolate(), info->literal()->feedback_vector_spec()); Handle feedback_vector = diff --git a/test/mjsunit/regress/regress-crbug-600995.js b/test/mjsunit/regress/regress-crbug-600995.js deleted file mode 100644 index c532608799..0000000000 --- a/test/mjsunit/regress/regress-crbug-600995.js +++ /dev/null @@ -1,10 +0,0 @@ -// Copyright 2016 the V8 project authors. All rights reserved. -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -// Flags: --noharmony-iterator-close - -// The {Set} function will produce a different type feedback vector layout -// depending on whether Harmony iterator finalization is enabled or not. - -new Set();