AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Monomorphic and polymorphic ICs with cleared maps should not go megamorphic.

Browse Source 
BUG=v8:3663
TEST=cctest/test-heap/MonomorphicStaysMonomorphicAfterGC
LOG=N

Review URL: https://codereview.chromium.org/816653002

Cr-Commit-Position: refs/heads/master@{#25882}
This commit is contained in:
ulan 2014-12-18 05:09:37 -08:00 committed by Commit bot
parent 377de64246
commit 9ffdae66e2
2 changed files with 92 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/ic/ic.cc
View File

@ -832,7 +832,10 @@ bool IC::UpdatePolymorphicIC(Handle<Name> name, Handle<Code> code) {
number_of_types - deprecated_types - (handler_to_overwrite != -1);
if (number_of_valid_types >= 4) return false;
if (number_of_types == 0) return false;
if (number_of_types == 0 && state() != MONOMORPHIC &&
state() != POLYMORPHIC) {
return false;
}
if (UseVector()) {
if (!nexus()->FindHandlers(&handlers, types.length())) return false;
} else {

88
test/cctest/test-heap.cc
View File

@ -4639,6 +4639,94 @@ TEST(WeakMapInMonomorphicCompareNilIC) {
}
Handle<JSFunction> GetFunctionByName(Isolate* isolate, const char* name) {
Handle<String> str = isolate->factory()->InternalizeUtf8String(name);
Handle<Object> obj =
Object::GetProperty(isolate->global_object(), str).ToHandleChecked();
return Handle<JSFunction>::cast(obj);
}
void CheckIC(Code* code, Code::Kind kind, InlineCacheState state) {
Code* ic = FindFirstIC(code, kind);
CHECK(ic->is_inline_cache_stub());
CHECK(ic->ic_state() == state);
}
TEST(MonomorphicStaysMonomorphicAfterGC) {
if (FLAG_always_opt) return;
// TODO(mvstanton): vector ics need weak support!
if (FLAG_vector_ics) return;
CcTest::InitializeVM();
Isolate* isolate = CcTest::i_isolate();
Heap* heap = isolate->heap();
v8::HandleScope scope(CcTest::isolate());
CompileRun(
"function loadIC(obj) {"
" return obj.name;"
"}"
"function testIC() {"
" var proto = {'name' : 'weak'};"
" var obj = Object.create(proto);"
" loadIC(obj);"
" loadIC(obj);"
" loadIC(obj);"
" return proto;"
"};");
Handle<JSFunction> loadIC = GetFunctionByName(isolate, "loadIC");
{
v8::HandleScope scope(CcTest::isolate());
CompileRun("(testIC())");
}
heap->CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
CheckIC(loadIC->code(), Code::LOAD_IC, MONOMORPHIC);
{
v8::HandleScope scope(CcTest::isolate());
CompileRun("(testIC())");
}
CheckIC(loadIC->code(), Code::LOAD_IC, MONOMORPHIC);
}
TEST(PolymorphicStaysPolymorphicAfterGC) {
if (FLAG_always_opt) return;
// TODO(mvstanton): vector ics need weak support!
if (FLAG_vector_ics) return;
CcTest::InitializeVM();
Isolate* isolate = CcTest::i_isolate();
Heap* heap = isolate->heap();
v8::HandleScope scope(CcTest::isolate());
CompileRun(
"function loadIC(obj) {"
" return obj.name;"
"}"
"function testIC() {"
" var proto = {'name' : 'weak'};"
" var obj = Object.create(proto);"
" loadIC(obj);"
" loadIC(obj);"
" loadIC(obj);"
" var poly = Object.create(proto);"
" poly.x = true;"
" loadIC(poly);"
" return proto;"
"};");
Handle<JSFunction> loadIC = GetFunctionByName(isolate, "loadIC");
{
v8::HandleScope scope(CcTest::isolate());
CompileRun("(testIC())");
}
heap->CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
CheckIC(loadIC->code(), Code::LOAD_IC, POLYMORPHIC);
{
v8::HandleScope scope(CcTest::isolate());
CompileRun("(testIC())");
}
CheckIC(loadIC->code(), Code::LOAD_IC, POLYMORPHIC);
}
TEST(WeakCell) {
CcTest::InitializeVM();
Isolate* isolate = CcTest::i_isolate();