AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[deoptimizer] Fix JSFunction materialization instance size.

Browse Source 
This ensures the JSFunction objects materialized by the deoptimizer have
the correct instance size (depending on the given map). There are corner
cases where the instance size might vary due to in-object properties.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-772610
BUG=chromium:772610

Change-Id: I4808c7260db1adbd1cdc3871c2a946475e4934f2
Reviewed-on: https://chromium-review.googlesource.com/707109
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48383}
This commit is contained in:
Michael Starzinger 2017-10-09 15:06:17 +02:00 committed by Commit Bot
parent e50b49a0e3
commit c34a29549f
2 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/deoptimizer.cc
View File

@ -3635,9 +3635,8 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
return object;
}
case JS_FUNCTION_TYPE: {
Handle<JSFunction> object =
isolate_->factory()->NewFunctionFromSharedFunctionInfo(
handle(isolate_->object_function()->shared()),
Handle<JSFunction> object = isolate_->factory()->NewFunction(
map, handle(isolate_->object_function()->shared()),
handle(isolate_->context()), NOT_TENURED);
slot->value_ = object;
// We temporarily allocated a JSFunction for the {Object} function

18
test/mjsunit/regress/regress-crbug-772610.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --verify-heap --expose-gc
function f() {
var o = [{
[Symbol.toPrimitive]() {}
}];
%_DeoptimizeNow();
return o.length;
}
assertEquals(1, f());
assertEquals(1, f());
%OptimizeFunctionOnNextCall(f);
assertEquals(1, f());
gc();