AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[compiler] Don't migrate boilerplates during TurboFan compile.

Browse Source 
Instead, bail out of inline literal creation if a deprecated map is
found. This makes it easier to compile on the background thread.

Bug: v8:7790
Change-Id: I87941938d4f13dcf49230cf246c33bf2f49897f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2745134
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73988}
This commit is contained in:
Mike Stanton 2021-04-16 09:56:58 +02:00 committed by Commit Bot
parent 1ee8df3c4e
commit d75813657d
2 changed files with 38 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/compiler/js-heap-broker.cc
View File

@ -980,14 +980,17 @@ bool IsFastLiteralHelper(Handle<JSObject> boilerplate, int max_depth,
DCHECK_GE(max_depth, 0);
DCHECK_GE(*max_properties, 0);
Isolate* const isolate = boilerplate->GetIsolate();
// Make sure the boilerplate map is not deprecated.
if (!JSObject::TryMigrateInstance(isolate, boilerplate)) return false;
// Check for too deep nesting.
if (max_depth == 0) return false;
Isolate* const isolate = boilerplate->GetIsolate();
// If the boilerplate map has been deprecated, bailout of fast literal
// optimization. The map could be deprecated at some point after the line
// below, but it's not a correctness issue -- it only means the literal isn't
// created with the most up to date map(s).
if (boilerplate->map().is_deprecated()) return false;
// Check the elements.
Handle<FixedArrayBase> elements(boilerplate->elements(), isolate);
if (elements->length() > 0 &&
@ -2349,7 +2352,6 @@ void JSObjectData::SerializeRecursiveAsBoilerplate(JSHeapBroker* broker,
// We only serialize boilerplates that pass the IsInlinableFastLiteral
// check, so we only do a check on the depth here.
CHECK_GT(depth, 0);
CHECK(!boilerplate->map().is_deprecated());
// Serialize the elements.
Isolate* const isolate = broker->isolate();

30
test/mjsunit/compiler/test-literal-map-migration.js Normal file
View File

@ -0,0 +1,30 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --opt --no-always-opt
function f() {
let r = [];
let o1 = { x: 5 };
let o2 = { y: 5, inner: { n: 5 } };
r.push(o1);
r.push(o2);
return r;
}
%PrepareFunctionForOptimization(f);
{
let r = f();
f();
// Deprecate all the maps.
r[0].x = 5.5;
r[1].y = 5.5;
r[1].inner.n = 5.5;
}
// We will optimize despite deprecated maps in the boilerplates.
// until code finalization.
%OptimizeFunctionOnNextCall(f);
f();
assertOptimized(f);