AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[compiler] Remove invalid CHECK on mutable map bits

Browse Source 
is_deprecated and is_stable are mutable and can be changed
concurrently.  We protect against changes through dependencies. CHECKs
on such fields are invalid.

Bug: v8:7790,chromium:1234206
Change-Id: I9bb7fab0342e0e2c33377c162b1912a8f93e760b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3059682
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75973}
This commit is contained in:
Jakob Gruber 2021-07-29 07:36:02 +02:00 committed by V8 LUCI CQ
parent 79c612b526
commit da3698523a
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/compiler/access-info.cc
View File

@ -936,7 +936,6 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
holder = prototype->AsJSObject();
map = map_prototype_map;
CHECK(!map.is_deprecated());
if (!CanInlinePropertyAccess(map, access_mode)) {
return Invalid();
@ -944,8 +943,12 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
// Successful lookup on prototype chain needs to guarantee that all the
// prototypes up to the holder have stable maps, except for dictionary-mode
// prototypes.
CHECK_IMPLIES(!map.is_dictionary_map(), map.is_stable());
// prototypes. We currently do this by taking a
// DependOnStablePrototypeChains dependency in the caller.
//
// TODO(jgruber): This is brittle and easy to miss. Consider a refactor
// that moves the responsibility of taking the dependency into
// AccessInfoFactory.
}
UNREACHABLE();
}

3
src/compiler/js-native-context-specialization.cc
View File

@ -551,8 +551,9 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
}
map = map_prototype->map();
// TODO(v8:11457) Support dictionary mode protoypes here.
if (!map.is_stable() || map.is_dictionary_map())
if (!map.is_stable() || map.is_dictionary_map()) {
return kMayBeInPrototypeChain;
}
if (map.oddball_type() == OddballType::kNull) {
all = false;
break;