7e0f961e4d
This CL teaches the deoptimizer about JavaScriptBuiltinContinuation frames that are not preceded by argument adapter frames. This pattern is used when calling C++ API functions from TurboFan. This CL fixes a crash when the deoptimizer encounters the pattern described above. The crash was caused when the deoptimizer tried to read the arguments of the continuation frame. As no adapter frame was present, the argument count was read from the SharedFunctionInfo which had the kDontAdaptArgumentsSentinel value. This translated to an argument count of ~65000 later down the line, which caused a FATAL error when the deoptimizer tried to re-construct ~65000 non-existent values. Bug: chromium:980529 Change-Id: Id2de3bf7607102ab5a16de344c649015e968b185 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687417 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#62547}
20 lines
426 B
JavaScript
20 lines
426 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --opt --no-always-opt
|
|
|
|
const a = {toString: () => {
|
|
console.log("print arguments", print.arguments);
|
|
}};
|
|
|
|
function g(x) {
|
|
print(x);
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(g);
|
|
g(a);
|
|
g(a);
|
|
%OptimizeFunctionOnNextCall(g);
|
|
g(a);
|