b06a134c24
If we flush the bytecode from a SFI we might recompile a JSFunction while the function still has its old feedback vector. This should usually be fine since the new and old feedback vectors have the same layout, however some bugs in the parser mean that it's possible for eagerly and lazily compiled eval functions to have different bytecode and so potentially different feedback vector layouts. For now reset the feedback vector if it doesn't have the same size when we compile the JSFunction, and recreate a new one of the correct layout. This will be replaced with a CHECK once the parser bugs are fixed. BUG=chromium:984344,v8:9511 Change-Id: Ib8976f2541516f7a07e4d4ab7dc3c750dfe9b5d4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708474 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#62800}
35 lines
863 B
JavaScript
35 lines
863 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function largeAllocToTriggerGC() {
|
|
for (let i = 0; i < 16; i++) {
|
|
let ab = new ArrayBuffer(1024 * 1024 * 10);
|
|
}
|
|
}
|
|
|
|
function foo() {
|
|
eval('function bar(a) {}' +
|
|
'(function() {' +
|
|
' for (let c = 0; c < 505; c++) {' +
|
|
' while (Promise >= 0xDEADBEEF) {' +
|
|
' Array.prototype.slice.call(bar, bar, bar);' +
|
|
' }' +
|
|
' for (let i = 0; i < 413; i++) {' +
|
|
' }' +
|
|
' }' +
|
|
'})();' +
|
|
'largeAllocToTriggerGC();');
|
|
}
|
|
|
|
|
|
foo();
|
|
foo();
|
|
foo();
|
|
// Don't prepare until here to allow function to be flushed.
|
|
%PrepareFunctionForOptimization(foo);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|