ef7d657960
Add support to flush only baseline code. FLAG_flush_baseline_code controls if baseline code is flushed or not and FLAG_flush_bytecode controls if bytecode is flushed or not. With this CL it is possible to control if we want to flush only bytecode / only baseline code / both. This also lets us have different heuristics for bytecode and baseline code flushing. Bug: v8:11947 Change-Id: Ibdfb9d8be7e7d54196db7890541fa0b5d84f037e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3060481 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#76075}
50 lines
1.6 KiB
JavaScript
50 lines
1.6 KiB
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --opt --noalways-opt --stress-flush-code
|
|
// Flags: --expose-gc --flush-bytecode
|
|
|
|
Debug = debug.Debug
|
|
|
|
function foo() {
|
|
return 44;
|
|
}
|
|
|
|
function listener(event, exec_state, event_data, data) {
|
|
if (event != Debug.DebugEvent.Break) return;
|
|
|
|
// Optimize foo.
|
|
%PrepareFunctionForOptimization(foo);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|
|
assertOptimized(foo);
|
|
|
|
// Lazily deopt foo, which marks the code for deoptimization and invalidates
|
|
// the DeoptimizationData, but doesn't unlink the optimized code entry in
|
|
// foo's JSFunction.
|
|
%DeoptimizeFunction(foo);
|
|
|
|
// Run the GC. Since the DeoptimizationData is now dead, the bytecode
|
|
// associated with the optimized code is free to be flushed, which also
|
|
// free's the feedback vector meta-data.
|
|
gc();
|
|
|
|
// Execute foo with side-effect checks, which causes the debugger to call
|
|
// DeoptimizeFunction on foo. Even though the code is already marked for
|
|
// deoptimization, this will try to unlink the optimized code from the
|
|
// feedback vector, which will fail due to the feedback meta-data being
|
|
// flushed. The deoptimizer should call JSFunction::ResetIfBytecodeFlushed
|
|
// before trying to do this, which will clear the whole feedback vector and
|
|
// reset the JSFunction's code entry field to CompileLazy.
|
|
exec_state.frame(0).evaluate("foo()", true);
|
|
}
|
|
|
|
// Add the debug event listener.
|
|
Debug.setListener(listener);
|
|
|
|
function f() {
|
|
debugger;
|
|
}
|
|
f();
|