83fd3e84ac
With bytecode flushing and the current OSR triggering mechanism which stores OSR nesting level on bytecode array it is possible to trigger OSR on a closure that doesn't have feedback vector. Bug: chromium:1031479 Change-Id: I4c62486f6b0eb6d6f9c96f98c1c1b275f3e6d6d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1962850 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#65431}
38 lines
1.2 KiB
JavaScript
38 lines
1.2 KiB
JavaScript
// Copyright 2015 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --interrupt-budget=200 --stack-size=200 --budget-for-feedback-vector-allocation=100 --expose-gc --stress-flush-bytecode
|
|
|
|
var i = 0;
|
|
function main() {
|
|
function v0() {
|
|
function v10(a) {
|
|
i++;
|
|
var cur_i = i;
|
|
try {
|
|
// This triggers the use of old closure that was installed in the
|
|
// earlier invocation of v10 and causes an infinite recursion. At
|
|
// some point we throw from here.
|
|
[].e = 1;
|
|
|
|
// Throw when the new closure is on the stack to trigger a OSR on
|
|
// the new closure
|
|
if (cur_i == 2) throw 1;
|
|
} catch(v22) {
|
|
// This loop triggers OSR.
|
|
for (const v24 in "c19rXGEC2E") {
|
|
}
|
|
}
|
|
}
|
|
const v25 = v10(1);
|
|
// We install v10's closure here. The bytecode for v10 gets flushed on gc()
|
|
const v21 = Object.defineProperty([].__proto__,"e",{set:v10});
|
|
}
|
|
const v26 = v0();
|
|
// With --stress-flush-bytecode GC flushes the bytecode for v0 and v10
|
|
gc();
|
|
assertThrows(v0, TypeError);
|
|
}
|
|
main();
|