c0720d28db
BUG=v8:8801 Change-Id: Id5ef6219ba2dca2be0603dd0d45e7b27136836e9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1587391 Reviewed-by: Mythri Alle <mythria@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#61085}
50 lines
1.6 KiB
JavaScript
50 lines
1.6 KiB
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --opt --noalways-opt --stress-flush-bytecode
|
|
// Flags: --expose-gc
|
|
|
|
Debug = debug.Debug
|
|
|
|
function foo() {
|
|
return 44;
|
|
}
|
|
|
|
function listener(event, exec_state, event_data, data) {
|
|
if (event != Debug.DebugEvent.Break) return;
|
|
|
|
// Optimize foo.
|
|
%PrepareFunctionForOptimization(foo);
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
foo();
|
|
assertOptimized(foo);
|
|
|
|
// Lazily deopt foo, which marks the code for deoptimization and invalidates
|
|
// the DeoptimizationData, but doesn't unlink the optimized code entry in
|
|
// foo's JSFunction.
|
|
%DeoptimizeFunction(foo);
|
|
|
|
// Run the GC. Since the DeoptimizationData is now dead, the bytecode
|
|
// associated with the optimized code is free to be flushed, which also
|
|
// free's the feedback vector meta-data.
|
|
gc();
|
|
|
|
// Execute foo with side-effect checks, which causes the debugger to call
|
|
// DeoptimizeFunction on foo. Even though the code is already marked for
|
|
// deoptimization, this will try to unlink the optimized code from the
|
|
// feedback vector, which will fail due to the feedback meta-data being
|
|
// flushed. The deoptimizer should call JSFunction::ResetIfBytecodeFlushed
|
|
// before trying to do this, which will clear the whole feedback vector and
|
|
// reset the JSFunction's code entry field to CompileLazy.
|
|
exec_state.frame(0).evaluate("foo()", true);
|
|
}
|
|
|
|
// Add the debug event listener.
|
|
Debug.setListener(listener);
|
|
|
|
function f() {
|
|
debugger;
|
|
}
|
|
f();
|