f85826eaf2
This CL adds additional information in PropertyAccessInfos and FieldAccesses about the map that introduced the accessed field. We use this information to prevent load elimination from incorrectly optimizing certain accesses marked const.
Prior to this CL, load elimination simply stored information about eliminatable field accesses based on objects (identified by nodes in the graph) and offsets (i.e., statically known ones). In the presence of const stores and loads this is insufficient, since a single object (in the above sense) may contain distinct *const* properties at the same offset throughout its lifetime. As an example, consider the following piece of code:
let obj = {};
obj.a = 0;
obj[1024] = 1; // An offset of >=1024 forces an elements-kind transition
delete obj.a;
obj.b = 2;
assertEquals(obj.b, 2);
In this scenario, *both* the first ('obj.a = 0') and the second ('obj.b = 2') store to a field will be marked const by the runtime. The reason that storing to 'a' above ends up being marked const, is that 'a' before and after the elements-kind transition is encoded in separate transition trees. Removing 'a' ('delete obj.a') only invalidates const-ness in the dictionary-elements transition tree; not the holey-elements one used at the time of 'obj.a = 0'.
The above situation on its own violates an invariant in load elimination. Namely, we assume that for the same object and offset, we will never encounter two const stores. One can extend the above snippet to coax load-elimination into producing incorrect results. For instance, by "hiding" 'obj.b = 2' in an unoptimized function call, the consecutive load from 'b' will incorrectly produce 0, violating the assert.
R=neis@chromium.org, tebbi@chromium.org
Bug: chromium:980183, chromium:983764
Change-Id: I576a9c7efd416fa9db6daff1f42d483e4bd369b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1751346
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63226}
40 lines
723 B
JavaScript
40 lines
723 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function f() {
|
|
const o = {};
|
|
// The order of the following operations is significant
|
|
o.a = 0;
|
|
o[1024] = 1; // An offset of >=1024 is required
|
|
delete o.a;
|
|
o.b = 2;
|
|
return o.b;
|
|
}
|
|
%PrepareFunctionForOptimization(f);
|
|
f();
|
|
f();
|
|
%OptimizeFunctionOnNextCall(f);
|
|
f();
|
|
|
|
|
|
function g(o) {
|
|
o.b = 2;
|
|
}
|
|
function h() {
|
|
const o = {};
|
|
o.a = 0;
|
|
o[1024] = 1;
|
|
delete o.a;
|
|
g(o);
|
|
assertEquals(o.b, 2);
|
|
}
|
|
%NeverOptimizeFunction(g);
|
|
%PrepareFunctionForOptimization(h);
|
|
h();
|
|
h();
|
|
%OptimizeFunctionOnNextCall(h);
|
|
h();
|