b9e0b87a5a
This adds a pointer to the shared function info into deoptimization data of an optimized code. Whenever the code is deoptimized, it clears the cache in the shared function info. This fixes the problem when the optimized function dies in new space GC before the code is deoptimized due to code dependency and before the optimized code cache is cleared in old space GC (see mjsunit/regress/regress-343609.js). This partially reverts r19603 because we need to be able to evict specific code from the optimized code cache. BUG=343609 LOG=Y TEST=mjsunit/regress/regress-343609.js R=yangguo@chromium.org Review URL: https://codereview.chromium.org/184923002 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19635 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
67 lines
1.3 KiB
JavaScript
67 lines
1.3 KiB
JavaScript
// Copyright 2014 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --block-concurrent-recompilation
|
|
// Flags: --no-concurrent-osr --expose-gc
|
|
|
|
function Ctor() {
|
|
this.a = 1;
|
|
}
|
|
|
|
function get_closure() {
|
|
return function add_field(obj) {
|
|
obj.c = 3;
|
|
obj.a = obj.a + obj.c;
|
|
return obj.a;
|
|
}
|
|
}
|
|
function get_closure2() {
|
|
return function cc(obj) {
|
|
obj.c = 3;
|
|
obj.a = obj.a + obj.c;
|
|
}
|
|
}
|
|
|
|
function dummy() {
|
|
(function () {
|
|
var o = {c: 10};
|
|
var f1 = get_closure2();
|
|
f1(o);
|
|
f1(o);
|
|
%OptimizeFunctionOnNextCall(f1);
|
|
f1(o);
|
|
})();
|
|
}
|
|
|
|
var o = new Ctor();
|
|
function opt() {
|
|
(function () {
|
|
var f1 = get_closure();
|
|
f1(new Ctor());
|
|
f1(new Ctor());
|
|
%OptimizeFunctionOnNextCall(f1);
|
|
f1(o);
|
|
})();
|
|
}
|
|
|
|
// Optimize add_field and install its code in optimized code cache.
|
|
opt();
|
|
opt();
|
|
opt();
|
|
|
|
// Optimize dummy function to remove the add_field from head of optimized
|
|
// function list in the context.
|
|
dummy();
|
|
dummy();
|
|
|
|
// Kill add_field in new space GC.
|
|
for(var i = 0; i < 3; i++) gc(true);
|
|
|
|
// Trigger deopt.
|
|
o.c = 2.2;
|
|
|
|
// Fetch optimized code of add_field from cache and crash.
|
|
var f2 = get_closure();
|
|
f2(new Ctor());
|