Reviewers: Hannes Payer, ulan,
Description:
Fix terrible interaction with code flushing.
This fixes a terrible interaction of code flushing and the clearing of
optimized code maps hanging off a SharedFunctionInfo. The following is
what happened:
1) Incremental marking cleared map in SharedFunctionInfo s, however it
was not enqueued as a flushing candidate because one JSFunction f1
still had optimized code.
2) Deoptimization of f1 made s eligible for code flushing.
3) Optimization of f2 added new entry to optimized code map of s.
4) The closure f2 became unreachable and hence is never marked.
5) Incremental marking not visits f1, finds it eligible for flushing,
also s is eligible for flushing, both are enqueued.
6) Marking finishes, code flusher clears f1 and s, but the optimized
code map of s still contains an entry.
7) Boom!
[email protected],[email protected]
TEST=mjsunit/es6/generators-iteration
BUG=v8:3803
LOG=N
Please review this at https://codereview.chromium.org/1197713004/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+15, -4 lines):
M src/compiler.cc
M src/factory.cc
M src/heap/mark-compact.cc
M test/mjsunit/mjsunit.status
Index: src/compiler.cc
diff --git a/src/compiler.cc b/src/compiler.cc
index
ef21f1f46f9e65ff227bdefb703fe4132101c59e..52451c6bbd046c008765f545925562e591766e8b
100644
--- a/src/compiler.cc
+++ b/src/compiler.cc
@@ -705,7 +705,10 @@ MUST_USE_RESULT static MaybeHandle<Code>
GetCodeFromOptimizedCodeMap(
}
FixedArray* literals =
shared->GetLiteralsFromOptimizedCodeMap(index);
if (literals != NULL) function->set_literals(literals);
- return Handle<Code>(shared->GetCodeFromOptimizedCodeMap(index));
+ Code* code = shared->GetCodeFromOptimizedCodeMap(index);
+ DCHECK(!code->marked_for_deoptimization());
+ DCHECK(function->shared()->is_compiled());
+ return Handle<Code>(code);
}
}
return MaybeHandle<Code>();
Index: src/factory.cc
diff --git a/src/factory.cc b/src/factory.cc
index
3827fee5a5b62bb1a342b57ac408fa870f97f416..ba93e6c7ff4753fe4ac111d2cc5426b4f948b455
100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -1391,6 +1391,7 @@ Handle<JSFunction>
Factory::NewFunctionFromSharedFunctionInfo(
if (literals != NULL) result->set_literals(literals);
Code* code = info->GetCodeFromOptimizedCodeMap(index);
DCHECK(!code->marked_for_deoptimization());
+ DCHECK(result->shared()->is_compiled());
result->ReplaceCode(code);
}
Index: src/heap/mark-compact.cc
diff --git a/src/heap/mark-compact.cc b/src/heap/mark-compact.cc
index
90fc13616c65f750b974ce58ff821742603486f8..2c98b7adc4e47a01103168d819a1117dc99c0ccb
100644
--- a/src/heap/mark-compact.cc
+++ b/src/heap/mark-compact.cc
@@ -898,6 +898,11 @@ void CodeFlusher::ProcessJSFunctionCandidates() {
shared->ShortPrint();
PrintF(" - age: %d]\n", code->GetAge());
}
+ // Always flush the optimized code map if requested by flag.
+ if (FLAG_cache_optimized_code && FLAG_flush_optimized_code_cache &&
+ !shared->optimized_code_map()->IsSmi()) {
+ shared->ClearOptimizedCodeMap();
+ }
shared->set_code(lazy_compile);
candidate->set_code(lazy_compile);
} else {
@@ -941,6 +946,11 @@ void
CodeFlusher::ProcessSharedFunctionInfoCandidates() {
candidate->ShortPrint();
PrintF(" - age: %d]\n", code->GetAge());
}
+ // Always flush the optimized code map if requested by flag.
+ if (FLAG_cache_optimized_code && FLAG_flush_optimized_code_cache &&
+ !candidate->optimized_code_map()->IsSmi()) {
+ candidate->ClearOptimizedCodeMap();
+ }
candidate->set_code(lazy_compile);
}
Index: test/mjsunit/mjsunit.status
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index
53be0b080479ec7dd5ce6e84b0969c3b14398c32..07197f59b293c929f2edb177d3b0ccd68c7343a0
100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -295,9 +295,6 @@
'regress/regress-3717': [SKIP],
# Issue 478788.
'es7/object-observe': [SKIP],
-
- # Issue 3803.
- 'es6/generators-iteration': [PASS, FLAKY],
}], # 'gc_stress == True'
##############################################################################
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
