Revision: 5522
Author: [email protected]
Date: Fri Sep 24 03:24:53 2010
Log: Merge r5518 into 2.3 branch.
Fix assertion failure in NormalizedMapCache.
Review URL: http://codereview.chromium.org/3501007
http://code.google.com/p/v8/source/detail?r=5522
Modified:
/branches/2.3/src/objects-debug.cc
/branches/2.3/src/objects-inl.h
/branches/2.3/src/objects.cc
/branches/2.3/src/objects.h
/branches/2.3/src/version.cc
/branches/2.3/test/cctest/test-api.cc
=======================================
--- /branches/2.3/src/objects-debug.cc Wed Aug 25 08:26:24 2010
+++ /branches/2.3/src/objects-debug.cc Fri Sep 24 03:24:53 2010
@@ -649,8 +649,9 @@
}
-void Map::NormalizedMapVerify() {
+void Map::SharedMapVerify() {
MapVerify();
+ ASSERT(is_shared());
ASSERT_EQ(Heap::empty_descriptor_array(), instance_descriptors());
ASSERT_EQ(Heap::empty_fixed_array(), code_cache());
ASSERT_EQ(0, pre_allocated_property_fields());
@@ -1381,7 +1382,7 @@
for (int i = 0; i < length(); i++) {
Object* e = get(i);
if (e->IsMap()) {
- Map::cast(e)->NormalizedMapVerify();
+ Map::cast(e)->SharedMapVerify();
} else {
ASSERT(e->IsUndefined());
}
=======================================
--- /branches/2.3/src/objects-inl.h Wed Aug 25 08:26:24 2010
+++ /branches/2.3/src/objects-inl.h Fri Sep 24 03:24:53 2010
@@ -2268,6 +2268,18 @@
}
+void Map::set_is_shared(bool value) {
+ if (value) {
+ set_bit_field2(bit_field2() | (1 << kIsShared));
+ } else {
+ set_bit_field2(bit_field2() & ~(1 << kIsShared));
+ }
+}
+
+bool Map::is_shared() {
+ return ((1 << kIsShared) & bit_field2()) != 0;
+}
+
Code::Flags Code::flags() {
return static_cast<Flags>(READ_INT_FIELD(this, kFlagsOffset));
=======================================
--- /branches/2.3/src/objects.cc Thu Sep 16 05:46:49 2010
+++ /branches/2.3/src/objects.cc Fri Sep 24 03:24:53 2010
@@ -2096,64 +2096,37 @@
LocalLookup(name, &result);
return GetPropertyAttribute(this, &result, name, false);
}
-
-
-bool NormalizedMapCache::IsCacheable(JSObject* object) {
- // Caching for global objects is not worth it (there are too few of
them).
- return !object->IsGlobalObject();
-}
Object* NormalizedMapCache::Get(JSObject* obj, PropertyNormalizationMode
mode) {
- Object* result;
-
Map* fast = obj->map();
- if (!IsCacheable(obj)) {
- result = fast->CopyNormalized(mode);
- if (result->IsFailure()) return result;
- } else {
- int index = Hash(fast) % kEntries;
- result = get(index);
-
- if (result->IsMap() && CheckHit(Map::cast(result), fast, mode)) {
+ int index = Hash(fast) % kEntries;
+ Object* result = get(index);
+ if (result->IsMap() && CheckHit(Map::cast(result), fast, mode)) {
#ifdef DEBUG
- if (FLAG_enable_slow_asserts) {
- // Make sure that the new slow map has exactly the same hash as the
- // original fast map. This way we can use hash to check if a slow
map
- // is already in the hash (see Contains method).
- ASSERT(Hash(fast) == Hash(Map::cast(result)));
- // The cached map should match newly created normalized map
bit-by-bit.
- Object* fresh = fast->CopyNormalized(mode);
- if (!fresh->IsFailure()) {
- // Copy the unused byte so that the assertion below works.
- Map::cast(fresh)->address()[Map::kUnusedOffset] =
- Map::cast(result)->address()[Map::kUnusedOffset];
- ASSERT(memcmp(Map::cast(fresh)->address(),
- Map::cast(result)->address(),
- Map::kSize) == 0);
- }
- }
-#endif
- return result;
- }
-
- result = fast->CopyNormalized(mode);
- if (result->IsFailure()) return result;
- set(index, result);
- }
+ if (FLAG_enable_slow_asserts) {
+ // The cached map should match newly created normalized map
bit-by-bit.
+ Object* fresh = fast->CopyNormalized(mode, SHARED_NORMALIZED_MAP);
+ if (!fresh->IsFailure()) {
+ // Copy the unused byte so that the assertion below works.
+ Map::cast(fresh)->address()[Map::kUnusedOffset] =
+ Map::cast(result)->address()[Map::kUnusedOffset];
+ ASSERT(memcmp(Map::cast(fresh)->address(),
+ Map::cast(result)->address(),
+ Map::kSize) == 0);
+ }
+ }
+#endif
+ return result;
+ }
+
+ result = fast->CopyNormalized(mode, SHARED_NORMALIZED_MAP);
+ if (result->IsFailure()) return result;
+ set(index, result);
Counters::normalized_maps.Increment();
return result;
}
-
-
-bool NormalizedMapCache::Contains(Map* map) {
- // If the map is present in the cache it can only be at one place:
- // at the index calculated from the hash. We assume that a slow map has
the
- // same hash as a fast map it has been generated from.
- int index = Hash(map) % kEntries;
- return get(index) == map;
-}
void NormalizedMapCache::Clear() {
@@ -2186,7 +2159,7 @@
Map* fast,
PropertyNormalizationMode mode) {
#ifdef DEBUG
- slow->NormalizedMapVerify();
+ slow->SharedMapVerify();
#endif
return
slow->constructor() == fast->constructor() &&
@@ -2196,17 +2169,17 @@
fast->inobject_properties()) &&
slow->instance_type() == fast->instance_type() &&
slow->bit_field() == fast->bit_field() &&
- slow->bit_field2() == fast->bit_field2();
+ (slow->bit_field2() & ~(1<<Map::kIsShared)) == fast->bit_field2();
}
Object* JSObject::UpdateMapCodeCache(String* name, Code* code) {
- if (!HasFastProperties() &&
- NormalizedMapCache::IsCacheable(this) &&
- Top::context()->global_context()->normalized_map_cache()->
- Contains(map())) {
- // Replace the map with the identical copy that can be safely modified.
- Object* obj = map()->CopyNormalized(KEEP_INOBJECT_PROPERTIES);
+ if (map()->is_shared()) {
+ // Fast case maps are never marked as shared.
+ ASSERT(!HasFastProperties());
+ // Replace the map with an identical copy that can be safely modified.
+ Object* obj = map()->CopyNormalized(KEEP_INOBJECT_PROPERTIES,
+ UNIQUE_NORMALIZED_MAP);
if (obj->IsFailure()) return obj;
Counters::normalized_maps.Increment();
@@ -3191,12 +3164,14 @@
}
Map::cast(result)->set_bit_field(bit_field());
Map::cast(result)->set_bit_field2(bit_field2());
+ Map::cast(result)->set_is_shared(false);
Map::cast(result)->ClearCodeCache();
return result;
}
-Object* Map::CopyNormalized(PropertyNormalizationMode mode) {
+Object* Map::CopyNormalized(PropertyNormalizationMode mode,
+ NormalizedMapSharingMode sharing) {
int new_instance_size = instance_size();
if (mode == CLEAR_INOBJECT_PROPERTIES) {
new_instance_size -= inobject_properties() * kPointerSize;
@@ -3215,8 +3190,12 @@
Map::cast(result)->set_bit_field(bit_field());
Map::cast(result)->set_bit_field2(bit_field2());
+ Map::cast(result)->set_is_shared(sharing == SHARED_NORMALIZED_MAP);
+
#ifdef DEBUG
- Map::cast(result)->NormalizedMapVerify();
+ if (Map::cast(result)->is_shared()) {
+ Map::cast(result)->SharedMapVerify();
+ }
#endif
return result;
=======================================
--- /branches/2.3/src/objects.h Thu Sep 16 05:46:49 2010
+++ /branches/2.3/src/objects.h Fri Sep 24 03:24:53 2010
@@ -201,6 +201,14 @@
};
+// NormalizedMapSharingMode is used to specify whether a map may be shared
+// by different objects with normalized properties.
+enum NormalizedMapSharingMode {
+ UNIQUE_NORMALIZED_MAP,
+ SHARED_NORMALIZED_MAP
+};
+
+
// Instance size sentinel for objects of variable size.
static const int kVariableSizeSentinel = 0;
@@ -2480,12 +2488,8 @@
public:
static const int kEntries = 64;
- static bool IsCacheable(JSObject* object);
-
Object* Get(JSObject* object, PropertyNormalizationMode mode);
- bool Contains(Map* map);
-
void Clear();
// Casting
@@ -3140,6 +3144,13 @@
inline bool has_fast_elements() {
return ((1 << kHasFastElements) & bit_field2()) != 0;
}
+
+ // Tells whether the map is shared between objects that may have
different
+ // behavior. If true, the map should never be modified, instead a clone
+ // should be created and modified.
+ inline void set_is_shared(bool value);
+
+ inline bool is_shared();
// Tells whether the instance needs security checks when accessing its
// properties.
@@ -3160,7 +3171,8 @@
Object* CopyDropDescriptors();
- Object* CopyNormalized(PropertyNormalizationMode mode);
+ Object* CopyNormalized(PropertyNormalizationMode mode,
+ NormalizedMapSharingMode sharing);
// Returns a copy of the map, with all transitions dropped from the
// instance descriptors.
@@ -3224,7 +3236,7 @@
#ifdef DEBUG
void MapPrint();
void MapVerify();
- void NormalizedMapVerify();
+ void SharedMapVerify();
#endif
inline int visitor_id();
@@ -3285,6 +3297,7 @@
static const int kFunctionWithPrototype = 1;
static const int kHasFastElements = 2;
static const int kStringWrapperSafeForDefaultValueOf = 3;
+ static const int kIsShared = 5;
// Layout of the default cache. It holds alternating name and code
objects.
static const int kCodeCacheEntrySize = 2;
=======================================
--- /branches/2.3/src/version.cc Wed Sep 22 05:59:55 2010
+++ /branches/2.3/src/version.cc Fri Sep 24 03:24:53 2010
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 2
#define MINOR_VERSION 3
#define BUILD_NUMBER 11
-#define PATCH_LEVEL 12
+#define PATCH_LEVEL 13
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
=======================================
--- /branches/2.3/test/cctest/test-api.cc Fri Sep 17 06:28:10 2010
+++ /branches/2.3/test/cctest/test-api.cc Fri Sep 24 03:24:53 2010
@@ -2934,6 +2934,49 @@
"get_x(interceptor_obj)");
CHECK_EQ(result, v8_str("x"));
}
+
+
+THREADED_TEST(NamedInterceptorDictionaryICMultipleContext) {
+ v8::HandleScope scope;
+
+ v8::Persistent<Context> context1 = Context::New();
+
+ context1->Enter();
+ Local<ObjectTemplate> templ = ObjectTemplate::New();
+ templ->SetNamedPropertyHandler(XPropertyGetter);
+ // Create an object with a named interceptor.
+ v8::Local<v8::Object> object = templ->NewInstance();
+ context1->Global()->Set(v8_str("interceptor_obj"), object);
+
+ // Force the object into the slow case.
+ CompileRun("interceptor_obj.y = 0;"
+ "delete interceptor_obj.y;");
+ context1->Exit();
+
+ {
+ // Introduce the object into a different context.
+ // Repeat named loads to exercise ICs.
+ LocalContext context2;
+ context2->Global()->Set(v8_str("interceptor_obj"), object);
+ Local<Value> result =
+ CompileRun("function get_x(o) { return o.x; }"
+ "interceptor_obj.x = 42;"
+ "for (var i=0; i != 10; i++) {"
+ " get_x(interceptor_obj);"
+ "}"
+ "get_x(interceptor_obj)");
+ // Check that the interceptor was actually invoked.
+ CHECK_EQ(result, v8_str("x"));
+ }
+
+ // Return to the original context and force some object to the slow case
+ // to cause the NormalizedMapCache to verify.
+ context1->Enter();
+ CompileRun("var obj = { x : 0 }; delete obj.x;");
+ context1->Exit();
+
+ context1.Dispose();
+}
static v8::Handle<Value> SetXOnPrototypeGetter(Local<String> property,
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
