Reviewers: Yang,
Message:
Please take a look.
Description:
Merge r10243 to 3.7 branch.
Guard against undefined fields in global context.
BUG=v8:1860
TEST=
Original CL: http://codereview.chromium.org/8917014/
Please review this at http://codereview.chromium.org/8879057/
SVN Base: https://v8.googlecode.com/svn/branches/3.7
Affected files:
M src/assembler.h
M src/assembler.cc
M src/deoptimizer.cc
M src/heap.cc
M src/incremental-marking.cc
M src/version.cc
Index: src/assembler.cc
diff --git a/src/assembler.cc b/src/assembler.cc
index
bc05c01800dc51889ee58e31264d533045be84ff..fd8c75e83ea9801889aec529a80d0c2ed42728ff
100644
--- a/src/assembler.cc
+++ b/src/assembler.cc
@@ -817,11 +817,6 @@ ExternalReference
ExternalReference::compute_output_frames_function(
}
-ExternalReference ExternalReference::global_contexts_list(Isolate*
isolate) {
- return
ExternalReference(isolate->heap()->global_contexts_list_address());
-}
-
-
ExternalReference ExternalReference::keyed_lookup_cache_keys(Isolate*
isolate) {
return ExternalReference(isolate->keyed_lookup_cache()->keys_address());
}
Index: src/assembler.h
diff --git a/src/assembler.h b/src/assembler.h
index
5c25768e6a0a60aead490b16c55cfed5a6892507..cec20fca073add3d9b77a7f4aa4d873b4df184d9
100644
--- a/src/assembler.h
+++ b/src/assembler.h
@@ -590,7 +590,6 @@ class ExternalReference BASE_EMBEDDED {
// Deoptimization support.
static ExternalReference new_deoptimizer_function(Isolate* isolate);
static ExternalReference compute_output_frames_function(Isolate*
isolate);
- static ExternalReference global_contexts_list(Isolate* isolate);
// Static data in the keyed lookup cache.
static ExternalReference keyed_lookup_cache_keys(Isolate* isolate);
Index: src/deoptimizer.cc
diff --git a/src/deoptimizer.cc b/src/deoptimizer.cc
index
108e547f2b95e6197a6d282bb432f7d06dde5ca2..aab69c3422abb5450248ddc7cd695fa9192b2f81
100644
--- a/src/deoptimizer.cc
+++ b/src/deoptimizer.cc
@@ -264,11 +264,16 @@ void Deoptimizer::VisitAllOptimizedFunctions(
AssertNoAllocation no_allocation;
// Run through the list of all global contexts and deoptimize.
- Object* global = Isolate::Current()->heap()->global_contexts_list();
- while (!global->IsUndefined()) {
-
VisitAllOptimizedFunctionsForGlobalObject(Context::cast(global)->global(),
- visitor);
- global = Context::cast(global)->get(Context::NEXT_CONTEXT_LINK);
+ Object* context = Isolate::Current()->heap()->global_contexts_list();
+ while (!context->IsUndefined()) {
+ // GC can happen when the context is not fully initialized,
+ // so the global field of the context can be undefined.
+ Object* global = Context::cast(context)->get(Context::GLOBAL_INDEX);
+ if (!global->IsUndefined()) {
+ VisitAllOptimizedFunctionsForGlobalObject(JSObject::cast(global),
+ visitor);
+ }
+ context = Context::cast(context)->get(Context::NEXT_CONTEXT_LINK);
}
}
Index: src/heap.cc
diff --git a/src/heap.cc b/src/heap.cc
index
4a048a12834eb7ec3ca181f804c7ddf3972a477a..df03c635c10d0c02fc135f1078d7f73b964579be
100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -637,13 +637,17 @@ void Heap::ClearJSFunctionResultCaches() {
Object* context = global_contexts_list_;
while (!context->IsUndefined()) {
- // Get the caches for this context:
- FixedArray* caches =
- Context::cast(context)->jsfunction_result_caches();
- // Clear the caches:
- int length = caches->length();
- for (int i = 0; i < length; i++) {
- JSFunctionResultCache::cast(caches->get(i))->Clear();
+ // Get the caches for this context. GC can happen when the context
+ // is not fully initialized, so the caches can be undefined.
+ Object* caches_or_undefined =
+
Context::cast(context)->get(Context::JSFUNCTION_RESULT_CACHES_INDEX);
+ if (!caches_or_undefined->IsUndefined()) {
+ FixedArray* caches = FixedArray::cast(caches_or_undefined);
+ // Clear the caches:
+ int length = caches->length();
+ for (int i = 0; i < length; i++) {
+ JSFunctionResultCache::cast(caches->get(i))->Clear();
+ }
}
// Get the next context:
context = Context::cast(context)->get(Context::NEXT_CONTEXT_LINK);
@@ -660,7 +664,13 @@ void Heap::ClearNormalizedMapCaches() {
Object* context = global_contexts_list_;
while (!context->IsUndefined()) {
- Context::cast(context)->normalized_map_cache()->Clear();
+ // GC can happen when the context is not fully initialized,
+ // so the cache can be undefined.
+ Object* cache =
+ Context::cast(context)->get(Context::NORMALIZED_MAP_CACHE_INDEX);
+ if (!cache->IsUndefined()) {
+ NormalizedMapCache::cast(cache)->Clear();
+ }
context = Context::cast(context)->get(Context::NEXT_CONTEXT_LINK);
}
}
Index: src/incremental-marking.cc
diff --git a/src/incremental-marking.cc b/src/incremental-marking.cc
index
0f29f73f5e585027b88650456e4d1f09e9da1117..c866346f01460c22867f31071ea2b0edb4edabd5
100644
--- a/src/incremental-marking.cc
+++ b/src/incremental-marking.cc
@@ -677,11 +677,16 @@ void IncrementalMarking::Hurry() {
Object* context = heap_->global_contexts_list();
while (!context->IsUndefined()) {
- NormalizedMapCache* cache =
Context::cast(context)->normalized_map_cache();
- MarkBit mark_bit = Marking::MarkBitFrom(cache);
- if (Marking::IsGrey(mark_bit)) {
- Marking::GreyToBlack(mark_bit);
- MemoryChunk::IncrementLiveBytes(cache->address(), cache->Size());
+ // GC can happen when the context is not fully initialized,
+ // so the cache can be undefined.
+ HeapObject* cache = HeapObject::cast(
+ Context::cast(context)->get(Context::NORMALIZED_MAP_CACHE_INDEX));
+ if (!cache->IsUndefined()) {
+ MarkBit mark_bit = Marking::MarkBitFrom(cache);
+ if (Marking::IsGrey(mark_bit)) {
+ Marking::GreyToBlack(mark_bit);
+ MemoryChunk::IncrementLiveBytes(cache->address(), cache->Size());
+ }
}
context = Context::cast(context)->get(Context::NEXT_CONTEXT_LINK);
}
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
924fee6a6fe62d2a13a973d583e602f463bc70a0..f656202a6889327e77674276ba1d19743edc471c
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 7
#define BUILD_NUMBER 12
-#define PATCH_LEVEL 10
+#define PATCH_LEVEL 11
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
