Revision: 13481
Author: [email protected]
Date: Wed Jan 23 08:15:15 2013
Log: Fix corner case when JSFunction is evicted from flusher.
This fixes a corner case that happens when JSFunctions are enqueued as
code flushing candidates but their respective SharedFunctionInfo isn't.
If the JSFunction gets evicted due to optimization the code slot in the
SharedFunctionInfo will never be recorded in the slots buffer.
[email protected]
BUG=chromium:168801
TEST=cctest/test-heap/Regress168801
Review URL: https://codereview.chromium.org/11896064
http://code.google.com/p/v8/source/detail?r=13481
Modified:
/branches/bleeding_edge/src/mark-compact.cc
/branches/bleeding_edge/test/cctest/test-heap.cc
=======================================
--- /branches/bleeding_edge/src/mark-compact.cc Wed Jan 16 07:44:26 2013
+++ /branches/bleeding_edge/src/mark-compact.cc Wed Jan 23 08:15:15 2013
@@ -943,8 +943,7 @@
void CodeFlusher::EvictCandidate(SharedFunctionInfo* shared_info) {
- // The function is no longer a candidate, make sure it gets visited
- // again so that previous flushing decisions are revisited.
+ // Make sure previous flushing decisions are revisited.
isolate_->heap()->incremental_marking()->RecordWrites(shared_info);
SharedFunctionInfo* candidate = shared_function_info_candidates_head_;
@@ -974,9 +973,9 @@
ASSERT(!function->next_function_link()->IsUndefined());
Object* undefined = isolate_->heap()->undefined_value();
- // The function is no longer a candidate, make sure it gets visited
- // again so that previous flushing decisions are revisited.
+ // Make sure previous flushing decisions are revisited.
isolate_->heap()->incremental_marking()->RecordWrites(function);
+
isolate_->heap()->incremental_marking()->RecordWrites(function->shared());
JSFunction* candidate = jsfunction_candidates_head_;
JSFunction* next_candidate;
=======================================
--- /branches/bleeding_edge/test/cctest/test-heap.cc Mon Jan 21 04:26:29
2013
+++ /branches/bleeding_edge/test/cctest/test-heap.cc Wed Jan 23 08:15:15
2013
@@ -2778,3 +2778,57 @@
AlwaysAllocateScope aa_scope;
v8::Script::Compile(mote_code_string)->Run();
}
+
+
+TEST(Regress168801) {
+ i::FLAG_always_compact = true;
+ i::FLAG_cache_optimized_code = false;
+ i::FLAG_allow_natives_syntax = true;
+ i::FLAG_flush_code_incrementally = true;
+ InitializeVM();
+ v8::HandleScope scope;
+
+ // Perform one initial GC to enable code flushing.
+ HEAP->CollectAllGarbage(Heap::kAbortIncrementalMarkingMask);
+
+ // Ensure the code ends up on an evacuation candidate.
+ SimulateFullSpace(HEAP->code_space());
+
+ // Prepare an unoptimized function that is eligible for code flushing.
+ Handle<JSFunction> function;
+ {
+ HandleScope inner_scope;
+ CompileRun("function mkClosure() {"
+ " return function(x) { return x + 1; };"
+ "}"
+ "var f = mkClosure();"
+ "f(1); f(2);");
+
+ Handle<JSFunction> f =
+ v8::Utils::OpenHandle(
+ *v8::Handle<v8::Function>::Cast(
+ v8::Context::GetCurrent()->Global()->Get(v8_str("f"))));
+ CHECK(f->is_compiled());
+ const int kAgingThreshold = 6;
+ for (int i = 0; i < kAgingThreshold; i++) {
+ f->shared()->code()->MakeOlder(static_cast<MarkingParity>(i % 2));
+ }
+
+ function = inner_scope.CloseAndEscape(handle(*f, ISOLATE));
+ }
+
+ // Simulate incremental marking so that unoptimized function is enqueued
as a
+ // candidate for code flushing. The shared function info however will
not be
+ // explicitly enqueued.
+ SimulateIncrementalMarking();
+
+ // Now optimize the function so that it is taken off the candidate list.
+ {
+ HandleScope inner_scope;
+ CompileRun("%OptimizeFunctionOnNextCall(f); f(3);");
+ }
+
+ // This cycle will bust the heap and subsequent cycles will go ballistic.
+ HEAP->CollectAllGarbage(Heap::kNoGCFlags);
+ HEAP->CollectAllGarbage(Heap::kNoGCFlags);
+}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
