Reviewers: Jakob,
Message:
Please take a look
Description:
Fix regressions triggered by map invalidation during graph creation.
BUG=
Please review this at https://codereview.chromium.org/22807003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/assert-scope.h
M src/compiler.h
M src/compiler.cc
M src/objects.cc
A + test/mjsunit/regress/regress-map-invalidation-1.js
A + test/mjsunit/regress/regress-map-invalidation-2.js
Index: src/assert-scope.h
diff --git a/src/assert-scope.h b/src/assert-scope.h
index
13adbd0f9c5179a850194f9d86ac66cc2cf8fed8..95d5fbb8f044557437ce0a0bb5766fae748e2c71
100644
--- a/src/assert-scope.h
+++ b/src/assert-scope.h
@@ -41,6 +41,7 @@ enum PerThreadAssertType {
HANDLE_ALLOCATION_ASSERT,
HANDLE_DEREFERENCE_ASSERT,
DEFERRED_HANDLE_DEREFERENCE_ASSERT,
+ MAP_INVALIDATE_ASSERT,
LAST_PER_THREAD_ASSERT_TYPE
};
@@ -170,6 +171,14 @@ typedef
PerThreadAssertScope<DEFERRED_HANDLE_DEREFERENCE_ASSERT, false>
typedef PerThreadAssertScope<DEFERRED_HANDLE_DEREFERENCE_ASSERT, true>
AllowDeferredHandleDereference;
+// Scope to document where we do not expect deferred handles to be
dereferenced.
+typedef PerThreadAssertScope<MAP_INVALIDATE_ASSERT, false>
+ DisallowMapInvalidation;
+
+// Scope to introduce an exception to DisallowDeferredHandleDereference.
+typedef PerThreadAssertScope<MAP_INVALIDATE_ASSERT, true>
+ AllowMapInvalidation;
+
} } // namespace v8::internal
#endif // V8_ASSERT_SCOPE_H_
Index: src/compiler.cc
diff --git a/src/compiler.cc b/src/compiler.cc
index
5ed274a7a20f4ae734db91772bcdfb7d7e64e536..b94041acaa79c0ca5f24a7b73e93501fd7f3ff50
100644
--- a/src/compiler.cc
+++ b/src/compiler.cc
@@ -120,6 +120,7 @@ void CompilationInfo::Initialize(Isolate* isolate,
return;
}
mode_ = V8::UseCrankshaft() ? mode : NONOPT;
+ abort_due_to_map_dependency_ = false;
if (script_->type()->value() == Script::TYPE_NATIVE) {
MarkAsNative();
}
@@ -446,6 +447,12 @@ OptimizingCompiler::Status
OptimizingCompiler::CreateGraph() {
}
}
+ if (info()->HasAbortedDueToDependencyChange()) {
+ info_->set_bailout_reason(kBailedOutDueToDependentMap);
+ info_->AbortOptimization();
+ return SetLastStatus(BAILED_OUT);
+ }
+
return SetLastStatus(SUCCEEDED);
}
@@ -454,6 +461,7 @@ OptimizingCompiler::Status
OptimizingCompiler::OptimizeGraph() {
DisallowHeapAllocation no_allocation;
DisallowHandleAllocation no_handles;
DisallowHandleDereference no_deref;
+ DisallowMapInvalidation no_map_invalidation;
ASSERT(last_status() == SUCCEEDED);
Timer t(this, &time_taken_to_optimize_);
@@ -474,6 +482,8 @@ OptimizingCompiler::Status
OptimizingCompiler::OptimizeGraph() {
OptimizingCompiler::Status OptimizingCompiler::GenerateAndInstallCode() {
ASSERT(last_status() == SUCCEEDED);
+ ASSERT(!info()->HasAbortedDueToDependencyChange());
+ DisallowMapInvalidation no_map_invalidation;
{ // Scope for timer.
Timer timer(this, &time_taken_to_codegen_);
ASSERT(chunk_ != NULL);
Index: src/compiler.h
diff --git a/src/compiler.h b/src/compiler.h
index
47d459a28206252581c9d4c35a2b0f42228864e8..d95514bcd67a740d04d17f30adb68bd301a14021
100644
--- a/src/compiler.h
+++ b/src/compiler.h
@@ -298,11 +298,15 @@ class CompilationInfo {
}
void AbortDueToDependencyChange() {
- mode_ = DEPENDENCY_CHANGE_ABORT;
+ ASSERT(!FLAG_parallel_recompilation ||
+ !isolate()->optimizing_compiler_thread()->IsOptimizerThread());
+ abort_due_to_map_dependency_ = true;
}
bool HasAbortedDueToDependencyChange() {
- return mode_ == DEPENDENCY_CHANGE_ABORT;
+ ASSERT(!FLAG_parallel_recompilation ||
+ !isolate()->optimizing_compiler_thread()->IsOptimizerThread());
+ return abort_due_to_map_dependency_;
}
protected:
@@ -326,8 +330,7 @@ class CompilationInfo {
BASE,
OPTIMIZE,
NONOPT,
- STUB,
- DEPENDENCY_CHANGE_ABORT
+ STUB
};
void Initialize(Isolate* isolate, Mode mode, Zone* zone);
@@ -401,6 +404,9 @@ class CompilationInfo {
Mode mode_;
BailoutId osr_ast_id_;
+ // Flag whether compilation needs to be aborted due to map dependency.
+ bool abort_due_to_map_dependency_;
+
// The zone from which the compilation pipeline working on this
// CompilationInfo allocates.
Zone* zone_;
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
58fb40b42369093285fd521e163e00d84488d16f..d97c2ec7b686e6df6697af2217647aa0a78684a0
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -11354,6 +11354,7 @@ bool DependentCode::Contains(DependencyGroup group,
Code* code) {
void DependentCode::DeoptimizeDependentCodeGroup(
Isolate* isolate,
DependentCode::DependencyGroup group) {
+ ASSERT(AllowMapInvalidation::IsAllowed());
DisallowHeapAllocation no_allocation_scope;
DependentCode::GroupStartIndexes starts(this);
int start = starts.at(group);
Index: test/mjsunit/regress/regress-map-invalidation-1.js
diff --git a/test/mjsunit/regress/regress-2045.js
b/test/mjsunit/regress/regress-map-invalidation-1.js
similarity index 86%
copy from test/mjsunit/regress/regress-2045.js
copy to test/mjsunit/regress/regress-map-invalidation-1.js
index
822ee1fa4641b4a0ba15eee2c2a2e59411db7d4d..426fcddbf64606c67197e346601838525663b0a5
100644
--- a/test/mjsunit/regress/regress-2045.js
+++ b/test/mjsunit/regress/regress-map-invalidation-1.js
@@ -27,23 +27,22 @@
// Flags: --allow-natives-syntax
-function foo() {
- assertEquals(2, arguments.length);
-}
+var c = { x: 2, y: 1 };
-function bar() {
- G.x;
- return foo.apply(this, arguments);
+function h() {
+ %MigrateInstance(c);
+ return 2;
}
+%NeverOptimizeFunction(h);
-function baz() {
- return bar(1, 2);
+function f() {
+ for (var i = 0; i < 100000; i++) {
+ var n = c.x + h();
+ assertEquals(4, n);
+ }
+ var o2 = [{ x: 2.5, y:1 }];
+ return o2;
}
-G = {x: 0};
-baz();
-baz();
-%OptimizeFunctionOnNextCall(baz);
-baz();
-delete G.x;
-baz();
+f();
+
Index: test/mjsunit/regress/regress-map-invalidation-2.js
diff --git a/test/mjsunit/regress/regress-119429.js
b/test/mjsunit/regress/regress-map-invalidation-2.js
similarity index 84%
copy from test/mjsunit/regress/regress-119429.js
copy to test/mjsunit/regress/regress-map-invalidation-2.js
index
a87648754a43e8d74b98b642495ba4e40f1551e9..c6d24cc4801cbe8482896e96913719c3b806f9de
100644
--- a/test/mjsunit/regress/regress-119429.js
+++ b/test/mjsunit/regress/regress-map-invalidation-2.js
@@ -27,11 +27,23 @@
// Flags: --allow-natives-syntax
-var d = 0;
-function recurse() {
- if (++d == 25135) { // A magic number just below stack overflow on ia32
- %DebugBreak();
+var c = { x: 2, y: 1 };
+
+function g() {
+ var outer = { foo: 1 };
+ function f() {
+ var n = outer.foo;
+ for (var i = 0; i < 100000; i++) {
+ n += c.x + outer.foo;
+ }
+ var o2 = [{ x: 1.5, y: 1 }];
+ return o2;
}
- recurse();
+ return f;
}
-assertThrows(function() { recurse();} );
+
+var fun = g();
+fun();
+assertOptimized(fun);
+fun();
+
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
