Reviewers: Michael Starzinger,
Description:
Merged r16529, r16742 into trunk branch.
Disable escape analysis to investigate stability offline.
Chromium 284577 needs a mitigation CL added. There is a TODO to remove the
mitigation when the cause of the bug is discovered.
[email protected]
BUG=
Please review this at https://codereview.chromium.org/23578037/
SVN Base: https://v8.googlecode.com/svn/trunk
Affected files (+15, -16 lines):
M src/flag-definitions.h
M src/objects-debug.cc
M src/objects.cc
M src/version.cc
Index: src/flag-definitions.h
diff --git a/src/flag-definitions.h b/src/flag-definitions.h
index
cc153af2542dfca612c4e12c579318931190acbd..08cd8304e4d7c86e53ca75ecd34678b5456bc6b4
100644
--- a/src/flag-definitions.h
+++ b/src/flag-definitions.h
@@ -240,7 +240,7 @@ DEFINE_bool(use_range, true, "use hydrogen range
analysis")
DEFINE_bool(use_gvn, true, "use hydrogen global value numbering")
DEFINE_bool(use_canonicalizing, true, "use hydrogen instruction
canonicalizing")
DEFINE_bool(use_inlining, true, "use function inlining")
-DEFINE_bool(use_escape_analysis, true, "use hydrogen escape analysis")
+DEFINE_bool(use_escape_analysis, false, "use hydrogen escape analysis")
DEFINE_bool(use_allocation_folding, true, "use allocation folding")
DEFINE_int(max_inlining_levels, 5, "maximum number of inlining levels")
DEFINE_int(max_inlined_source_size, 600,
Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index
3716df1e87cf6069dce0ab83d7564aa150b02d97..5d9e161a7e54ef40d2435e709fd51b2e7b35b655
100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -690,11 +690,6 @@ void JSArray::JSArrayVerify() {
CHECK(elements()->IsUndefined() ||
elements()->IsFixedArray() ||
elements()->IsFixedDoubleArray());
- // TODO(mvstanton): to diagnose chromium bug 284577, remove after.
- AllocationMemento* memento = AllocationMemento::FindForJSObject(this);
- if (memento != NULL && memento->IsValid()) {
- memento->AllocationMementoVerify();
- }
}
}
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
e37f6d1b2592a84f11d0fa1b7748b768d185e1c5..ca9e3963a8bb57f48fa1e945ac740b68b20128f1
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9012,8 +9012,7 @@ AllocationMemento*
AllocationMemento::FindForJSObject(JSObject* object) {
// involves carefully checking the object immediately after the JSArray
// (if there is one) to see if it's an AllocationMemento.
if (FLAG_track_allocation_sites &&
object->GetHeap()->InNewSpace(object)) {
- // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove
after.
- CHECK(object->GetHeap()->InToSpace(object));
+ ASSERT(object->GetHeap()->InToSpace(object));
Address ptr_end = (reinterpret_cast<Address>(object) - kHeapObjectTag)
+
object->Size();
if ((ptr_end + AllocationMemento::kSize) <=
@@ -9023,15 +9022,20 @@ AllocationMemento*
AllocationMemento::FindForJSObject(JSObject* object) {
reinterpret_cast<Map**>(ptr_end);
if (*possible_allocation_memento_map ==
object->GetHeap()->allocation_memento_map()) {
- Address ptr_object = reinterpret_cast<Address>(object);
- // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove
after.
- // If this check fails it points to the very unlikely case that
we've
- // misinterpreted a page header as an allocation memento. Follow up
- // with a real fix.
- CHECK(Page::FromAddress(ptr_object) == Page::FromAddress(ptr_end));
AllocationMemento* memento = AllocationMemento::cast(
reinterpret_cast<Object*>(ptr_end + kHeapObjectTag));
- return memento;
+
+ // TODO(mvstanton): because of chromium bug 284577, put extra care
+ // into validating that the memento points to a valid
AllocationSite.
+ // This check is expensive so remove it asap. Also, this check
+ // HIDES bug 284577, so it must be disabled to debug/diagnose.
+ Object* site = memento->allocation_site();
+ Heap* heap = object->GetHeap();
+ if (heap->InOldPointerSpace(site) &&
+ site->IsHeapObject() &&
+ HeapObject::cast(site)->map() == heap->allocation_site_map()) {
+ return memento;
+ }
}
}
}
Index: src/version.cc
diff --git a/src/version.cc b/src/version.cc
index
35f788997bad5339d497e675fb5c999964f27a41..7612aea4ac774126fd256988e58bc440102fae92
100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 21
#define BUILD_NUMBER 16
-#define PATCH_LEVEL 1
+#define PATCH_LEVEL 2
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
