Revision: 18013
Author: [email protected]
Date: Fri Nov 22 13:10:31 2013 UTC
Log: Invalidate embedded objects in optimized code if it was marked
for deoptimization.
It avoids having dead pointers in code from the time it was marked for
deoptimization until it is deoptimized.
BUG=320532,v8:2996
TEST=mjsunit/regress/regress-320532.js
LOG=Y
[email protected]
Review URL: https://chromiumcodereview.appspot.com/61213012
http://code.google.com/p/v8/source/detail?r=18013
Modified:
/branches/bleeding_edge/src/mark-compact.cc
/branches/bleeding_edge/src/objects.cc
/branches/bleeding_edge/src/objects.h
=======================================
--- /branches/bleeding_edge/src/mark-compact.cc Tue Nov 19 11:52:47 2013 UTC
+++ /branches/bleeding_edge/src/mark-compact.cc Fri Nov 22 13:10:31 2013 UTC
@@ -2655,6 +2655,7 @@
if (IsMarked(code) && !code->marked_for_deoptimization()) {
code->set_marked_for_deoptimization(true);
+ code->InvalidateEmbeddedObjects();
have_code_to_deoptimize_ = true;
}
entries->clear_at(i);
=======================================
--- /branches/bleeding_edge/src/objects.cc Thu Nov 21 16:55:16 2013 UTC
+++ /branches/bleeding_edge/src/objects.cc Fri Nov 22 13:10:31 2013 UTC
@@ -10400,6 +10400,18 @@
void Code::InvalidateRelocation() {
set_relocation_info(GetHeap()->empty_byte_array());
}
+
+
+void Code::InvalidateEmbeddedObjects() {
+ Object* undefined = GetHeap()->undefined_value();
+ int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
+ for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
+ RelocInfo::Mode mode = it.rinfo()->rmode();
+ if (mode == RelocInfo::EMBEDDED_OBJECT) {
+ it.rinfo()->set_target_object(undefined, SKIP_WRITE_BARRIER);
+ }
+ }
+}
void Code::Relocate(intptr_t delta) {
=======================================
--- /branches/bleeding_edge/src/objects.h Fri Nov 22 11:35:39 2013 UTC
+++ /branches/bleeding_edge/src/objects.h Fri Nov 22 13:10:31 2013 UTC
@@ -5054,6 +5054,7 @@
// [relocation_info]: Code relocation information
DECL_ACCESSORS(relocation_info, ByteArray)
void InvalidateRelocation();
+ void InvalidateEmbeddedObjects();
// [handler_table]: Fixed array containing offsets of exception handlers.
DECL_ACCESSORS(handler_table, FixedArray)
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
