Revision: 21112
Author: [email protected]
Date: Fri May 2 08:08:23 2014 UTC
Log: Fix crash in debug builds introduced with r21110.
Basically we should not check for map deprecation during
code selection, because that may run on the concurrent
compiler thread. So the fix is to move this logic to the
code generation phase instead, which is always run on the
main thread.
[email protected]
Review URL: https://codereview.chromium.org/263803005
http://code.google.com/p/v8/source/detail?r=21112
Modified:
/branches/bleeding_edge/src/arm/lithium-arm.cc
/branches/bleeding_edge/src/arm/lithium-arm.h
/branches/bleeding_edge/src/arm/lithium-codegen-arm.cc
/branches/bleeding_edge/src/arm/lithium-codegen-arm.h
/branches/bleeding_edge/src/arm64/lithium-arm64.cc
/branches/bleeding_edge/src/arm64/lithium-arm64.h
/branches/bleeding_edge/src/arm64/lithium-codegen-arm64.cc
/branches/bleeding_edge/src/arm64/lithium-codegen-arm64.h
/branches/bleeding_edge/src/compiler.h
/branches/bleeding_edge/src/ia32/lithium-codegen-ia32.cc
/branches/bleeding_edge/src/ia32/lithium-codegen-ia32.h
/branches/bleeding_edge/src/ia32/lithium-ia32.cc
/branches/bleeding_edge/src/ia32/lithium-ia32.h
/branches/bleeding_edge/src/lithium-codegen.cc
/branches/bleeding_edge/src/lithium-codegen.h
/branches/bleeding_edge/src/mips/lithium-codegen-mips.cc
/branches/bleeding_edge/src/mips/lithium-codegen-mips.h
/branches/bleeding_edge/src/mips/lithium-mips.cc
/branches/bleeding_edge/src/mips/lithium-mips.h
/branches/bleeding_edge/src/x64/lithium-codegen-x64.cc
/branches/bleeding_edge/src/x64/lithium-codegen-x64.h
/branches/bleeding_edge/src/x64/lithium-x64.cc
/branches/bleeding_edge/src/x64/lithium-x64.h
=======================================
--- /branches/bleeding_edge/src/arm/lithium-arm.cc Fri May 2 06:37:54 2014
UTC
+++ /branches/bleeding_edge/src/arm/lithium-arm.cc Fri May 2 08:08:23 2014
UTC
@@ -427,12 +427,6 @@
info()->set_bailout_reason(reason);
status_ = ABORTED;
}
-
-
-void LChunkBuilder::AddDeprecationDependency(Handle<Map> map) {
- if (map->is_deprecated()) return Abort(kMapBecameDeprecated);
- chunk_->AddDeprecationDependency(map);
-}
LUnallocated* LChunkBuilder::ToUnallocated(Register reg) {
@@ -2305,11 +2299,6 @@
// We need a temporary register for write barrier of the map field.
LOperand* temp = needs_write_barrier_for_map ? TempRegister() : NULL;
-
- // Add a deprecation dependency on the transition target map.
- if (instr->has_transition()) {
- AddDeprecationDependency(instr->transition_map());
- }
LInstruction* result = new(zone()) LStoreNamedField(obj, val, temp);
if (!instr->access().IsExternalMemory() &&
=======================================
--- /branches/bleeding_edge/src/arm/lithium-arm.h Fri May 2 06:37:54 2014
UTC
+++ /branches/bleeding_edge/src/arm/lithium-arm.h Fri May 2 08:08:23 2014
UTC
@@ -2161,7 +2161,6 @@
virtual void PrintDataTo(StringStream* stream) V8_OVERRIDE;
- Handle<Map> transition() const { return hydrogen()->transition_map(); }
Representation representation() const {
return hydrogen()->field_representation();
}
@@ -2748,9 +2747,6 @@
void Abort(BailoutReason reason);
- // Methods for code dependencies.
- void AddDeprecationDependency(Handle<Map> map);
-
// Methods for getting operands for Use / Define / Temp.
LUnallocated* ToUnallocated(Register reg);
LUnallocated* ToUnallocated(DoubleRegister reg);
=======================================
--- /branches/bleeding_edge/src/arm/lithium-codegen-arm.cc Fri May 2
06:37:54 2014 UTC
+++ /branches/bleeding_edge/src/arm/lithium-codegen-arm.cc Fri May 2
08:08:23 2014 UTC
@@ -64,12 +64,6 @@
if (code->is_optimized_code()) RegisterWeakObjectsInOptimizedCode(code);
PopulateDeoptimizationData(code);
}
-
-
-void LCodeGen::Abort(BailoutReason reason) {
- info()->set_bailout_reason(reason);
- status_ = ABORTED;
-}
void LCodeGen::SaveCallerDoubles() {
@@ -4075,7 +4069,6 @@
return;
}
- Handle<Map> transition = instr->transition();
SmiCheck check_needed =
instr->hydrogen()->value()->IsHeapObject()
? OMIT_SMI_CHECK : INLINE_SMI_CHECK;
@@ -4093,15 +4086,17 @@
check_needed = OMIT_SMI_CHECK;
}
} else if (representation.IsDouble()) {
- ASSERT(transition.is_null());
ASSERT(access.IsInobject());
+ ASSERT(!instr->hydrogen()->has_transition());
ASSERT(!instr->hydrogen()->NeedsWriteBarrier());
DwVfpRegister value = ToDoubleRegister(instr->value());
__ vstr(value, FieldMemOperand(object, offset));
return;
}
- if (!transition.is_null()) {
+ if (instr->hydrogen()->has_transition()) {
+ Handle<Map> transition = instr->hydrogen()->transition_map();
+ AddDeprecationDependency(transition);
__ mov(scratch, Operand(transition));
__ str(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
if (instr->hydrogen()->NeedsWriteBarrierForMap()) {
=======================================
--- /branches/bleeding_edge/src/arm/lithium-codegen-arm.h Tue Apr 29
06:42:26 2014 UTC
+++ /branches/bleeding_edge/src/arm/lithium-codegen-arm.h Fri May 2
08:08:23 2014 UTC
@@ -162,8 +162,6 @@
Register temporary2);
int GetStackSlotCount() const { return chunk()->spill_slot_count(); }
-
- void Abort(BailoutReason reason);
void AddDeferredCode(LDeferredCode* code) { deferred_.Add(code, zone());
}
=======================================
--- /branches/bleeding_edge/src/arm64/lithium-arm64.cc Fri May 2 06:37:54
2014 UTC
+++ /branches/bleeding_edge/src/arm64/lithium-arm64.cc Fri May 2 08:08:23
2014 UTC
@@ -358,12 +358,6 @@
info()->set_bailout_reason(reason);
status_ = ABORTED;
}
-
-
-void LChunkBuilder::AddDeprecationDependency(Handle<Map> map) {
- if (map->is_deprecated()) return Abort(kMapBecameDeprecated);
- chunk_->AddDeprecationDependency(map);
-}
LUnallocated* LChunkBuilder::ToUnallocated(Register reg) {
@@ -2255,11 +2249,6 @@
value = UseRegister(instr->value());
temp0 = TempRegister();
}
-
- // Add a deprecation dependency on the transition target map.
- if (instr->has_transition()) {
- AddDeprecationDependency(instr->transition_map());
- }
LStoreNamedField* result =
new(zone()) LStoreNamedField(object, value, temp0, temp1);
=======================================
--- /branches/bleeding_edge/src/arm64/lithium-arm64.h Fri May 2 06:37:54
2014 UTC
+++ /branches/bleeding_edge/src/arm64/lithium-arm64.h Fri May 2 08:08:23
2014 UTC
@@ -2502,7 +2502,6 @@
virtual void PrintDataTo(StringStream* stream) V8_OVERRIDE;
- Handle<Map> transition() const { return hydrogen()->transition_map(); }
Representation representation() const {
return hydrogen()->field_representation();
}
@@ -2999,9 +2998,6 @@
void Abort(BailoutReason reason);
- // Methods for code dependencies.
- void AddDeprecationDependency(Handle<Map> map);
-
// Methods for getting operands for Use / Define / Temp.
LUnallocated* ToUnallocated(Register reg);
LUnallocated* ToUnallocated(DoubleRegister reg);
=======================================
--- /branches/bleeding_edge/src/arm64/lithium-codegen-arm64.cc Fri May 2
06:37:54 2014 UTC
+++ /branches/bleeding_edge/src/arm64/lithium-codegen-arm64.cc Fri May 2
08:08:23 2014 UTC
@@ -893,12 +893,6 @@
if (code->is_optimized_code()) RegisterWeakObjectsInOptimizedCode(code);
PopulateDeoptimizationData(code);
}
-
-
-void LCodeGen::Abort(BailoutReason reason) {
- info()->set_bailout_reason(reason);
- status_ = ABORTED;
-}
void LCodeGen::PopulateDeoptimizationData(Handle<Code> code) {
@@ -5253,18 +5247,17 @@
Register object = ToRegister(instr->object());
HObjectAccess access = instr->hydrogen()->access();
- Handle<Map> transition = instr->transition();
int offset = access.offset();
if (access.IsExternalMemory()) {
- ASSERT(transition.is_null());
+ ASSERT(!instr->hydrogen()->has_transition());
ASSERT(!instr->hydrogen()->NeedsWriteBarrier());
Register value = ToRegister(instr->value());
__ Store(value, MemOperand(object, offset), representation);
return;
} else if (representation.IsDouble()) {
- ASSERT(transition.is_null());
ASSERT(access.IsInobject());
+ ASSERT(!instr->hydrogen()->has_transition());
ASSERT(!instr->hydrogen()->NeedsWriteBarrier());
FPRegister value = ToDoubleRegister(instr->value());
__ Str(value, FieldMemOperand(object, offset));
@@ -5287,7 +5280,9 @@
check_needed = OMIT_SMI_CHECK;
}
- if (!transition.is_null()) {
+ if (instr->hydrogen()->has_transition()) {
+ Handle<Map> transition = instr->hydrogen()->transition_map();
+ AddDeprecationDependency(transition);
// Store the new map value.
Register new_map_value = ToRegister(instr->temp0());
__ Mov(new_map_value, Operand(transition));
=======================================
--- /branches/bleeding_edge/src/arm64/lithium-codegen-arm64.h Wed Apr 30
17:31:05 2014 UTC
+++ /branches/bleeding_edge/src/arm64/lithium-codegen-arm64.h Fri May 2
08:08:23 2014 UTC
@@ -247,8 +247,6 @@
Safepoint::DeoptMode mode);
int GetStackSlotCount() const { return chunk()->spill_slot_count(); }
-
- void Abort(BailoutReason reason);
void AddDeferredCode(LDeferredCode* code) { deferred_.Add(code, zone());
}
=======================================
--- /branches/bleeding_edge/src/compiler.h Wed Apr 30 10:51:01 2014 UTC
+++ /branches/bleeding_edge/src/compiler.h Fri May 2 08:08:23 2014 UTC
@@ -538,6 +538,8 @@
MUST_USE_RESULT Status AbortAndDisableOptimization(
BailoutReason reason = kNoReason) {
if (reason != kNoReason) info_->set_bailout_reason(reason);
+ // Reference to shared function info does not change between phases.
+ AllowDeferredHandleDereference allow_handle_dereference;
info_->shared_info()->DisableOptimization(info_->bailout_reason());
return SetLastStatus(BAILED_OUT);
}
=======================================
--- /branches/bleeding_edge/src/ia32/lithium-codegen-ia32.cc Fri May 2
06:37:54 2014 UTC
+++ /branches/bleeding_edge/src/ia32/lithium-codegen-ia32.cc Fri May 2
08:08:23 2014 UTC
@@ -87,12 +87,6 @@
Deoptimizer::EnsureRelocSpaceForLazyDeoptimization(code);
}
}
-
-
-void LCodeGen::Abort(BailoutReason reason) {
- info()->set_bailout_reason(reason);
- status_ = ABORTED;
-}
#ifdef _MSC_VER
@@ -4405,6 +4399,7 @@
if (instr->hydrogen()->has_transition()) {
Handle<Map> transition = instr->hydrogen()->transition_map();
+ AddDeprecationDependency(transition);
if (!instr->hydrogen()->NeedsWriteBarrierForMap()) {
__ mov(FieldOperand(object, HeapObject::kMapOffset), transition);
} else {
=======================================
--- /branches/bleeding_edge/src/ia32/lithium-codegen-ia32.h Wed Apr 30
09:50:58 2014 UTC
+++ /branches/bleeding_edge/src/ia32/lithium-codegen-ia32.h Fri May 2
08:08:23 2014 UTC
@@ -173,8 +173,6 @@
Register temporary2);
int GetStackSlotCount() const { return chunk()->spill_slot_count(); }
-
- void Abort(BailoutReason reason);
void AddDeferredCode(LDeferredCode* code) { deferred_.Add(code, zone());
}
=======================================
--- /branches/bleeding_edge/src/ia32/lithium-ia32.cc Fri May 2 06:37:54
2014 UTC
+++ /branches/bleeding_edge/src/ia32/lithium-ia32.cc Fri May 2 08:08:23
2014 UTC
@@ -476,12 +476,6 @@
info()->set_bailout_reason(reason);
status_ = ABORTED;
}
-
-
-void LChunkBuilder::AddDeprecationDependency(Handle<Map> map) {
- if (map->is_deprecated()) return Abort(kMapBecameDeprecated);
- chunk_->AddDeprecationDependency(map);
-}
LUnallocated* LChunkBuilder::ToUnallocated(Register reg) {
@@ -2427,11 +2421,6 @@
// We need a temporary register for write barrier of the map field.
LOperand* temp_map = needs_write_barrier_for_map ? TempRegister() : NULL;
-
- // Add a deprecation dependency on the transition target map.
- if (instr->has_transition()) {
- AddDeprecationDependency(instr->transition_map());
- }
LInstruction* result =
new(zone()) LStoreNamedField(obj, val, temp, temp_map);
=======================================
--- /branches/bleeding_edge/src/ia32/lithium-ia32.h Fri May 2 06:37:54
2014 UTC
+++ /branches/bleeding_edge/src/ia32/lithium-ia32.h Fri May 2 08:08:23
2014 UTC
@@ -2775,9 +2775,6 @@
void Abort(BailoutReason reason);
- // Methods for code dependencies.
- void AddDeprecationDependency(Handle<Map> map);
-
// Methods for getting operands for Use / Define / Temp.
LUnallocated* ToUnallocated(Register reg);
LUnallocated* ToUnallocated(XMMRegister reg);
=======================================
--- /branches/bleeding_edge/src/lithium-codegen.cc Tue Apr 29 14:31:12 2014
UTC
+++ /branches/bleeding_edge/src/lithium-codegen.cc Fri May 2 08:08:23 2014
UTC
@@ -210,4 +210,15 @@
}
+void LCodeGenBase::Abort(BailoutReason reason) {
+ info()->set_bailout_reason(reason);
+ status_ = ABORTED;
+}
+
+
+void LCodeGenBase::AddDeprecationDependency(Handle<Map> map) {
+ if (map->is_deprecated()) return Abort(kMapBecameDeprecated);
+ chunk_->AddDeprecationDependency(map);
+}
+
} } // namespace v8::internal
=======================================
--- /branches/bleeding_edge/src/lithium-codegen.h Tue Apr 29 06:42:26 2014
UTC
+++ /branches/bleeding_edge/src/lithium-codegen.h Fri May 2 08:08:23 2014
UTC
@@ -72,6 +72,11 @@
bool is_generating() const { return status_ == GENERATING; }
bool is_done() const { return status_ == DONE; }
bool is_aborted() const { return status_ == ABORTED; }
+
+ void Abort(BailoutReason reason);
+
+ // Methods for code dependencies.
+ void AddDeprecationDependency(Handle<Map> map);
};
=======================================
--- /branches/bleeding_edge/src/mips/lithium-codegen-mips.cc Fri May 2
06:37:54 2014 UTC
+++ /branches/bleeding_edge/src/mips/lithium-codegen-mips.cc Fri May 2
08:08:23 2014 UTC
@@ -87,12 +87,6 @@
if (code->is_optimized_code()) RegisterWeakObjectsInOptimizedCode(code);
PopulateDeoptimizationData(code);
}
-
-
-void LChunkBuilder::Abort(BailoutReason reason) {
- info()->set_bailout_reason(reason);
- status_ = ABORTED;
-}
void LCodeGen::SaveCallerDoubles() {
@@ -4072,7 +4066,6 @@
return;
}
- Handle<Map> transition = instr->transition();
SmiCheck check_needed =
instr->hydrogen()->value()->IsHeapObject()
? OMIT_SMI_CHECK : INLINE_SMI_CHECK;
@@ -4090,15 +4083,17 @@
check_needed = OMIT_SMI_CHECK;
}
} else if (representation.IsDouble()) {
- ASSERT(transition.is_null());
ASSERT(access.IsInobject());
+ ASSERT(!instr->hydrogen()->has_transition());
ASSERT(!instr->hydrogen()->NeedsWriteBarrier());
DoubleRegister value = ToDoubleRegister(instr->value());
__ sdc1(value, FieldMemOperand(object, offset));
return;
}
- if (!transition.is_null()) {
+ if (instr->hydrogen()->has_transition()) {
+ Handle<Map> transition = instr->hydrogen()->transition_map();
+ AddDeprecationDependency(transition);
__ li(scratch, Operand(transition));
__ sw(scratch, FieldMemOperand(object, HeapObject::kMapOffset));
if (instr->hydrogen()->NeedsWriteBarrierForMap()) {
=======================================
--- /branches/bleeding_edge/src/mips/lithium-codegen-mips.h Tue Apr 29
06:42:26 2014 UTC
+++ /branches/bleeding_edge/src/mips/lithium-codegen-mips.h Fri May 2
08:08:23 2014 UTC
@@ -162,8 +162,6 @@
Register temporary2);
int GetStackSlotCount() const { return chunk()->spill_slot_count(); }
-
- void Abort(BailoutReason reason);
void AddDeferredCode(LDeferredCode* code) { deferred_.Add(code, zone());
}
=======================================
--- /branches/bleeding_edge/src/mips/lithium-mips.cc Fri May 2 06:37:54
2014 UTC
+++ /branches/bleeding_edge/src/mips/lithium-mips.cc Fri May 2 08:08:23
2014 UTC
@@ -428,18 +428,12 @@
}
-void LCodeGen::Abort(BailoutReason reason) {
+void LChunkBuilder::Abort(BailoutReason reason) {
info()->set_bailout_reason(reason);
status_ = ABORTED;
}
-void LChunkBuilder::AddDeprecationDependency(Handle<Map> map) {
- if (map->is_deprecated()) return Abort(kMapBecameDeprecated);
- chunk_->AddDeprecationDependency(map);
-}
-
-
LUnallocated* LChunkBuilder::ToUnallocated(Register reg) {
return new(zone()) LUnallocated(LUnallocated::FIXED_REGISTER,
Register::ToAllocationIndex(reg));
@@ -2256,11 +2250,6 @@
// We need a temporary register for write barrier of the map field.
LOperand* temp = needs_write_barrier_for_map ? TempRegister() : NULL;
-
- // Add a deprecation dependency on the transition target map.
- if (instr->has_transition()) {
- AddDeprecationDependency(instr->transition_map());
- }
LInstruction* result = new(zone()) LStoreNamedField(obj, val, temp);
if (!instr->access().IsExternalMemory() &&
=======================================
--- /branches/bleeding_edge/src/mips/lithium-mips.h Fri May 2 06:37:54
2014 UTC
+++ /branches/bleeding_edge/src/mips/lithium-mips.h Fri May 2 08:08:23
2014 UTC
@@ -2122,7 +2122,6 @@
virtual void PrintDataTo(StringStream* stream) V8_OVERRIDE;
- Handle<Map> transition() const { return hydrogen()->transition_map(); }
Representation representation() const {
return hydrogen()->field_representation();
}
@@ -2703,9 +2702,6 @@
void Abort(BailoutReason reason);
- // Methods for code dependencies.
- void AddDeprecationDependency(Handle<Map> map);
-
// Methods for getting operands for Use / Define / Temp.
LUnallocated* ToUnallocated(Register reg);
LUnallocated* ToUnallocated(DoubleRegister reg);
=======================================
--- /branches/bleeding_edge/src/x64/lithium-codegen-x64.cc Fri May 2
06:37:54 2014 UTC
+++ /branches/bleeding_edge/src/x64/lithium-codegen-x64.cc Fri May 2
08:08:23 2014 UTC
@@ -67,12 +67,6 @@
if (code->is_optimized_code()) RegisterWeakObjectsInOptimizedCode(code);
PopulateDeoptimizationData(code);
}
-
-
-void LChunkBuilder::Abort(BailoutReason reason) {
- info()->set_bailout_reason(reason);
- status_ = ABORTED;
-}
#ifdef _MSC_VER
@@ -3996,7 +3990,6 @@
}
Register object = ToRegister(instr->object());
- Handle<Map> transition = instr->transition();
SmiCheck check_needed = hinstr->value()->IsHeapObject()
? OMIT_SMI_CHECK : INLINE_SMI_CHECK;
@@ -4020,15 +4013,17 @@
}
}
} else if (representation.IsDouble()) {
- ASSERT(transition.is_null());
ASSERT(access.IsInobject());
+ ASSERT(!hinstr->has_transition());
ASSERT(!hinstr->NeedsWriteBarrier());
XMMRegister value = ToDoubleRegister(instr->value());
__ movsd(FieldOperand(object, offset), value);
return;
}
- if (!transition.is_null()) {
+ if (hinstr->has_transition()) {
+ Handle<Map> transition = hinstr->transition_map();
+ AddDeprecationDependency(transition);
if (!hinstr->NeedsWriteBarrierForMap()) {
__ Move(FieldOperand(object, HeapObject::kMapOffset), transition);
} else {
=======================================
--- /branches/bleeding_edge/src/x64/lithium-codegen-x64.h Tue Apr 29
06:42:26 2014 UTC
+++ /branches/bleeding_edge/src/x64/lithium-codegen-x64.h Fri May 2
08:08:23 2014 UTC
@@ -126,8 +126,6 @@
Register scratch);
int GetStackSlotCount() const { return chunk()->spill_slot_count(); }
-
- void Abort(BailoutReason reason);
void AddDeferredCode(LDeferredCode* code) { deferred_.Add(code, zone());
}
=======================================
--- /branches/bleeding_edge/src/x64/lithium-x64.cc Fri May 2 06:37:54 2014
UTC
+++ /branches/bleeding_edge/src/x64/lithium-x64.cc Fri May 2 08:08:23 2014
UTC
@@ -439,18 +439,12 @@
}
-void LCodeGen::Abort(BailoutReason reason) {
+void LChunkBuilder::Abort(BailoutReason reason) {
info()->set_bailout_reason(reason);
status_ = ABORTED;
}
-void LChunkBuilder::AddDeprecationDependency(Handle<Map> map) {
- if (map->is_deprecated()) return Abort(kMapBecameDeprecated);
- chunk_->AddDeprecationDependency(map);
-}
-
-
LUnallocated* LChunkBuilder::ToUnallocated(Register reg) {
return new(zone()) LUnallocated(LUnallocated::FIXED_REGISTER,
Register::ToAllocationIndex(reg));
@@ -2319,11 +2313,6 @@
// have a store into the properties array (not in-object-property).
LOperand* temp = (!is_in_object || needs_write_barrier ||
needs_write_barrier_for_map) ? TempRegister() : NULL;
-
- // Add a deprecation dependency on the transition target map.
- if (instr->has_transition()) {
- AddDeprecationDependency(instr->transition_map());
- }
LInstruction* result = new(zone()) LStoreNamedField(obj, val, temp);
if (!instr->access().IsExternalMemory() &&
=======================================
--- /branches/bleeding_edge/src/x64/lithium-x64.h Fri May 2 06:37:54 2014
UTC
+++ /branches/bleeding_edge/src/x64/lithium-x64.h Fri May 2 08:08:23 2014
UTC
@@ -2130,7 +2130,6 @@
virtual void PrintDataTo(StringStream* stream) V8_OVERRIDE;
- Handle<Map> transition() const { return hydrogen()->transition_map(); }
Representation representation() const {
return hydrogen()->field_representation();
}
@@ -2710,9 +2709,6 @@
void Abort(BailoutReason reason);
- // Methods for code dependencies.
- void AddDeprecationDependency(Handle<Map> map);
-
// Methods for getting operands for Use / Define / Temp.
LUnallocated* ToUnallocated(Register reg);
LUnallocated* ToUnallocated(XMMRegister reg);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
