Ben Murdoch | 4a90d5f | 2016-03-22 12:00:34 +0000 | [diff] [blame] | 1 | // Copyright 2015 the V8 project authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
| 5 | // Flags: --allow-natives-syntax --expose-gc --block-concurrent-recompilation |
| 6 | |
| 7 | function Inner() { |
| 8 | this.property = "OK"; |
| 9 | this.prop2 = 1; |
| 10 | } |
| 11 | |
| 12 | function Outer() { |
| 13 | this.o = "u"; |
| 14 | } |
| 15 | function KeepMapAlive(o) { |
| 16 | return o.o; |
| 17 | } |
| 18 | function SetInner(o, i) { |
| 19 | o.inner_field = i; |
| 20 | } |
| 21 | function Crash(o) { |
| 22 | return o.inner_field.property; |
| 23 | } |
| 24 | |
| 25 | var inner = new Inner(); |
| 26 | var outer = new Outer(); |
| 27 | |
| 28 | // Collect type feedback. |
| 29 | SetInner(new Outer(), inner); |
| 30 | SetInner(outer, inner); |
| 31 | |
| 32 | // This function's only purpose is to stash away a Handle that keeps |
| 33 | // outer's map alive during the gc() call below. We store this handle |
| 34 | // on the compiler thread :-) |
| 35 | KeepMapAlive(outer); |
| 36 | KeepMapAlive(outer); |
| 37 | %OptimizeFunctionOnNextCall(KeepMapAlive, "concurrent"); |
| 38 | KeepMapAlive(outer); |
| 39 | |
| 40 | // So far, all is well. Collect type feedback and optimize. |
| 41 | print(Crash(outer)); |
| 42 | print(Crash(outer)); |
| 43 | %OptimizeFunctionOnNextCall(Crash); |
| 44 | print(Crash(outer)); |
| 45 | |
| 46 | // Null out references and perform GC. This will keep outer's map alive |
| 47 | // (due to the handle created above), but will let inner's map die. Hence, |
| 48 | // inner_field's field type stored in outer's map will get cleared. |
| 49 | inner = undefined; |
| 50 | outer = undefined; |
| 51 | gc(); |
| 52 | |
| 53 | // We could unblock the compiler thread now. But why bother? |
| 54 | |
| 55 | // Now optimize SetInner while inner_field's type is still cleared! |
| 56 | // This will generate optimized code that stores arbitrary objects |
| 57 | // into inner_field without checking their type against the field type. |
| 58 | %OptimizeFunctionOnNextCall(SetInner); |
| 59 | |
| 60 | // Use the optimized code to store an arbitrary object into |
| 61 | // o2's inner_field, without triggering any dependent code deopts... |
| 62 | var o2 = new Outer(); |
| 63 | SetInner(o2, { invalid: 1.51, property: "OK" }); |
| 64 | // ...and then use the existing code expecting an Inner-class object to |
| 65 | // read invalid data (in this case, a raw double). |
| 66 | // We crash trying to convert the raw double into a printable string. |
| 67 | print(Crash(o2)); |