• Simon Zünd's avatar
    [deoptimizer] Handle continuation frames that are not preceded by adapter frames · 7e0f961e
    Simon Zünd authored
    This CL teaches the deoptimizer about JavaScriptBuiltinContinuation
    frames that are not preceded by argument adapter frames. This pattern
    is used when calling C++ API functions from TurboFan.
    
    This CL fixes a crash when the deoptimizer encounters the pattern
    described above. The crash was caused when the deoptimizer tried to
    read the arguments of the continuation frame. As no adapter frame
    was present, the argument count was read from the SharedFunctionInfo
    which had the kDontAdaptArgumentsSentinel value. This translated to
    an argument count of ~65000 later down the line, which caused a
    FATAL error when the deoptimizer tried to re-construct ~65000
    non-existent values.
    
    Bug: chromium:980529
    Change-Id: Id2de3bf7607102ab5a16de344c649015e968b185
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687417Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
    Reviewed-by: 's avatarSigurd Schneider <sigurds@chromium.org>
    Commit-Queue: Simon Zünd <szuend@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#62547}
    7e0f961e
deoptimizer.cc 150 KB