• Benedikt Meurer's avatar
    [map] Move Map::IsInRetainedMapListBit out of Map::bit_field2. · 437d710f
    Benedikt Meurer authored
    The invariant is that Map::bit_field2 shouldn't change, and the
    IsInRetainedMapListBit apparently changes when the map is held
    weakly from optimized code. This causes TurboFan compilations to
    change the Map::Hash() result, which in turn causes lookups on
    the normalized map cache to miss (and maybe other bad consequences).
    
    With this change we swap Map::IsInRetainedMapListBit (previously in
    bit_field2) and Map::HasHiddenPrototypeBit (previously in bit_field3)
    to address this problem.
    
    Bug: chromium:963411, v8:9114, v8:9267
    Change-Id: I040a27c37305fa602649750bd93bee40c91fca78
    Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619747
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
    Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
    Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#61657}
    437d710f
js-heap-broker.cc 125 KB