• Jaroslav Sevcik's avatar
    Reland "[deoptimizer] Staged materialization of objects." · 1da91b83
    Jaroslav Sevcik authored
    This relands commit e71b8022.
    
    This can now back in as the fix for chromium:787301 had enough time to
    be tested in Canary.
    
    Original change's description:
    > [deoptimizer] Staged materialization of objects.
    >
    > The existing object materialization in the deoptimizer has the following problems:
    >
    > - Objects do not necessarily verify during materialization (because during the
    >   depth first walk we might have inconsistent objects).
    >
    > - Stack can overflow (because we just materialize using recursive calls).
    >
    > - We generalize object fields.
    >
    >
    > This CL re-implements the materialization algorithm to solve this problem. The
    > new implementation creates the objects in two steps:
    >
    > 1. We allocate space for all the objects. In general, we allocate ByteArrays
    >    of the right size. For leaf objects that cannot participate in cycles,
    >    we build and initialize the materialized objects completely.
    >
    >    For JS objects, we insert markers into the byte array at the positions
    >    where unboxed doubles are expected.
    >
    > 2. We initialize all the objects with the proper field values and change the
    >    map from the ByteArray map to the correct map. This requires some sync
    >    with the concurrent marker (Heap::NotifyObjectLayoutChange).
    >
    >    When initializing the JS object fields, we make sure that we respect
    >    the unboxed double marker.
    >
    > Bug: chromium:770106, v8:3836
    > Change-Id: I1ec466a9d19db9538df4ba915516d4c3ca825632
    > Reviewed-on: https://chromium-review.googlesource.com/777559
    > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
    > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
    > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#49821}
    
    Bug: chromium:770106, v8:3836
    Change-Id: Ied6c4e0fbae52713e55ae6dc13794a7521dbb8a5
    Reviewed-on: https://chromium-review.googlesource.com/817745Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#49982}
    1da91b83
materialize-dictionary-properties.js 410 Bytes