• bmeurer's avatar
    Revert of [compiler] Properly validate stable map assumption for globals.... · d0a047d4
    bmeurer authored
    Revert of [compiler] Properly validate stable map assumption for globals. (patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )
    
    Reason for revert:
    Breaks tree: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/8789
    
    Original issue's description:
    > [compiler] Properly validate stable map assumption for globals.
    >
    > For global object property cells, we did not check that the map on the
    > previous object is still the same for which we actually optimized. So
    > the optimized code was not in sync with the actual state of the property
    > cell. When loading from such a global object property cell, Crankshaft
    > optimizes away any map checks (based on the stable map assumption),
    > leading to arbitrary memory access in the worst case.
    >
    > TurboFan has the same bug for stores, but is safe on loads because we
    > do appropriate map checks there. However mixing TurboFan and Crankshaft
    > still exposes the bug.
    >
    > R=yangguo@chromium.org
    > BUG=chromium:659475
    
    TBR=yangguo@chromium.org
    # Skipping CQ checks because original CL landed less than 1 days ago.
    NOPRESUBMIT=true
    NOTREECHECKS=true
    NOTRY=true
    BUG=chromium:659475
    
    Review-Url: https://codereview.chromium.org/2454513003
    Cr-Commit-Position: refs/heads/master@{#40582}
    d0a047d4
hydrogen-instructions.h 218 KB