• Ross McIlroy's avatar
    [Compile] Ensure we don't reuse a feedback vector with a different layout than expected. · b06a134c
    Ross McIlroy authored
    If we flush the bytecode from a SFI we might recompile a JSFunction while the function
    still has its old feedback vector. This should usually be fine since the new and old
    feedback vectors have the same layout, however some bugs in the parser mean that it's
    possible for eagerly and lazily compiled eval functions to have different bytecode and
    so potentially different feedback vector layouts.
    
    For now reset the feedback vector if it doesn't have the same size when we compile the
    JSFunction, and recreate a new one of the correct layout. This will be replaced with a
    CHECK once the parser bugs are fixed.
    
    BUG=chromium:984344,v8:9511
    
    Change-Id: Ib8976f2541516f7a07e4d4ab7dc3c750dfe9b5d4
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708474
    Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
    Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
    Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
    Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#62800}
    b06a134c
js-objects.cc 223 KB