Commit c34a2954 authored by Michael Starzinger's avatar Michael Starzinger Committed by Commit Bot

[deoptimizer] Fix JSFunction materialization instance size.

This ensures the JSFunction objects materialized by the deoptimizer have
the correct instance size (depending on the given map). There are corner
cases where the instance size might vary due to in-object properties.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-772610
BUG=chromium:772610

Change-Id: I4808c7260db1adbd1cdc3871c2a946475e4934f2
Reviewed-on: https://chromium-review.googlesource.com/707109Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48383}
parent e50b49a0
......@@ -3635,10 +3635,9 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
return object;
}
case JS_FUNCTION_TYPE: {
Handle<JSFunction> object =
isolate_->factory()->NewFunctionFromSharedFunctionInfo(
handle(isolate_->object_function()->shared()),
handle(isolate_->context()), NOT_TENURED);
Handle<JSFunction> object = isolate_->factory()->NewFunction(
map, handle(isolate_->object_function()->shared()),
handle(isolate_->context()), NOT_TENURED);
slot->value_ = object;
// We temporarily allocated a JSFunction for the {Object} function
// within the current context, to break cycles in the object graph.
......
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --verify-heap --expose-gc
function f() {
var o = [{
[Symbol.toPrimitive]() {}
}];
%_DeoptimizeNow();
return o.length;
}
assertEquals(1, f());
assertEquals(1, f());
%OptimizeFunctionOnNextCall(f);
assertEquals(1, f());
gc();
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment