Reland r12342: Flush monomorphic ICs on context disposal instead of context exit.

The crashes that caused r12342 to be reverted are fixed in r12563.

R=mstarzinger@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11092081

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12715 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/heap.cc

@@ -98,6 +98,7 @@ Heap::Heap()
       linear_allocation_scope_depth_(0),
       contexts_disposed_(0),
       global_ic_age_(0),
+      flush_monomorphic_ics_(false),
       scan_on_scavenge_pages_(0),
       new_space_(this),
       old_pointer_space_(NULL),
@@ -999,7 +1000,7 @@ void Heap::MarkCompact(GCTracer* tracer) {
 
   contexts_disposed_ = 0;
 
-  isolate_->set_context_exit_happened(false);
+  flush_monomorphic_ics_ = false;
 }
 
 

src/heap.h

@@ -1103,7 +1103,10 @@ class Heap {
   void EnsureHeapIsIterable();
 
   // Notify the heap that a context has been disposed.
-  int NotifyContextDisposed() { return ++contexts_disposed_; }
+  int NotifyContextDisposed() {
+    flush_monomorphic_ics_ = true;
+    return ++contexts_disposed_;
+  }
 
   // Utility to invoke the scavenger. This is needed in test code to
   // ensure correct callback for weak global handles.
@@ -1635,6 +1638,8 @@ class Heap {
     global_ic_age_ = (global_ic_age_ + 1) & SharedFunctionInfo::ICAgeBits::kMax;
   }
 
+  bool flush_monomorphic_ics() { return flush_monomorphic_ics_; }
+
   intptr_t amount_of_external_allocated_memory() {
     return amount_of_external_allocated_memory_;
   }
@@ -1720,6 +1725,8 @@ class Heap {
 
   int global_ic_age_;
 
+  bool flush_monomorphic_ics_;
+
   int scan_on_scavenge_pages_;
 
 #if defined(V8_TARGET_ARCH_X64)

src/objects-visiting-inl.h

@@ -214,9 +214,8 @@ void StaticMarkingVisitor<StaticVisitor>::VisitCodeTarget(
   // when they might be keeping a Context alive, or when the heap is about
   // to be serialized.
   if (FLAG_cleanup_code_caches_at_gc && target->is_inline_cache_stub()
-      && (target->ic_state() == MEGAMORPHIC || Serializer::enabled() ||
-          heap->isolate()->context_exit_happened() ||
-          target->ic_age() != heap->global_ic_age())) {
+      && (target->ic_state() == MEGAMORPHIC || heap->flush_monomorphic_ics() ||
+          Serializer::enabled() || target->ic_age() != heap->global_ic_age())) {
     IC::Clear(rinfo->pc());
     target = Code::GetCodeFromTargetAddress(rinfo->target_address());
   }

test/cctest/test-api.cc

@@ -10840,18 +10840,21 @@ TEST(DontLeakGlobalObjects) {
     { v8::HandleScope scope;
       LocalContext context;
     }
+    v8::V8::ContextDisposedNotification();
     CheckSurvivingGlobalObjectsCount(0);
 
     { v8::HandleScope scope;
       LocalContext context;
       v8_compile("Date")->Run();
     }
+    v8::V8::ContextDisposedNotification();
     CheckSurvivingGlobalObjectsCount(0);
 
     { v8::HandleScope scope;
       LocalContext context;
       v8_compile("/aaa/")->Run();
     }
+    v8::V8::ContextDisposedNotification();
     CheckSurvivingGlobalObjectsCount(0);
 
     { v8::HandleScope scope;
@@ -10860,6 +10863,7 @@ TEST(DontLeakGlobalObjects) {
       LocalContext context(&extensions);
       v8_compile("gc();")->Run();
     }
+    v8::V8::ContextDisposedNotification();
     CheckSurvivingGlobalObjectsCount(0);
   }
 }
@@ -15006,6 +15010,7 @@ TEST(Regress528) {
     context->Exit();
   }
   context.Dispose();
+  v8::V8::ContextDisposedNotification();
   for (gc_count = 1; gc_count < 10; gc_count++) {
     other_context->Enter();
     CompileRun(source_exception);

test/cctest/test-heap.cc

@@ -1067,6 +1067,7 @@ TEST(TestInternalWeakLists) {
     }
 
     // Mark compact handles the weak references.
+    ISOLATE->compilation_cache()->Clear();
     HEAP->CollectAllGarbage(Heap::kNoGCFlags);
     CHECK_EQ(opt ? 4 : 0, CountOptimizedUserFunctions(ctx[i]));
 
@@ -1398,6 +1399,7 @@ TEST(LeakNativeContextViaMap) {
     ctx2->Exit();
     ctx1->Exit();
     ctx1.Dispose();
+    v8::V8::ContextDisposedNotification();
   }
   HEAP->CollectAllAvailableGarbage();
   CHECK_EQ(2, NumberOfGlobalObjects());
@@ -1435,6 +1437,7 @@ TEST(LeakNativeContextViaFunction) {
     ctx2->Exit();
     ctx1->Exit();
     ctx1.Dispose();
+    v8::V8::ContextDisposedNotification();
   }
   HEAP->CollectAllAvailableGarbage();
   CHECK_EQ(2, NumberOfGlobalObjects());
@@ -1470,6 +1473,7 @@ TEST(LeakNativeContextViaMapKeyed) {
     ctx2->Exit();
     ctx1->Exit();
     ctx1.Dispose();
+    v8::V8::ContextDisposedNotification();
   }
   HEAP->CollectAllAvailableGarbage();
   CHECK_EQ(2, NumberOfGlobalObjects());
@@ -1509,6 +1513,7 @@ TEST(LeakNativeContextViaMapProto) {
     ctx2->Exit();
     ctx1->Exit();
     ctx1.Dispose();
+    v8::V8::ContextDisposedNotification();
   }
   HEAP->CollectAllAvailableGarbage();
   CHECK_EQ(2, NumberOfGlobalObjects());
@@ -2111,8 +2116,6 @@ TEST(IncrementalMarkingPreservesMonomorhpicIC) {
   Code* ic_before = FindFirstIC(f->shared()->code(), Code::LOAD_IC);
   CHECK(ic_before->ic_state() == MONOMORPHIC);
 
-  // Fire context dispose notification.
-  v8::V8::ContextDisposedNotification();
   SimulateIncrementalMarking();
   HEAP->CollectAllGarbage(Heap::kNoGCFlags);
 

test/mjsunit/debug-script.js

@@ -26,8 +26,10 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug --expose-gc --noparallel-recompilation
+// Flags: --send-idle-notification
+
 // Get the Debug object exposed from the debug context global object.
-Debug = debug.Debug
+Debug = debug.Debug;
 
 Date();
 RegExp();

test/mjsunit/elements-transition-hoisting.js

@@ -25,8 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --smi-only-arrays --expose-gc
-// Flags: --noparallel-recompilation
+// Flags: --allow-natives-syntax --smi-only-arrays --noparallel-recompilation
 
 // Ensure that ElementsKind transitions in various situations are hoisted (or
 // not hoisted) correctly, don't change the semantics programs and don't trigger
@@ -40,11 +39,6 @@ if (support_smi_only_arrays) {
   print("Tests do NOT include smi-only arrays.");
 }
 
-// Force existing ICs from previous stress runs to be flushed, otherwise the
-// assumptions in this test about when deoptimizations get triggered are not
-// valid.
-gc();
-
 if (support_smi_only_arrays) {
   // Make sure that a simple elements array transitions inside a loop before
   // stores to an array gets hoisted in a way that doesn't generate a deopt in
@@ -66,6 +60,7 @@ if (support_smi_only_arrays) {
   testDoubleConversion4(new Array(5));
   testDoubleConversion4(new Array(5));
   assertTrue(2 != %GetOptimizationStatus(testDoubleConversion4));
+  %ClearFunctionTypeFeedback(testDoubleConversion4);
 
   // Make sure that non-element related map checks that are not preceded by
   // transitions in a loop still get hoisted in a way that doesn't generate a
@@ -91,6 +86,7 @@ if (support_smi_only_arrays) {
   testExactMapHoisting(new Array(5));
   testExactMapHoisting(new Array(5));
   assertTrue(2 != %GetOptimizationStatus(testExactMapHoisting));
+  %ClearFunctionTypeFeedback(testExactMapHoisting);
 
   // Make sure that non-element related map checks do NOT get hoisted if they
   // depend on an elements transition before them and it's not possible to hoist
@@ -122,6 +118,7 @@ if (support_smi_only_arrays) {
   testExactMapHoisting2(new Array(5));
   // Temporarily disabled - see bug 2176.
   // assertTrue(2 != %GetOptimizationStatus(testExactMapHoisting2));
+  %ClearFunctionTypeFeedback(testExactMapHoisting2);
 
   // Make sure that non-element related map checks do get hoisted if they use
   // the transitioned map for the check and all transitions that they depend
@@ -150,6 +147,7 @@ if (support_smi_only_arrays) {
   testExactMapHoisting3(new Array(5));
   testExactMapHoisting3(new Array(5));
   assertTrue(2 != %GetOptimizationStatus(testExactMapHoisting3));
+  %ClearFunctionTypeFeedback(testExactMapHoisting3);
 
   function testDominatingTransitionHoisting1(a) {
     var object = new Object();
@@ -176,6 +174,7 @@ if (support_smi_only_arrays) {
   // above the access, causing a deopt. We should update the type of access
   // rather than forbid hoisting the transition.
   assertTrue(2 != %GetOptimizationStatus(testDominatingTransitionHoisting1));
+  %ClearFunctionTypeFeedback(testDominatingTransitionHoisting1);
   */
 
   function testHoistingWithSideEffect(a) {
@@ -196,6 +195,7 @@ if (support_smi_only_arrays) {
   testHoistingWithSideEffect(new Array(5));
   testHoistingWithSideEffect(new Array(5));
   assertTrue(2 != %GetOptimizationStatus(testHoistingWithSideEffect));
+  %ClearFunctionTypeFeedback(testHoistingWithSideEffect);
 
   function testStraightLineDupeElinination(a,b,c,d,e,f) {
     var count = 3;
@@ -234,4 +234,5 @@ if (support_smi_only_arrays) {
   testStraightLineDupeElinination(new Array(5),0,0,0,0,0);
   testStraightLineDupeElinination(new Array(5),0,0,0,0,0);
   assertTrue(2 != %GetOptimizationStatus(testStraightLineDupeElinination));
+  %ClearFunctionTypeFeedback(testStraightLineDupeElinination);
 }