Allow code-dependency changes in OptimizedCompilationJob::FinalizeJob

Installation of the PrototypePropertyDependency, as well as GC, can
invalidate dependencies.

Bug: chromium:902552
Change-Id: Iabcce026c7475c722d19ac0b80758b22d9fbcfda
Reviewed-on: https://chromium-review.googlesource.com/c/1322450Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57343}

src/compiler.cc

@@ -226,7 +226,6 @@ CompilationJob::Status OptimizedCompilationJob::ExecuteJob() {
 
 CompilationJob::Status OptimizedCompilationJob::FinalizeJob(Isolate* isolate) {
   DCHECK(ThreadId::Current().Equals(isolate->thread_id()));
-  DisallowCodeDependencyChange no_dependency_change;
   DisallowJavascriptExecution no_js(isolate);
 
   // Delegate to the underlying implementation.

src/compiler/compilation-dependencies.cc

@@ -71,6 +71,9 @@ class PrototypePropertyDependency final
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
     Handle<JSFunction> function = function_.object();
+    // Note that EnsureHasInitialMap can invalidate other dependencies, whether
+    // installed already or not, because it may change the map of the prototype
+    // object.
     if (!function->has_initial_map()) JSFunction::EnsureHasInitialMap(function);
     Handle<Map> initial_map(function->initial_map(), function_.isolate());
     DependentCode::InstallDependency(function_.isolate(), code, initial_map,
@@ -382,7 +385,8 @@ bool CompilationDependencies::Commit(Handle<Code> code) {
 
   for (auto dep : dependencies_) {
     // Check each dependency's validity again right before installing it,
-    // because a GC can trigger invalidation for some dependency kinds.
+    // because a GC can trigger invalidation for some dependency kinds (e.g.,
+    // for PretenureModeDependency).
     if (!dep->IsValid()) {
       dependencies_.clear();
       return false;

test/mjsunit/regress/regress-902552.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var C = class {};
+for (var i = 0; i < 4; ++i) {
+  if (i == 2) %OptimizeOsr();
+  C.prototype.foo = 42;
+}