• Benedikt Meurer's avatar
    [map] Move Map::IsInRetainedMapListBit out of Map::bit_field2. · 437d710f
    Benedikt Meurer authored
    The invariant is that Map::bit_field2 shouldn't change, and the
    IsInRetainedMapListBit apparently changes when the map is held
    weakly from optimized code. This causes TurboFan compilations to
    change the Map::Hash() result, which in turn causes lookups on
    the normalized map cache to miss (and maybe other bad consequences).
    
    With this change we swap Map::IsInRetainedMapListBit (previously in
    bit_field2) and Map::HasHiddenPrototypeBit (previously in bit_field3)
    to address this problem.
    
    Bug: chromium:963411, v8:9114, v8:9267
    Change-Id: I040a27c37305fa602649750bd93bee40c91fca78
    Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619747
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
    Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
    Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#61657}
    437d710f
Name
Last commit
Last update
..
benchmarks Loading commit data...
cctest Loading commit data...
common Loading commit data...
debugger Loading commit data...
fuzzer Loading commit data...
inspector Loading commit data...
intl Loading commit data...
js-perf-test Loading commit data...
memory Loading commit data...
message Loading commit data...
mjsunit Loading commit data...
mkgrokdump Loading commit data...
mozilla Loading commit data...
preparser Loading commit data...
test262 Loading commit data...
torque Loading commit data...
unittests Loading commit data...
wasm-js Loading commit data...
wasm-spec-tests Loading commit data...
webkit Loading commit data...
BUILD.gn Loading commit data...
OWNERS Loading commit data...