• bmeurer's avatar
    Revert of [compiler] Properly validate stable map assumption for globals.... · d0a047d4
    bmeurer authored
    Revert of [compiler] Properly validate stable map assumption for globals. (patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )
    
    Reason for revert:
    Breaks tree: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/8789
    
    Original issue's description:
    > [compiler] Properly validate stable map assumption for globals.
    >
    > For global object property cells, we did not check that the map on the
    > previous object is still the same for which we actually optimized. So
    > the optimized code was not in sync with the actual state of the property
    > cell. When loading from such a global object property cell, Crankshaft
    > optimizes away any map checks (based on the stable map assumption),
    > leading to arbitrary memory access in the worst case.
    >
    > TurboFan has the same bug for stores, but is safe on loads because we
    > do appropriate map checks there. However mixing TurboFan and Crankshaft
    > still exposes the bug.
    >
    > R=yangguo@chromium.org
    > BUG=chromium:659475
    
    TBR=yangguo@chromium.org
    # Skipping CQ checks because original CL landed less than 1 days ago.
    NOPRESUBMIT=true
    NOTREECHECKS=true
    NOTRY=true
    BUG=chromium:659475
    
    Review-Url: https://codereview.chromium.org/2454513003
    Cr-Commit-Position: refs/heads/master@{#40582}
    d0a047d4
Name
Last commit
Last update
..
benchmarks Loading commit data...
cctest Loading commit data...
common Loading commit data...
debugger Loading commit data...
fuzzer Loading commit data...
inspector Loading commit data...
intl Loading commit data...
js-perf-test Loading commit data...
memory Loading commit data...
message Loading commit data...
mjsunit Loading commit data...
mozilla Loading commit data...
preparser Loading commit data...
promises-aplus Loading commit data...
simdjs Loading commit data...
test262 Loading commit data...
unittests Loading commit data...
webkit Loading commit data...
BUILD.gn Loading commit data...
bot_default.gyp Loading commit data...
bot_default.isolate Loading commit data...
default.gyp Loading commit data...
default.isolate Loading commit data...
optimize_for_size.gyp Loading commit data...
optimize_for_size.isolate Loading commit data...
perf.gyp Loading commit data...
perf.isolate Loading commit data...