The article is a bit confused about multiple things within V8, so I
wouldn't rely on it as a source to correctly understand how V8 works in
detail. E.g., also the first sentence explaining what "stable maps" are is
plainly wrong. Stable maps are maps from which we've never seen an instance
transition away.
I don't remember if it's correct but it makes think that the bug was about
an optimization allowing us not to recheck the map of an object since it
was marked stable, by instead adding a "stability dependency" on the map.
If any object ever transitions away from the stable map the code should be
deoptimized. I believe this was broken for elements transitions since we
find those transitions in special way; and we had forgotten to mark the
source map of the transition unstable when the transition target map
already existed. Since optimized code wasn't notified when the object shape
changed (and its map was swapped), it kept on assuming that the elements
kind was the previous one.
On Wed, Sep 6, 2017 at 3:41 AM Jakob Kummerow <jkumme...@chromium.org>
wrote:
> Well, as you said, that article is talking about a bug, so the answer to
> the question "why did that happen?" is "because there was a bug".
>
> Elements kind transitions are regular map transitions (the article seems
> to be a bit confused about that), and do cause inline cache misses (and
> other map check failures) just like every other map transition. The bug (as
> far as I understand) had to do with compiler optimizations, not inline
> cache misses.
>
> On Tue, Sep 5, 2017 at 4:30 PM, cyril <hit.liushenr...@gmail.com> wrote:
>
>> I have read an article about V8's bug , the author wrote
>>
>>> What happens is this: First, a function is reduced in a way that makes
>>> it change the elements kind of a stable map. Next, a second function is
>>> reduced in a way that simply stores / loads a property in the same stable
>>> map. Now, an object of that map is created. The first function is called
>>> with that object as the argument, and the elements kind is changed.
>>> The second function is called, and the inline cache does not miss
>>> (since, remember, an elements kind transition is not a regular transition
>>> into a different map type that would cause the cache to miss).
>>
>> So How to understand this sentence?* (since, remember, an elements kind
>> transition is not a regular transition into a different map type that would
>> cause the cache to miss).*
>>
>> the link : https://blogs.securiteam.com/index.php/archives/3379
>>
>> Jakob Kummerow wrote：
>>>
>>> What cache are you talking about?
>>>
>>> Different elements kinds do cause inline cache misses.
>>>
>>> On Tue, Sep 5, 2017 at 3:08 AM, cyril <hit.liu...@gmail.com> wrote:
>>>
>>>> Hi all,
>>>>
>>>> Why element kind transition can't cause the cache to miss?
>>>>
>>>>
>>>> --
>>>> --
>>>> v8-users mailing list
>>>> v8-u...@googlegroups.com
>>>> http://groups.google.com/group/v8-users
>>>> ---
>>>> You received this message because you are subscribed to the Google
>>>> Groups "v8-users" group.
>>>> To unsubscribe from this group and stop receiving emails from it, send
>>>> an email to v8-users+u...@googlegroups.com.
>>>> For more options, visit https://groups.google.com/d/optout.
>>>>
>>>
>>> --
>> --
>> v8-users mailing list
>> v8-users@googlegroups.com
>> http://groups.google.com/group/v8-users
>> ---
>> You received this message because you are subscribed to the Google Groups
>> "v8-users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to v8-users+unsubscr...@googlegroups.com.
>> For more options, visit https://groups.google.com/d/optout.
>>
>
> --
> --
> v8-users mailing list
> v8-users@googlegroups.com
> http://groups.google.com/group/v8-users
> ---
> You received this message because you are subscribed to the Google Groups
> "v8-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to v8-users+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
>
--
Toon Verwaest | Software Engineer, V8 | Google Germany GmbH | Erika-Mann
Str. 33, 80636 München
Registergericht und -nummer: Hamburg, HRB 86891 | Sitz der Gesellschaft:
Hamburg | Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
--
--
v8-users mailing list
v8-users@googlegroups.com
http://groups.google.com/group/v8-users
---
You received this message because you are subscribed to the Google Groups
"v8-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-users+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
