Revision: 16654
Author: mvstan...@chromium.org
Date: Wed Sep 11 13:39:11 2013 UTC
Log: To diagnose chromium bug 284577, some additional CHECKS. TODOs are
added so these can be backed out once the cause of the bug is determined.
BUG=
R=hpa...@chromium.org
Review URL: https://codereview.chromium.org/23936007
http://code.google.com/p/v8/source/detail?r=16654
Modified:
/branches/bleeding_edge/src/hydrogen.cc
/branches/bleeding_edge/src/objects-debug.cc
/branches/bleeding_edge/src/objects.cc
=======================================
--- /branches/bleeding_edge/src/hydrogen.cc Wed Sep 11 13:00:27 2013 UTC
+++ /branches/bleeding_edge/src/hydrogen.cc Wed Sep 11 13:39:11 2013 UTC
@@ -1824,7 +1824,8 @@
HValue* HGraphBuilder::BuildCreateAllocationMemento(HValue*
previous_object,
int
previous_object_size,
HValue* alloc_site) {
- ASSERT(alloc_site != NULL);
+ // TODO(mvstanton): ASSERT altered to CHECK to diagnose chromium bug
284577
+ CHECK(alloc_site != NULL);
HInnerAllocatedObject* alloc_memento = Add<HInnerAllocatedObject>(
previous_object, previous_object_size);
Handle<Map> alloc_memento_map(
=======================================
--- /branches/bleeding_edge/src/objects-debug.cc Wed Sep 11 07:14:41 2013
UTC
+++ /branches/bleeding_edge/src/objects-debug.cc Wed Sep 11 13:39:11 2013
UTC
@@ -329,11 +329,17 @@
}
}
}
- CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
- (elements() == GetHeap()->empty_fixed_array())),
- (elements()->map() == GetHeap()->fixed_array_map() ||
- elements()->map() == GetHeap()->fixed_cow_array_map()));
- CHECK(map()->has_fast_object_elements() == HasFastObjectElements());
+
+ // TODO(hpayer): deal gracefully with partially constructed JSObjects,
when
+ // allocation folding is turned off.
+ if (reinterpret_cast<Map*>(elements()) !=
+ GetHeap()->one_pointer_filler_map()) {
+ CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
+ (elements() == GetHeap()->empty_fixed_array())),
+ (elements()->map() == GetHeap()->fixed_array_map() ||
+ elements()->map() == GetHeap()->fixed_cow_array_map()));
+ CHECK(map()->has_fast_object_elements() == HasFastObjectElements());
+ }
}
@@ -677,9 +683,19 @@
void JSArray::JSArrayVerify() {
JSObjectVerify();
CHECK(length()->IsNumber() || length()->IsUndefined());
- CHECK(elements()->IsUndefined() ||
- elements()->IsFixedArray() ||
- elements()->IsFixedDoubleArray());
+ // TODO(hpayer): deal gracefully with partially constructed JSObjects,
when
+ // allocation folding is turned off.
+ if (reinterpret_cast<Map*>(elements()) !=
+ GetHeap()->one_pointer_filler_map()) {
+ CHECK(elements()->IsUndefined() ||
+ elements()->IsFixedArray() ||
+ elements()->IsFixedDoubleArray());
+ // TODO(mvstanton): to diagnose chromium bug 284577, remove after.
+ AllocationMemento* memento = AllocationMemento::FindForJSObject(this);
+ if (memento != NULL && memento->IsValid()) {
+ memento->AllocationMementoVerify();
+ }
+ }
}
=======================================
--- /branches/bleeding_edge/src/objects.cc Wed Sep 11 11:00:36 2013 UTC
+++ /branches/bleeding_edge/src/objects.cc Wed Sep 11 13:39:11 2013 UTC
@@ -9052,6 +9052,8 @@
// involves carefully checking the object immediately after the JSArray
// (if there is one) to see if it's an AllocationMemento.
if (FLAG_track_allocation_sites &&
object->GetHeap()->InNewSpace(object)) {
+ // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove
after.
+ CHECK(object->GetHeap()->InToSpace(object));
Address ptr_end = (reinterpret_cast<Address>(object) - kHeapObjectTag)
+
object->Size();
if ((ptr_end + AllocationMemento::kSize) <=
@@ -9061,8 +9063,14 @@
reinterpret_cast<Map**>(ptr_end);
if (*possible_allocation_memento_map ==
object->GetHeap()->allocation_memento_map()) {
+ Address ptr_object = reinterpret_cast<Address>(object);
+ // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove
after.
+ // If this check fails it points to the very unlikely case that
we've
+ // misinterpreted a page header as an allocation memento. Follow up
+ // with a real fix.
+ CHECK(Page::FromAddress(ptr_object) == Page::FromAddress(ptr_end));
AllocationMemento* memento = AllocationMemento::cast(
- reinterpret_cast<Object*>(ptr_end + 1));
+ reinterpret_cast<Object*>(ptr_end + kHeapObjectTag));
return memento;
}
}
--
--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to v8-dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
