Add crash instrumentation for crbug.com/621147

src/ic/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/ic.h"
 
 #include "src/accessors.h"
 #include "src/api-arguments-inl.h"
 #include "src/api.h"
 #include "src/arguments.h"
@@ skipping 2517 matching lines @@
       isolate,
       Runtime::SetObjectProperty(isolate, object, key, value, language_mode));
 }
 
 
 MaybeHandle<Object> BinaryOpIC::Transition(
     Handle<AllocationSite> allocation_site, Handle<Object> left,
     Handle<Object> right) {
   BinaryOpICState state(isolate(), extra_ic_state());
 
+#ifdef V8_TARGET_ARCH_X64
+  // Crash instrumentation for crbug.com/621147.
+  if (left->IsHeapObject()) {
+    Heap* heap = isolate()->heap();
+    uintptr_t left_raw = HeapObject::cast(*left)->map_word().ToRawValue();

[Igor Sheludko, 2016/06/28 07:07:20]

If left is a broken pointer it will already crash in attempt to load a map. We
should compare the lower part of the left value with the hole value.

[Michael Lippautz, 2016/06/28 08:39:33]

Oops, thought that it was the map. Reading the values now.

+    uintptr_t hole_raw = heap->the_hole_map()->map_word().ToRawValue();
+    if ((hole_raw & ((1ul << 32) - 1)) == (left_raw & ((1ul << 32) - 1))) {
+      if (!heap->map_space()->ContainsSlow(
+              HeapObject::cast(*left)->address())) {
+        Code* c = GetCode();
+        Code::Kind kind = c->kind();
+        USE(kind);
+        int instruction_size = c->instruction_size();
+        byte* instructions = static_cast<byte*>(alloca(instruction_size));
+        for (int i = 0; i < instruction_size; i++) {
+          instructions[i] = c->instruction_start()[i];
+        }
+        isolate()->PushStackTraceAndDie(0xBAAAAAAD, pc(), fp(), 0u);
+      }
+    }
+  }
+#endif  // V8_TARGET_ARCH_X64
+
   // Compute the actual result using the builtin for the binary operation.
   Handle<Object> result;
   switch (state.op()) {
     default:
       UNREACHABLE();
     case Token::ADD:
       ASSIGN_RETURN_ON_EXCEPTION(isolate(), result,
                                  Object::Add(isolate(), left, right), Object);
       break;
     case Token::SUB:
@@ skipping 445 matching lines @@
     DCHECK_EQ(FeedbackVectorSlotKind::KEYED_LOAD_IC,
               vector->GetKind(vector_slot));
     KeyedLoadICNexus nexus(vector, vector_slot);
     KeyedLoadIC ic(IC::EXTRA_CALL_FRAME, isolate, &nexus);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Load(receiver, key));
   }
 }
 }  // namespace internal
 }  // namespace v8