Add crash instrumentation for crbug.com/621147

src/ic/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/ic/ic.h"
 
 #include "src/accessors.h"
 #include "src/api-arguments-inl.h"
 #include "src/api.h"
 #include "src/arguments.h"
@@ skipping 2517 matching lines @@
       isolate,
       Runtime::SetObjectProperty(isolate, object, key, value, language_mode));
 }
 
 
 MaybeHandle<Object> BinaryOpIC::Transition(
     Handle<AllocationSite> allocation_site, Handle<Object> left,
     Handle<Object> right) {
   BinaryOpICState state(isolate(), extra_ic_state());
 
+#ifdef V8_TARGET_ARCH_X64
+  // Crash instrumentation for crbug.com/621147.
+  uintptr_t left_raw = reinterpret_cast<uintptr_t>(*left);
+  uintptr_t hole_raw =
+      reinterpret_cast<uintptr_t>(isolate()->heap()->the_hole_value());
+  if ((hole_raw & ((1ul << 32) - 1)) == (left_raw & ((1ul << 32) - 1))) {
+    Code* c = GetCode();
+    Code::Kind kind = c->kind();
+    USE(kind);
+    int instruction_size = c->instruction_size();
+    byte* instructions = static_cast<byte*>(alloca(instruction_size));
+    for (int i = 0; i < instruction_size; i++) {
+      instructions[i] = c->instruction_start()[i];
+    }
+    isolate()->PushStackTraceAndDie(0xBAAAAAAD, pc(), fp(), 0u);

[Igor Sheludko, 2016/06/28 09:06:28]

I have a fear that the instructions array could be eliminated in release build
since it is not used. I would put the fp() value to the beginning of the
instructions buffer and pass the buffer pointer to the PushStackTraceAndDie
instead of fp.

[Michael Lippautz, 2016/06/28 09:45:13]

Done.

+  }
+#endif  // V8_TARGET_ARCH_X64
+
   // Compute the actual result using the builtin for the binary operation.
   Handle<Object> result;
   switch (state.op()) {
     default:
       UNREACHABLE();
     case Token::ADD:
       ASSIGN_RETURN_ON_EXCEPTION(isolate(), result,
                                  Object::Add(isolate(), left, right), Object);
       break;
     case Token::SUB:
@@ skipping 445 matching lines @@
     DCHECK_EQ(FeedbackVectorSlotKind::KEYED_LOAD_IC,
               vector->GetKind(vector_slot));
     KeyedLoadICNexus nexus(vector, vector_slot);
     KeyedLoadIC ic(IC::EXTRA_CALL_FRAME, isolate, &nexus);
     ic.UpdateState(receiver, key);
     RETURN_RESULT_OR_FAILURE(isolate, ic.Load(receiver, key));
   }
 }
 }  // namespace internal
 }  // namespace v8