[turbofan] Properly guard keyed stores wrt. setters in the prototype chain.

[turbofan] Properly guard keyed stores wrt. setters in the prototype chain.

For holey/growing keyed stores, we need to check that there are no
setters in the prototype chain and protect against changes to that
via code dependencies.

R=verwaest@chromium.org
BUG=v8:5275, v8:5276
Committed: https://crrev.com/7060bab81cbe3a81f4340263ab6c3b105ed90eec
Cr-Commit-Position: refs/heads/master@{#38514}

[Benedikt Meurer, 2016-08-10 05:30:48]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-10 05:31:02]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-08-10 05:31:26]

Hey Toon,

Here's the fix for the missing prototype chain checks for keyed growing/holey
stores.
Please take a look.

Thanks,
Benedikt

[Toon Verwaest, 2016-08-10 05:38:36]

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
File src/compiler/js-native-context-specialization.cc (right):

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:486: if
(!receiver_map->prototype()->IsNull(isolate()) &&
drop this null check, already covered in the loop below.

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:494: map =
handle(Handle<JSObject>::cast(map_prototype)->map(),
JSObject::cast(*map_prototype)->map() is shorter :)

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:498:
prototype_maps.push_back(map);
Most of the time this will only cover array_prototype, object_prototype for
different receiver maps. Don't we want to optimize for that case (and avoid
later overhead for registering, and avoiding zone allocation)?

[Benedikt Meurer, 2016-08-10 05:41:34]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-10 05:41:39]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-08-10 05:41:47]

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
File src/compiler/js-native-context-specialization.cc (right):

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:486: if
(!receiver_map->prototype()->IsNull(isolate()) &&
On 2016/08/10 05:38:36, Toon Verwaest wrote:
> drop this null check, already covered in the loop below.

Done.

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:494: map =
handle(Handle<JSObject>::cast(map_prototype)->map(),
On 2016/08/10 05:38:36, Toon Verwaest wrote:
> JSObject::cast(*map_prototype)->map() is shorter :)

Acknowledged.

https://codereview.chromium.org/2231683002/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:498:
prototype_maps.push_back(map);
Added a TODO.

[Toon Verwaest, 2016-08-10 05:42:31]

lgtm

[commit-bot: I haz the power, 2016-08-10 05:42:48]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-10 05:42:49]

Dry run: Try jobs failed on following builders:
  v8_android_arm_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_android_arm_compile_rel/...)
  v8_linux64_avx2_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_avx2_rel_ng/buil...)
  v8_linux64_gyp_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_gyp_rel_ng/build...)
  v8_linux64_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_rel_ng/builds/10700)
  v8_linux_arm_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm_rel_ng/builds/...)
  v8_linux_gcc_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_gcc_compile_rel/bu...)
  v8_linux_mips64el_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_mips64el_compile_r...)
  v8_linux_nodcheck_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_nodcheck_rel_ng/bu...)
  v8_mac_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng/builds/6704)
  v8_presubmit on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/21465)

[Benedikt Meurer, 2016-08-10 05:43:33]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-08-10 05:43:39]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-10 05:44:49]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-10 05:44:50]

Try jobs failed on following builders:
  v8_android_arm_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_android_arm_compile_rel/...)
  v8_linux64_asan_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng/buil...)
  v8_linux64_avx2_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_avx2_rel_ng/buil...)
  v8_linux64_gyp_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_gyp_rel_ng/build...)
  v8_linux_arm64_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm64_rel_ng/build...)
  v8_linux_arm_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm_rel_ng/builds/...)
  v8_linux_dbg_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_dbg_ng/builds/10683)
  v8_linux_gcc_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_gcc_compile_rel/bu...)
  v8_linux_mips64el_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_mips64el_compile_r...)
  v8_linux_mipsel_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_mipsel_compile_rel...)
  v8_linux_nodcheck_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_nodcheck_rel_ng/bu...)
  v8_linux_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_rel_ng/builds/10642)
  v8_presubmit on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/21466)

[Benedikt Meurer, 2016-08-10 05:59:30]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-10 05:59:42]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-08-10 06:23:06]

The CQ bit was unchecked by bmeurer@chromium.org

[Benedikt Meurer, 2016-08-10 06:23:09]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2016-08-10 06:23:10]

The patchset sent to the CQ was uploaded after l-g-t-m from
verwaest@chromium.org
Link to the patchset: https://codereview.chromium.org/2231683002/#ps40001
(title: "REBASE")

[commit-bot: I haz the power, 2016-08-10 06:23:15]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-10 06:30:10]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-08-10 06:30:29]

Description was changed from

==========
[turbofan] Properly guard keyed stores wrt. setters in the prototype chain.

For holey/growing keyed stores, we need to check that there are no
setters in the prototype chain and protect against changes to that
via code dependencies.

R=verwaest@chromium.org
BUG=v8:5275,v8:5276
==========

to

==========
[turbofan] Properly guard keyed stores wrt. setters in the prototype chain.

For holey/growing keyed stores, we need to check that there are no
setters in the prototype chain and protect against changes to that
via code dependencies.

R=verwaest@chromium.org
BUG=v8:5275,v8:5276

Committed: https://crrev.com/7060bab81cbe3a81f4340263ab6c3b105ed90eec
Cr-Commit-Position: refs/heads/master@{#38514}
==========

[commit-bot: I haz the power, 2016-08-10 06:30:30]

Patchset 3 (id:??) landed as
https://crrev.com/7060bab81cbe3a81f4340263ab6c3b105ed90eec
Cr-Commit-Position: refs/heads/master@{#38514}