Revert of [compiler] Properly validate stable map assumption for globals.

Revert of [compiler] Properly validate stable map assumption for globals. (patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )

Reason for revert:
Breaks tree: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/8789

Original issue's description:
> [compiler] Properly validate stable map assumption for globals.
>
> For global object property cells, we did not check that the map on the
> previous object is still the same for which we actually optimized. So
> the optimized code was not in sync with the actual state of the property
> cell. When loading from such a global object property cell, Crankshaft
> optimizes away any map checks (based on the stable map assumption),
> leading to arbitrary memory access in the worst case.
>
> TurboFan has the same bug for stores, but is safe on loads because we
> do appropriate map checks there. However mixing TurboFan and Crankshaft
> still exposes the bug.
>
> R=yangguo@chromium.org
> BUG=chromium:659475
TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:659475
Committed: https://crrev.com/d0a047d440ea6283f9e63056cf5ec1fa3203e309
Cr-Commit-Position: refs/heads/master@{#40582}

[Benedikt Meurer, 2016-10-26 11:11:08]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2016-10-26 11:11:09]

Created Revert of [compiler] Properly validate stable map assumption for
globals.

[commit-bot: I haz the power, 2016-10-26 11:11:14]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-26 11:11:27]

Description was changed from

==========
Revert of [compiler] Properly validate stable map assumption for globals.
(patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )

Reason for revert:
Breaks tree:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-...


Original issue's description:
> [compiler] Properly validate stable map assumption for globals.
> 
> For global object property cells, we did not check that the map on the
> previous object is still the same for which we actually optimized. So
> the optimized code was not in sync with the actual state of the property
> cell. When loading from such a global object property cell, Crankshaft
> optimizes away any map checks (based on the stable map assumption),
> leading to arbitrary memory access in the worst case.
> 
> TurboFan has the same bug for stores, but is safe on loads because we
> do appropriate map checks there. However mixing TurboFan and Crankshaft
> still exposes the bug.
> 
> R=yangguo@chromium.org
> BUG=chromium:659475

TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:659475
==========

to

==========
Revert of [compiler] Properly validate stable map assumption for globals.
(patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )

Reason for revert:
Breaks tree:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-...


Original issue's description:
> [compiler] Properly validate stable map assumption for globals.
> 
> For global object property cells, we did not check that the map on the
> previous object is still the same for which we actually optimized. So
> the optimized code was not in sync with the actual state of the property
> cell. When loading from such a global object property cell, Crankshaft
> optimizes away any map checks (based on the stable map assumption),
> leading to arbitrary memory access in the worst case.
> 
> TurboFan has the same bug for stores, but is safe on loads because we
> do appropriate map checks there. However mixing TurboFan and Crankshaft
> still exposes the bug.
> 
> R=yangguo@chromium.org
> BUG=chromium:659475

TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:659475
==========

[commit-bot: I haz the power, 2016-10-26 11:11:28]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-11-17 22:13:29]

Description was changed from

==========
Revert of [compiler] Properly validate stable map assumption for globals.
(patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )

Reason for revert:
Breaks tree:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-...


Original issue's description:
> [compiler] Properly validate stable map assumption for globals.
> 
> For global object property cells, we did not check that the map on the
> previous object is still the same for which we actually optimized. So
> the optimized code was not in sync with the actual state of the property
> cell. When loading from such a global object property cell, Crankshaft
> optimizes away any map checks (based on the stable map assumption),
> leading to arbitrary memory access in the worst case.
> 
> TurboFan has the same bug for stores, but is safe on loads because we
> do appropriate map checks there. However mixing TurboFan and Crankshaft
> still exposes the bug.
> 
> R=yangguo@chromium.org
> BUG=chromium:659475

TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:659475
==========

to

==========
Revert of [compiler] Properly validate stable map assumption for globals.
(patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )

Reason for revert:
Breaks tree:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-...

Original issue's description:
> [compiler] Properly validate stable map assumption for globals.
>
> For global object property cells, we did not check that the map on the
> previous object is still the same for which we actually optimized. So
> the optimized code was not in sync with the actual state of the property
> cell. When loading from such a global object property cell, Crankshaft
> optimizes away any map checks (based on the stable map assumption),
> leading to arbitrary memory access in the worst case.
>
> TurboFan has the same bug for stores, but is safe on loads because we
> do appropriate map checks there. However mixing TurboFan and Crankshaft
> still exposes the bug.
>
> R=yangguo@chromium.org
> BUG=chromium:659475

TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:659475

Committed: https://crrev.com/d0a047d440ea6283f9e63056cf5ec1fa3203e309
Cr-Commit-Position: refs/heads/master@{#40582}
==========

[commit-bot: I haz the power, 2016-11-17 22:13:34]

Patchset 1 (id:??) landed as
https://crrev.com/d0a047d440ea6283f9e63056cf5ec1fa3203e309
Cr-Commit-Position: refs/heads/master@{#40582}