[deoptimizer] Insert more consistency checks.

src/deoptimizer.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/deoptimizer.h"
 
 #include <memory>
 
 #include "src/accessors.h"
 #include "src/ast/prettyprinter.h"
@@ skipping 3599 matching lines @@
 
   stack_frame_pointer_ = stack_frame_pointer;
   has_adapted_arguments_ = has_adapted_arguments;
 
   UpdateFromPreviouslyMaterializedObjects();
 }
 
 
 Handle<Object> TranslatedState::MaterializeAt(int frame_index,
                                               int* value_index) {
+  CHECK_LT(static_cast<size_t>(frame_index), frames().size());
   TranslatedFrame* frame = &(frames_[frame_index]);
-  CHECK(static_cast<size_t>(*value_index) < frame->values_.size());
+  CHECK_LT(static_cast<size_t>(*value_index), frame->values_.size());
 
   TranslatedValue* slot = &(frame->values_[*value_index]);
   (*value_index)++;
 
   switch (slot->kind()) {
     case TranslatedValue::kTagged:
     case TranslatedValue::kInt32:
     case TranslatedValue::kUInt32:
     case TranslatedValue::kBoolBit:
     case TranslatedValue::kFloat:
@@ skipping 25 matching lines @@
           Handle<Object> value = MaterializeAt(frame_index, value_index);
           array->set(i, *value);
         }
       }
       slot->value_ = arguments;
       return arguments;
     }
     case TranslatedValue::kCapturedObject: {
       int length = slot->GetChildrenCount();
 
+      class FieldMaterializer {
+       public:
+        FieldMaterializer(TranslatedState* state, int frame_index,
+                          int field_count)
+            : state_(state),
+              frame_index_(frame_index),
+              field_count_(field_count) {}
+
+        Handle<Object> At(int* value_index) {
+          CHECK(field_count_ > 0);
+          --field_count_;
+          return state_->MaterializeAt(frame_index_, value_index);
+        }
+
+        ~FieldMaterializer() { CHECK_EQ(0, field_count_); }
+
+       private:
+        TranslatedState* state_;
+        int frame_index_;
+        int field_count_;
+      };
+      FieldMaterializer materializer(this, frame_index, length);
+
       // The map must be a tagged object.
       CHECK(frame->values_[*value_index].kind() == TranslatedValue::kTagged);
 
       Handle<Object> result;
       if (slot->value_.ToHandle(&result)) {
         // This has been previously materialized, return the previous value.
         // We still need to skip all the nested objects.
         for (int i = 0; i < length; i++) {
-          MaterializeAt(frame_index, value_index);
+          materializer.At(value_index);
         }
 
         return result;
       }
 
-      Handle<Object> map_object = MaterializeAt(frame_index, value_index);
+      Handle<Object> map_object = materializer.At(value_index);
       Handle<Map> map =
           Map::GeneralizeAllFieldRepresentations(Handle<Map>::cast(map_object));
       switch (map->instance_type()) {
         case MUTABLE_HEAP_NUMBER_TYPE:
         case HEAP_NUMBER_TYPE: {
           // Reuse the HeapNumber value directly as it is already properly
           // tagged and skip materializing the HeapNumber explicitly.
-          Handle<Object> object = MaterializeAt(frame_index, value_index);
+          Handle<Object> object = materializer.At(value_index);
           slot->value_ = object;
           // On 32-bit architectures, there is an extra slot there because
           // the escape analysis calculates the number of slots as
           // object-size/pointer-size. To account for this, we read out
           // any extra slots.
           for (int i = 0; i < length - 2; i++) {
-            MaterializeAt(frame_index, value_index);
+            materializer.At(value_index);
           }
           return object;
         }
         case JS_OBJECT_TYPE:
         case JS_ERROR_TYPE:
         case JS_ARGUMENTS_TYPE: {
           Handle<JSObject> object =
               isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED);
           slot->value_ = object;
-          Handle<Object> properties = MaterializeAt(frame_index, value_index);
-          Handle<Object> elements = MaterializeAt(frame_index, value_index);
+          Handle<Object> properties = materializer.At(value_index);
+          Handle<Object> elements = materializer.At(value_index);
           object->set_properties(FixedArray::cast(*properties));
           object->set_elements(FixedArrayBase::cast(*elements));
           for (int i = 0; i < length - 3; ++i) {
-            Handle<Object> value = MaterializeAt(frame_index, value_index);
+            Handle<Object> value = materializer.At(value_index);
             FieldIndex index = FieldIndex::ForPropertyIndex(object->map(), i);
             object->FastPropertyAtPut(index, *value);
           }
           return object;
         }
         case JS_ARRAY_TYPE: {
           Handle<JSArray> object = Handle<JSArray>::cast(
               isolate_->factory()->NewJSObjectFromMap(map, NOT_TENURED));
           slot->value_ = object;
-          Handle<Object> properties = MaterializeAt(frame_index, value_index);
-          Handle<Object> elements = MaterializeAt(frame_index, value_index);
-          Handle<Object> length = MaterializeAt(frame_index, value_index);
+          Handle<Object> properties = materializer.At(value_index);
+          Handle<Object> elements = materializer.At(value_index);
+          Handle<Object> length = materializer.At(value_index);
           object->set_properties(FixedArray::cast(*properties));
           object->set_elements(FixedArrayBase::cast(*elements));
           object->set_length(*length);
           return object;
         }
         case JS_FUNCTION_TYPE: {
           Handle<SharedFunctionInfo> temporary_shared =
               isolate_->factory()->NewSharedFunctionInfo(
                   isolate_->factory()->empty_string(), MaybeHandle<Code>(),
                   false);
           Handle<JSFunction> object =
               isolate_->factory()->NewFunctionFromSharedFunctionInfo(
                   map, temporary_shared, isolate_->factory()->undefined_value(),
                   NOT_TENURED);
           slot->value_ = object;
-          Handle<Object> properties = MaterializeAt(frame_index, value_index);
-          Handle<Object> elements = MaterializeAt(frame_index, value_index);
-          Handle<Object> prototype = MaterializeAt(frame_index, value_index);
-          Handle<Object> shared = MaterializeAt(frame_index, value_index);
-          Handle<Object> context = MaterializeAt(frame_index, value_index);
-          Handle<Object> literals = MaterializeAt(frame_index, value_index);
-          Handle<Object> entry = MaterializeAt(frame_index, value_index);
-          Handle<Object> next_link = MaterializeAt(frame_index, value_index);
+          Handle<Object> properties = materializer.At(value_index);
+          Handle<Object> elements = materializer.At(value_index);
+          Handle<Object> prototype = materializer.At(value_index);
+          Handle<Object> shared = materializer.At(value_index);
+          Handle<Object> context = materializer.At(value_index);
+          Handle<Object> literals = materializer.At(value_index);
+          Handle<Object> entry = materializer.At(value_index);
+          Handle<Object> next_link = materializer.At(value_index);
           object->ReplaceCode(*isolate_->builtins()->CompileLazy());
           object->set_map(*map);
           object->set_properties(FixedArray::cast(*properties));
           object->set_elements(FixedArrayBase::cast(*elements));
           object->set_prototype_or_initial_map(*prototype);
           object->set_shared(SharedFunctionInfo::cast(*shared));
           object->set_context(Context::cast(*context));
           object->set_literals(LiteralsArray::cast(*literals));
           CHECK(entry->IsNumber());  // Entry to compile lazy stub.
           CHECK(next_link->IsUndefined(isolate_));
           return object;
         }
         case CONS_STRING_TYPE: {
           Handle<ConsString> object = Handle<ConsString>::cast(
               isolate_->factory()
                   ->NewConsString(isolate_->factory()->undefined_string(),
                                   isolate_->factory()->undefined_string())
                   .ToHandleChecked());
           slot->value_ = object;
-          Handle<Object> hash = MaterializeAt(frame_index, value_index);
-          Handle<Object> length = MaterializeAt(frame_index, value_index);
-          Handle<Object> first = MaterializeAt(frame_index, value_index);
-          Handle<Object> second = MaterializeAt(frame_index, value_index);
+          Handle<Object> hash = materializer.At(value_index);
+          Handle<Object> length = materializer.At(value_index);
+          Handle<Object> first = materializer.At(value_index);
+          Handle<Object> second = materializer.At(value_index);
           object->set_map(*map);
           object->set_length(Smi::cast(*length)->value());
           object->set_first(String::cast(*first));
           object->set_second(String::cast(*second));
           CHECK(hash->IsNumber());  // The {Name::kEmptyHashField} value.
           return object;
         }
         case CONTEXT_EXTENSION_TYPE: {
           Handle<ContextExtension> object =
               isolate_->factory()->NewContextExtension(
                   isolate_->factory()->NewScopeInfo(1),
                   isolate_->factory()->undefined_value());
           slot->value_ = object;
-          Handle<Object> scope_info = MaterializeAt(frame_index, value_index);
-          Handle<Object> extension = MaterializeAt(frame_index, value_index);
+          Handle<Object> scope_info = materializer.At(value_index);
+          Handle<Object> extension = materializer.At(value_index);
           object->set_scope_info(ScopeInfo::cast(*scope_info));
           object->set_extension(*extension);
           return object;
         }
         case FIXED_ARRAY_TYPE: {
-          Handle<Object> lengthObject = MaterializeAt(frame_index, value_index);
+          Handle<Object> lengthObject = materializer.At(value_index);
           int32_t length = 0;
           CHECK(lengthObject->ToInt32(&length));
           Handle<FixedArray> object =
               isolate_->factory()->NewFixedArray(length);
           // We need to set the map, because the fixed array we are
           // materializing could be a context or an arguments object,
           // in which case we must retain that information.
           object->set_map(*map);
           slot->value_ = object;
           for (int i = 0; i < length; ++i) {
-            Handle<Object> value = MaterializeAt(frame_index, value_index);
+            Handle<Object> value = materializer.At(value_index);
             object->set(i, *value);
           }
           return object;
         }
         case FIXED_DOUBLE_ARRAY_TYPE: {
           DCHECK_EQ(*map, isolate_->heap()->fixed_double_array_map());
-          Handle<Object> lengthObject = MaterializeAt(frame_index, value_index);
+          Handle<Object> lengthObject = materializer.At(value_index);
           int32_t length = 0;
           CHECK(lengthObject->ToInt32(&length));
           Handle<FixedArrayBase> object =
               isolate_->factory()->NewFixedDoubleArray(length);
           slot->value_ = object;
           if (length > 0) {
             Handle<FixedDoubleArray> double_array =
                 Handle<FixedDoubleArray>::cast(object);
             for (int i = 0; i < length; ++i) {
-              Handle<Object> value = MaterializeAt(frame_index, value_index);
+              Handle<Object> value = materializer.At(value_index);
               CHECK(value->IsNumber());
               double_array->set(i, value->Number());
             }
           }
           return object;
         }
         default:
           PrintF(stderr, "[couldn't handle instance type %d]\n",
                  map->instance_type());
           FATAL("unreachable");
@@ skipping 27 matching lines @@
       UNREACHABLE();
       break;
   }
 
   FATAL("We should never get here - unexpected deopt slot kind.");
   return Handle<Object>::null();
 }
 
 
 Handle<Object> TranslatedState::MaterializeObjectAt(int object_index) {
+  CHECK_LT(static_cast<size_t>(object_index), object_positions_.size());
   TranslatedState::ObjectPosition pos = object_positions_[object_index];
   return MaterializeAt(pos.frame_index_, &(pos.value_index_));
 }
 
 
 bool TranslatedState::GetAdaptedArguments(Handle<JSObject>* result,
                                           int frame_index) {
   if (frame_index == 0) {
     // Top level frame -> we need to go to the parent frame on the stack.
     if (!has_adapted_arguments_) return false;
@@ skipping 131 matching lines @@
       CHECK(value_info->IsMaterializedObject());
 
       value_info->value_ =
           Handle<Object>(previously_materialized_objects->get(i), isolate_);
     }
   }
 }
 
 }  // namespace internal
 }  // namespace v8