Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(329)

Unified Diff: src/objects.cc

Issue 2972353002: [wasm] Improve precision of slow DCHECK for WebAssembly-constructed internal objects. (Closed)
Patch Set: Fix compile error and add testcase. Created 3 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | test/mjsunit/asm/regress-740325.js » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 6dbd0d32cba21d02228f5019a051fdf063306074..270c7b6bd77e8d051c6818d435badfda3fb4ac46 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -15857,23 +15857,28 @@ bool JSObject::WasConstructedFromApiFunction() {
auto instance_type = map()->instance_type();
bool is_api_object = instance_type == JS_API_OBJECT_TYPE ||
instance_type == JS_SPECIAL_API_OBJECT_TYPE;
+ bool is_wasm_object =
+ instance_type == WASM_MEMORY_TYPE || instance_type == WASM_MODULE_TYPE ||
+ instance_type == WASM_INSTANCE_TYPE || instance_type == WASM_TABLE_TYPE;
#ifdef ENABLE_SLOW_DCHECKS
if (FLAG_enable_slow_asserts) {
Object* maybe_constructor = map()->GetConstructor();
if (maybe_constructor->IsJSFunction()) {
JSFunction* constructor = JSFunction::cast(maybe_constructor);
- if (constructor->shared()->IsApiFunction()) {
- DCHECK(is_api_object);
- } else {
- DCHECK(!is_api_object);
- }
+ DCHECK_EQ(constructor->shared()->IsApiFunction(),
+ is_api_object || is_wasm_object);
} else if (maybe_constructor->IsFunctionTemplateInfo()) {
- DCHECK(is_api_object);
+ DCHECK(is_api_object || is_wasm_object);
} else {
return false;
}
}
#endif
+ // TODO(titzer): Clean this up somehow. WebAssembly objects should not be
+ // considered "constructed from API functions" even though they have
+ // function template info, since that would make the V8 GC identify them to
+ // the embedder, e.g. the Oilpan GC.
+ USE(is_wasm_object);
return is_api_object;
}
« no previous file with comments | « no previous file | test/mjsunit/asm/regress-740325.js » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698