OLD | NEW |
---|---|
1 // Copyright 2013 the V8 project authors. All rights reserved. | 1 // Copyright 2014 the V8 project authors. All rights reserved. |
2 // Redistribution and use in source and binary forms, with or without | 2 // Redistribution and use in source and binary forms, with or without |
3 // modification, are permitted provided that the following conditions are | 3 // modification, are permitted provided that the following conditions are |
4 // met: | 4 // met: |
5 // | 5 // |
6 // * Redistributions of source code must retain the above copyright | 6 // * Redistributions of source code must retain the above copyright |
7 // notice, this list of conditions and the following disclaimer. | 7 // notice, this list of conditions and the following disclaimer. |
8 // * Redistributions in binary form must reproduce the above | 8 // * Redistributions in binary form must reproduce the above |
9 // copyright notice, this list of conditions and the following | 9 // copyright notice, this list of conditions and the following |
10 // disclaimer in the documentation and/or other materials provided | 10 // disclaimer in the documentation and/or other materials provided |
11 // with the distribution. | 11 // with the distribution. |
12 // * Neither the name of Google Inc. nor the names of its | 12 // * Neither the name of Google Inc. nor the names of its |
13 // contributors may be used to endorse or promote products derived | 13 // contributors may be used to endorse or promote products derived |
14 // from this software without specific prior written permission. | 14 // from this software without specific prior written permission. |
15 // | 15 // |
16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | 16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | 17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | 18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
19 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | 19 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
20 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | 20 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
21 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | 21 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
22 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | 22 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
23 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | 23 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
24 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | 24 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
25 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | 25 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
26 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 26 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
27 | 27 |
28 // Flags: --expose-debug-as debug --allow-natives-syntax | 28 // Flags: --expose-debug-as debug --allow-natives-syntax |
29 | 29 |
30 Debug = debug.Debug; | 30 Debug = debug.Debug; |
31 var listened = false; | |
32 | 31 |
33 function listener(event, exec_state, event_data, data) { | 32 function dummy(x) { |
34 if (event == Debug.DebugEvent.Exception) { | 33 return x + 100; |
35 for (var i = 0; i < exec_state.frameCount(); i++) { | 34 } |
36 print(exec_state.frame(i).receiver()); | 35 |
37 print(exec_state.frame(i).func().name()); | 36 function create_closure() { |
37 return function(arg) { | |
38 if (arg === true) { | |
Toon Verwaest
2014/07/29 11:28:18
if (arg) { %DeoptimizeFunction(function); }
| |
39 // Do something that causes a deopt. We'd like to run the newly compiled | |
40 // full code for the Array statement below. Soft deopt: | |
41 dummy(); | |
42 } | |
43 var a = Array(10); | |
44 for (var i = 0; i < a.length; i++) { | |
45 a[i] = i; | |
38 } | 46 } |
39 } | 47 } |
40 listened = true; | |
41 } | 48 } |
42 | 49 |
43 Debug.setListener(listener); | 50 var c = create_closure(); |
44 Debug.setBreakOnException(); | 51 c(); |
45 | 52 |
46 assertThrows(function() { delete null['foo']; }); | 53 // c CallIC state now has custom Array handler installed. |
47 | 54 |
48 Debug.clearBreakOnException(); | 55 // Turn on the debugger. |
49 Debug.setListener(null); | 56 Debug.setListener(function () {}); |
50 | 57 |
51 assertTrue(listened); | 58 var d = create_closure(); |
59 %OptimizeFunctionOnNextCall(d); | |
60 // Thanks to the debugger, we recreate the full code too. We deopt and run | |
61 // it, stomping on the unexpected AllocationSite in the type vector slot. | |
62 d(true); | |
63 | |
64 // CallIC in c misinterprets type vector slot contents as an AllocationSite, | |
65 // corrupting the heap. | |
66 c(); | |
67 | |
68 // CallIC MISS - crash due to corruption. | |
69 dummy(); | |
OLD | NEW |