[deoptimizer] Stricter checks during deoptimization

schuay · Commit Bot · commit 506e893b812e · 2020-12-31T10:10:39.000Z
.. to verify that the trampoline_pc has been set. Bug: chromium:1161357 Change-Id: If7e1a13cff9919e2e8a65c095d80dfcef2dc05cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2606333 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#71896}
diff --git a/src/deoptimizer/deoptimizer.cc b/src/deoptimizer/deoptimizer.cc
@@ -267,6 +267,7 @@ class ActivationsFinder : public ThreadVisitor {
           SafepointEntry safepoint = code.GetSafepointEntry(it.frame()->pc());
           int trampoline_pc = safepoint.trampoline_pc();
           DCHECK_IMPLIES(code == topmost_, safe_to_deopt_);
+          CHECK_GE(trampoline_pc, 0);
           // Replace the current pc on the stack with the trampoline.
           // TODO(v8:10026): avoid replacing a signed pointer.
           Address* pc_addr = it.frame()->pc_address();
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
@@ -73,6 +73,10 @@
   # https://crbug.com/1129854
   'tools/log': ['arch == arm or arch == arm64', SKIP],
 
+  # crbug.com/1161357
+  # TODO(solanes): Remove this entry once the underlying issue is fixed.
+  'regress/regress-1161357': [PASS, FAIL],
+
   ##############################################################################
   # Tests where variants make no sense.
   'd8/enable-tracing': [PASS, NO_VARIANTS],
diff --git a/test/mjsunit/regress/regress-1161357.js b/test/mjsunit/regress/regress-1161357.js
@@ -0,0 +1,15 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (let i = 0; i < 3; i++) {
+  for (let j = 0; j < 32767; j++) {
+    Number;
+  }
+  for (let j = 0; j < 2335; j++) {
+    Number;
+  }
+  var arr = [, ...(new Int16Array(0xffff)), 4294967296];
+  arr.concat(Number, arr)
+}
+eval(``);
