Fix a race between concurrent recompilation and OSR.
authorulan@chromium.org <ulan@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Fri, 27 Dec 2013 09:22:56 +0000 (09:22 +0000)
committerulan@chromium.org <ulan@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Fri, 27 Dec 2013 09:22:56 +0000 (09:22 +0000)
commit7ac7a7ea9918914e99961d3066101ee157539687
tree6f2b29aaf1b309af4dcb5131a60a6c2b27c72f0c
parent2566c54f15e9a39617571bd0c0e823baa03582b5
Fix a race between concurrent recompilation and OSR.

If concurrent recompilation finishes before OSR, then OSR replaces
the old optimized code without evicting it from the optimized code map.

New functions can get the old optimized code from the optimized code map,
but the old code could be already deoptimized.

BUG=330046
TEST=test/mjsunit/regress-330046.js
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/109033003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@18420 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/objects-inl.h
test/mjsunit/regress-330046.js [new file with mode: 0644]