From bb13e7f7468a5b92022d98be7086b5abf2533359 Mon Sep 17 00:00:00 2001
From: jarin <jarin@chromium.org>
Date: Thu, 26 Feb 2015 00:36:49 -0800
Subject: [PATCH] Do not touch a binary op IC target in code object marked for
 lazy deopt.

Bad scenario:

- Enter a binop IC miss handler from optimized code object C from call
  site S,

- From the binop IC, invoke arbitrary javascript that lazy deopts C,
  so all relocation info is nuked and replaced with lazy deopt entries'
  reloc info. In particular, there is no reloc info for S.

- Still from the arbitrary JavaScript, make IC target's code object move.
  Note that the call site S is not updated.

- Return to the miss handler and inspect the IC's target. This will try
  to get the target from S, but that is a potentially invalid pointer.

It is quite possible that we will have to do a similar fix for other ICs,
but we will have to find a reliable repro first. I am not submitting a
repro here because it is quite long running and brittle (it
relies on code compaction happening while in the binop IC).

BUG=v8:3910
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/958473004

Cr-Commit-Position: refs/heads/master@{#26872}
---
 src/ic/ic.cc | 16 ++++++++++++++++
 src/ic/ic.h  |  1 +
 2 files changed, 17 insertions(+)

diff --git a/src/ic/ic.cc b/src/ic/ic.cc
index 0d40ea6..97f7a76 100644
--- a/src/ic/ic.cc
+++ b/src/ic/ic.cc
@@ -230,6 +230,14 @@ bool IC::AddressIsOptimizedCode() const {
 }
 
 
+bool IC::AddressIsDeoptimizedCode() const {
+  Code* host =
+      isolate()->inner_pointer_to_code_cache()->GetCacheEntry(address())->code;
+  return host->kind() == Code::OPTIMIZED_FUNCTION &&
+         host->marked_for_deoptimization();
+}
+
+
 static void LookupForRead(LookupIterator* it) {
   for (; it->IsFound(); it->Next()) {
     switch (it->state()) {
@@ -2516,9 +2524,17 @@ MaybeHandle<Object> BinaryOpIC::Transition(
       isolate(), result, Execution::Call(isolate(), function, left, 1, &right),
       Object);
 
+  // Do not try to update the target if the code was marked for lazy
+  // deoptimization. (Since we do not relocate addresses in these
+  // code objects, an attempt to access the target could fail.)
+  if (AddressIsDeoptimizedCode()) {
+    return result;
+  }
+
   // Execution::Call can execute arbitrary JavaScript, hence potentially
   // update the state of this very IC, so we must update the stored state.
   UpdateTarget();
+
   // Compute the new state.
   BinaryOpICState old_state(isolate(), target()->extra_ic_state());
   state.Update(left, right, result);
diff --git a/src/ic/ic.h b/src/ic/ic.h
index 3025f72..f12b5bd 100644
--- a/src/ic/ic.h
+++ b/src/ic/ic.h
@@ -134,6 +134,7 @@ class IC {
   Code* GetOriginalCode() const;
 
   bool AddressIsOptimizedCode() const;
+  bool AddressIsDeoptimizedCode() const;
 
   // Set the call-site target.
   inline void set_target(Code* code);
-- 
2.7.4