@@ -3222,7 +3222,8 @@ int TranslatedState::CreateNextTranslatedValue(
3222
3222
FATAL (" We should never get here - unexpected deopt info." );
3223
3223
}
3224
3224
3225
- TranslatedState::TranslatedState (const JavaScriptFrame* frame) {
3225
+ TranslatedState::TranslatedState (const JavaScriptFrame* frame)
3226
+ : purpose_(kFrameInspection ) {
3226
3227
int deopt_index = Safepoint::kNoDeoptimizationIndex ;
3227
3228
DeoptimizationData* data =
3228
3229
static_cast <const OptimizedFrame*>(frame)->GetDeoptimizationData (
@@ -3596,25 +3597,63 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
3596
3597
}
3597
3598
3598
3599
default :
3599
- CHECK (map->IsJSObjectMap ());
3600
3600
EnsureJSObjectAllocated (slot, map);
3601
- TranslatedValue* properties_slot = &(frame->values_ [value_index]);
3602
- value_index++;
3601
+ int remaining_children_count = slot->GetChildrenCount () - 1 ;
3602
+
3603
+ TranslatedValue* properties_slot = frame->ValueAt (value_index);
3604
+ value_index++, remaining_children_count--;
3603
3605
if (properties_slot->kind () == TranslatedValue::kCapturedObject ) {
3604
- // If we are materializing the property array, make sure we put
3605
- // the mutable heap numbers at the right places.
3606
+ // We are materializing the property array, so make sure we put the
3607
+ // mutable heap numbers at the right places.
3606
3608
EnsurePropertiesAllocatedAndMarked (properties_slot, map);
3607
3609
EnsureChildrenAllocated (properties_slot->GetChildrenCount (), frame,
3608
3610
&value_index, worklist);
3611
+ } else {
3612
+ CHECK_EQ (properties_slot->kind (), TranslatedValue::kTagged );
3609
3613
}
3610
- // Make sure all the remaining children (after the map and properties) are
3611
- // allocated.
3612
- return EnsureChildrenAllocated (slot->GetChildrenCount () - 2 , frame,
3614
+
3615
+ TranslatedValue* elements_slot = frame->ValueAt (value_index);
3616
+ value_index++, remaining_children_count--;
3617
+ if (elements_slot->kind () == TranslatedValue::kCapturedObject ||
3618
+ !map->IsJSArrayMap ()) {
3619
+ // Handle this case with the other remaining children below.
3620
+ value_index--, remaining_children_count++;
3621
+ } else {
3622
+ CHECK_EQ (elements_slot->kind (), TranslatedValue::kTagged );
3623
+ elements_slot->GetValue ();
3624
+ if (purpose_ == kFrameInspection ) {
3625
+ // We are materializing a JSArray for the purpose of frame inspection.
3626
+ // If we were to construct it with the above elements value then an
3627
+ // actual deopt later on might create another JSArray instance with
3628
+ // the same elements store. That would violate the key assumption
3629
+ // behind left-trimming.
3630
+ elements_slot->ReplaceElementsArrayWithCopy ();
3631
+ }
3632
+ }
3633
+
3634
+ // Make sure all the remaining children (after the map, properties store,
3635
+ // and possibly elements store) are allocated.
3636
+ return EnsureChildrenAllocated (remaining_children_count, frame,
3613
3637
&value_index, worklist);
3614
3638
}
3615
3639
UNREACHABLE ();
3616
3640
}
3617
3641
3642
+ void TranslatedValue::ReplaceElementsArrayWithCopy () {
3643
+ DCHECK_EQ (kind (), TranslatedValue::kTagged );
3644
+ DCHECK_EQ (materialization_state (), TranslatedValue::kFinished );
3645
+ auto elements = Handle <FixedArrayBase>::cast (GetValue ());
3646
+ DCHECK (elements->IsFixedArray () || elements->IsFixedDoubleArray ());
3647
+ if (elements->IsFixedDoubleArray ()) {
3648
+ DCHECK (!elements->IsCowArray ());
3649
+ set_storage (isolate ()->factory ()->CopyFixedDoubleArray (
3650
+ Handle <FixedDoubleArray>::cast (elements)));
3651
+ } else if (!elements->IsCowArray ()) {
3652
+ set_storage (isolate ()->factory ()->CopyFixedArray (
3653
+ Handle <FixedArray>::cast (elements)));
3654
+ }
3655
+ }
3656
+
3618
3657
void TranslatedState::EnsureChildrenAllocated (int count, TranslatedFrame* frame,
3619
3658
int * value_index,
3620
3659
std::stack<int >* worklist) {
@@ -3680,6 +3719,7 @@ Handle<ByteArray> TranslatedState::AllocateStorageFor(TranslatedValue* slot) {
3680
3719
3681
3720
void TranslatedState::EnsureJSObjectAllocated (TranslatedValue* slot,
3682
3721
Handle <Map> map) {
3722
+ CHECK (map->IsJSObjectMap ());
3683
3723
CHECK_EQ (map->instance_size (), slot->GetChildrenCount () * kPointerSize );
3684
3724
3685
3725
Handle <ByteArray> object_storage = AllocateStorageFor (slot);
0 commit comments