| [x64][deopt] Zap code objects marked for lazy deopt The identification of code objects that should be deoptimized and the actual deoptimization happen at different points in time. It can therefore happen that deoptimization does not happen even though a code object is marked for deoptimization. With this CL, code objects on x64 get zapped with int3 the moment they are marked for deoptimization. Therefore, if for whatever reason deoptimization fails later, execution of that code object cannot continue, as it will cause a crash immediately. Bug: 422364570, 422951610 Change-Id: I93c31cafd24014f8a53b961ee7b78d3da7ef2af7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6624355 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100968} | 1 年前 |