AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[heap] Fix data race with inobject_properties access in concurrent marker.

Browse Source 
The race happens when inobject slack tracking is being completed on the
main thread, which decrements inobject_properties. At the same time
the concurrent marker is reading inobject_properties via the
LayoutDescriptorHelper.

BUG=chromium:694255

Change-Id: I4627d66b66c6036d357b9f619e1c602f0bb47d80
Reviewed-on: https://chromium-review.googlesource.com/555210
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46319}
This commit is contained in:
Ulan Degenbaev 2017-06-29 14:01:02 +02:00 committed by Commit Bot
parent 95a436b271
commit 039849478b
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/objects-inl.h
View File

@ -3213,15 +3213,16 @@ int Map::instance_size() {
int Map::inobject_properties_or_constructor_function_index() {
return READ_BYTE_FIELD(this,
kInObjectPropertiesOrConstructorFunctionIndexOffset);
return RELAXED_READ_BYTE_FIELD(
this, kInObjectPropertiesOrConstructorFunctionIndexOffset);
}
void Map::set_inobject_properties_or_constructor_function_index(int value) {
DCHECK(0 <= value && value < 256);
WRITE_BYTE_FIELD(this, kInObjectPropertiesOrConstructorFunctionIndexOffset,
static_cast<byte>(value));
RELAXED_WRITE_BYTE_FIELD(this,
kInObjectPropertiesOrConstructorFunctionIndexOffset,
static_cast<byte>(value));
}

1
src/objects.cc
View File

@ -11914,6 +11914,7 @@ static void ShrinkInstanceSize(Map* map, void* data) {
int old_visitor_id = Heap::GetStaticVisitorIdForMap(map);
#endif
int slack = *reinterpret_cast<int*>(data);
DCHECK_GE(slack, 0);
map->SetInObjectProperties(map->GetInObjectProperties() - slack);
map->set_unused_property_fields(map->unused_property_fields() - slack);
map->set_instance_size(map->instance_size() - slack * kPointerSize);