[heap] Fix data race with inobject_properties access in concurrent marker.
The race happens when inobject slack tracking is being completed on the main thread, which decrements inobject_properties. At the same time the concurrent marker is reading inobject_properties via the LayoutDescriptorHelper. BUG=chromium:694255 Change-Id: I4627d66b66c6036d357b9f619e1c602f0bb47d80 Reviewed-on: https://chromium-review.googlesource.com/555210 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#46319}
This commit is contained in:
parent
95a436b271
commit
039849478b
@ -3213,15 +3213,16 @@ int Map::instance_size() {
|
||||
|
||||
|
||||
int Map::inobject_properties_or_constructor_function_index() {
|
||||
return READ_BYTE_FIELD(this,
|
||||
kInObjectPropertiesOrConstructorFunctionIndexOffset);
|
||||
return RELAXED_READ_BYTE_FIELD(
|
||||
this, kInObjectPropertiesOrConstructorFunctionIndexOffset);
|
||||
}
|
||||
|
||||
|
||||
void Map::set_inobject_properties_or_constructor_function_index(int value) {
|
||||
DCHECK(0 <= value && value < 256);
|
||||
WRITE_BYTE_FIELD(this, kInObjectPropertiesOrConstructorFunctionIndexOffset,
|
||||
static_cast<byte>(value));
|
||||
RELAXED_WRITE_BYTE_FIELD(this,
|
||||
kInObjectPropertiesOrConstructorFunctionIndexOffset,
|
||||
static_cast<byte>(value));
|
||||
}
|
||||
|
||||
|
||||
|
@ -11914,6 +11914,7 @@ static void ShrinkInstanceSize(Map* map, void* data) {
|
||||
int old_visitor_id = Heap::GetStaticVisitorIdForMap(map);
|
||||
#endif
|
||||
int slack = *reinterpret_cast<int*>(data);
|
||||
DCHECK_GE(slack, 0);
|
||||
map->SetInObjectProperties(map->GetInObjectProperties() - slack);
|
||||
map->set_unused_property_fields(map->unused_property_fields() - slack);
|
||||
map->set_instance_size(map->instance_size() - slack * kPointerSize);
|
||||
|
Loading…
Reference in New Issue
Block a user