[promises] Add Torque checks to guard against a bug we had
Bug: chromium:1105318 Change-Id: I105fc4cfc1b781dc0a481c7bee9faee1923f474f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343071 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#69299}
This commit is contained in:
parent
adaeed6889
commit
4c3cc31cfc
@ -159,6 +159,8 @@ transitioning macro PromiseAllResolveElementClosure<F: type>(
|
||||
values.objects[index] = updatedValue;
|
||||
|
||||
remainingElementsCount = remainingElementsCount - 1;
|
||||
check(remainingElementsCount >= 0);
|
||||
|
||||
*ContextSlot(
|
||||
promiseContext,
|
||||
PromiseAllResolveElementContextSlots::
|
||||
|
@ -276,6 +276,8 @@ Reject(Object) {
|
||||
PromiseAllResolveElementContextSlots::
|
||||
kPromiseAllResolveElementRemainingSlot);
|
||||
|
||||
check(remainingElementsCount >= 0);
|
||||
|
||||
if (remainingElementsCount > 0) {
|
||||
// Pre-allocate the backing store for the {values} to the desired
|
||||
// capacity. We may already have elements in "values" - this happens
|
||||
@ -295,7 +297,6 @@ Reject(Object) {
|
||||
}
|
||||
} else
|
||||
deferred {
|
||||
assert(remainingElementsCount == 0);
|
||||
// If remainingElementsCount.[[Value]] is 0, then
|
||||
// Let valuesArray be CreateArrayFromList(values).
|
||||
// Perform ? Call(resultCapability.[[Resolve]], undefined,
|
||||
|
@ -444,27 +444,27 @@ KNOWN_OBJECTS = {
|
||||
("old_space", 0x02a69): "StringSplitCache",
|
||||
("old_space", 0x02e71): "RegExpMultipleCache",
|
||||
("old_space", 0x03279): "BuiltinsConstantsTable",
|
||||
("old_space", 0x03625): "AsyncFunctionAwaitRejectSharedFun",
|
||||
("old_space", 0x0364d): "AsyncFunctionAwaitResolveSharedFun",
|
||||
("old_space", 0x03675): "AsyncGeneratorAwaitRejectSharedFun",
|
||||
("old_space", 0x0369d): "AsyncGeneratorAwaitResolveSharedFun",
|
||||
("old_space", 0x036c5): "AsyncGeneratorYieldResolveSharedFun",
|
||||
("old_space", 0x036ed): "AsyncGeneratorReturnResolveSharedFun",
|
||||
("old_space", 0x03715): "AsyncGeneratorReturnClosedRejectSharedFun",
|
||||
("old_space", 0x0373d): "AsyncGeneratorReturnClosedResolveSharedFun",
|
||||
("old_space", 0x03765): "AsyncIteratorValueUnwrapSharedFun",
|
||||
("old_space", 0x0378d): "PromiseAllResolveElementSharedFun",
|
||||
("old_space", 0x037b5): "PromiseAllSettledResolveElementSharedFun",
|
||||
("old_space", 0x037dd): "PromiseAllSettledRejectElementSharedFun",
|
||||
("old_space", 0x03805): "PromiseAnyRejectElementSharedFun",
|
||||
("old_space", 0x0382d): "PromiseCapabilityDefaultRejectSharedFun",
|
||||
("old_space", 0x03855): "PromiseCapabilityDefaultResolveSharedFun",
|
||||
("old_space", 0x0387d): "PromiseCatchFinallySharedFun",
|
||||
("old_space", 0x038a5): "PromiseGetCapabilitiesExecutorSharedFun",
|
||||
("old_space", 0x038cd): "PromiseThenFinallySharedFun",
|
||||
("old_space", 0x038f5): "PromiseThrowerFinallySharedFun",
|
||||
("old_space", 0x0391d): "PromiseValueThunkFinallySharedFun",
|
||||
("old_space", 0x03945): "ProxyRevokeSharedFun",
|
||||
("old_space", 0x0362d): "AsyncFunctionAwaitRejectSharedFun",
|
||||
("old_space", 0x03655): "AsyncFunctionAwaitResolveSharedFun",
|
||||
("old_space", 0x0367d): "AsyncGeneratorAwaitRejectSharedFun",
|
||||
("old_space", 0x036a5): "AsyncGeneratorAwaitResolveSharedFun",
|
||||
("old_space", 0x036cd): "AsyncGeneratorYieldResolveSharedFun",
|
||||
("old_space", 0x036f5): "AsyncGeneratorReturnResolveSharedFun",
|
||||
("old_space", 0x0371d): "AsyncGeneratorReturnClosedRejectSharedFun",
|
||||
("old_space", 0x03745): "AsyncGeneratorReturnClosedResolveSharedFun",
|
||||
("old_space", 0x0376d): "AsyncIteratorValueUnwrapSharedFun",
|
||||
("old_space", 0x03795): "PromiseAllResolveElementSharedFun",
|
||||
("old_space", 0x037bd): "PromiseAllSettledResolveElementSharedFun",
|
||||
("old_space", 0x037e5): "PromiseAllSettledRejectElementSharedFun",
|
||||
("old_space", 0x0380d): "PromiseAnyRejectElementSharedFun",
|
||||
("old_space", 0x03835): "PromiseCapabilityDefaultRejectSharedFun",
|
||||
("old_space", 0x0385d): "PromiseCapabilityDefaultResolveSharedFun",
|
||||
("old_space", 0x03885): "PromiseCatchFinallySharedFun",
|
||||
("old_space", 0x038ad): "PromiseGetCapabilitiesExecutorSharedFun",
|
||||
("old_space", 0x038d5): "PromiseThenFinallySharedFun",
|
||||
("old_space", 0x038fd): "PromiseThrowerFinallySharedFun",
|
||||
("old_space", 0x03925): "PromiseValueThunkFinallySharedFun",
|
||||
("old_space", 0x0394d): "ProxyRevokeSharedFun",
|
||||
}
|
||||
|
||||
# Lower 32 bits of first page addresses for various heap spaces.
|
||||
|
Loading…
Reference in New Issue
Block a user