AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[promises] Add Torque checks to guard against a bug we had

Browse Source 
Bug: chromium:1105318
Change-Id: I105fc4cfc1b781dc0a481c7bee9faee1923f474f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343071
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69299}
This commit is contained in:
Marja Hölttä 2020-08-10 08:57:43 +02:00 committed by Commit Bot
parent adaeed6889
commit 4c3cc31cfc
3 changed files with 25 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/builtins/promise-all-element-closure.tq
View File

@ -159,6 +159,8 @@ transitioning macro PromiseAllResolveElementClosure<F: type>(
values.objects[index] = updatedValue;
remainingElementsCount = remainingElementsCount - 1;
check(remainingElementsCount >= 0);
*ContextSlot(
promiseContext,
PromiseAllResolveElementContextSlots::

3
src/builtins/promise-all.tq
View File

@ -276,6 +276,8 @@ Reject(Object) {
PromiseAllResolveElementContextSlots::
kPromiseAllResolveElementRemainingSlot);
check(remainingElementsCount >= 0);
if (remainingElementsCount > 0) {
// Pre-allocate the backing store for the {values} to the desired
// capacity. We may already have elements in "values" - this happens
@ -295,7 +297,6 @@ Reject(Object) {
}
} else
deferred {
assert(remainingElementsCount == 0);
// If remainingElementsCount.[[Value]] is 0, then
// Let valuesArray be CreateArrayFromList(values).
// Perform ? Call(resultCapability.[[Resolve]], undefined,

42
tools/v8heapconst.py
View File

@ -444,27 +444,27 @@ KNOWN_OBJECTS = {
("old_space", 0x02a69): "StringSplitCache",
("old_space", 0x02e71): "RegExpMultipleCache",
("old_space", 0x03279): "BuiltinsConstantsTable",
("old_space", 0x03625): "AsyncFunctionAwaitRejectSharedFun",
("old_space", 0x0364d): "AsyncFunctionAwaitResolveSharedFun",
("old_space", 0x03675): "AsyncGeneratorAwaitRejectSharedFun",
("old_space", 0x0369d): "AsyncGeneratorAwaitResolveSharedFun",
("old_space", 0x036c5): "AsyncGeneratorYieldResolveSharedFun",
("old_space", 0x036ed): "AsyncGeneratorReturnResolveSharedFun",
("old_space", 0x03715): "AsyncGeneratorReturnClosedRejectSharedFun",
("old_space", 0x0373d): "AsyncGeneratorReturnClosedResolveSharedFun",
("old_space", 0x03765): "AsyncIteratorValueUnwrapSharedFun",
("old_space", 0x0378d): "PromiseAllResolveElementSharedFun",
("old_space", 0x037b5): "PromiseAllSettledResolveElementSharedFun",
("old_space", 0x037dd): "PromiseAllSettledRejectElementSharedFun",
("old_space", 0x03805): "PromiseAnyRejectElementSharedFun",
("old_space", 0x0382d): "PromiseCapabilityDefaultRejectSharedFun",
("old_space", 0x03855): "PromiseCapabilityDefaultResolveSharedFun",
("old_space", 0x0387d): "PromiseCatchFinallySharedFun",
("old_space", 0x038a5): "PromiseGetCapabilitiesExecutorSharedFun",
("old_space", 0x038cd): "PromiseThenFinallySharedFun",
("old_space", 0x038f5): "PromiseThrowerFinallySharedFun",
("old_space", 0x0391d): "PromiseValueThunkFinallySharedFun",
("old_space", 0x03945): "ProxyRevokeSharedFun",
("old_space", 0x0362d): "AsyncFunctionAwaitRejectSharedFun",
("old_space", 0x03655): "AsyncFunctionAwaitResolveSharedFun",
("old_space", 0x0367d): "AsyncGeneratorAwaitRejectSharedFun",
("old_space", 0x036a5): "AsyncGeneratorAwaitResolveSharedFun",
("old_space", 0x036cd): "AsyncGeneratorYieldResolveSharedFun",
("old_space", 0x036f5): "AsyncGeneratorReturnResolveSharedFun",
("old_space", 0x0371d): "AsyncGeneratorReturnClosedRejectSharedFun",
("old_space", 0x03745): "AsyncGeneratorReturnClosedResolveSharedFun",
("old_space", 0x0376d): "AsyncIteratorValueUnwrapSharedFun",
("old_space", 0x03795): "PromiseAllResolveElementSharedFun",
("old_space", 0x037bd): "PromiseAllSettledResolveElementSharedFun",
("old_space", 0x037e5): "PromiseAllSettledRejectElementSharedFun",
("old_space", 0x0380d): "PromiseAnyRejectElementSharedFun",
("old_space", 0x03835): "PromiseCapabilityDefaultRejectSharedFun",
("old_space", 0x0385d): "PromiseCapabilityDefaultResolveSharedFun",
("old_space", 0x03885): "PromiseCatchFinallySharedFun",
("old_space", 0x038ad): "PromiseGetCapabilitiesExecutorSharedFun",
("old_space", 0x038d5): "PromiseThenFinallySharedFun",
("old_space", 0x038fd): "PromiseThrowerFinallySharedFun",
("old_space", 0x03925): "PromiseValueThunkFinallySharedFun",
("old_space", 0x0394d): "ProxyRevokeSharedFun",
}
# Lower 32 bits of first page addresses for various heap spaces.