AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[test] Fix TypedArray::sort for multi-mapped mock allocator

Browse Source 
Turns out std::sort() gets angry when various ranges of an array
alias each other in memory. We wouldn't like it when it's angry.

Fixed: chromium:1209152
Change-Id: Ic927b46c59d10f7d3856768628c773b344005979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897098
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74598}
This commit is contained in:
Jakob Kummerow 2021-05-15 00:31:30 +02:00 committed by V8 LUCI CQ
parent 243665c696
commit 7e6bb868cc
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/runtime/runtime-typedarray.cc
View File

@ -94,6 +94,14 @@ RUNTIME_FUNCTION(Runtime_TypedArraySortFast) {
CONVERT_ARG_HANDLE_CHECKED(JSTypedArray, array, 0);
DCHECK(!array->WasDetached());
#if V8_OS_LINUX
if (FLAG_multi_mapped_mock_allocator) {
// Sorting is meaningless with the mock allocator, and std::sort
// might crash (because aliasing elements violate its assumptions).
return *array;
}
#endif
size_t length = array->length();
DCHECK_LT(1, length);

13
test/mjsunit/regress/regress-crbug-1209152.js Normal file
View File

@ -0,0 +1,13 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --multi-mapped-mock-allocator
let size = 8 * 1024 * 1024;
let initialized = 2 * 1024 * 1008;
let array = new Uint8Array(size);
for (let i = 0; i < initialized; i++) {
array[i] = 42;
}
array.sort();