AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[heap] Fix ArrayBufferTracker processing

Browse Source 
Avoid accessing |byte_length| during processing buffers. The length
might be a HeapNumber that has already been processed (e.g. moved) in
the current garbage collection cycle.

Bug: v8:8076
Change-Id: I6d79631e300845a29f15a9f60933ee41ffc95300
Reviewed-on: https://chromium-review.googlesource.com/1183193
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55256}
This commit is contained in:
Michael Lippautz 2018-08-21 12:06:14 +02:00 committed by Commit Bot
parent dcc09b60ab
commit 8b2cee550c
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/heap/array-buffer-tracker.cc
View File

@ -45,24 +45,25 @@ void LocalArrayBufferTracker::Process(Callback callback) {
tracker = target_page->local_tracker(); tracker = target_page->local_tracker();
} }
DCHECK_NOT_NULL(tracker); DCHECK_NOT_NULL(tracker);
const size_t size = NumberToSize(new_buffer->byte_length()); const size_t length = it->second.length;
// We should decrement before adding to avoid potential overflows in // We should decrement before adding to avoid potential overflows in
// the external memory counters. // the external memory counters.
DCHECK_EQ(it->first->is_wasm_memory(), it->second.is_wasm_memory); DCHECK_EQ(it->first->is_wasm_memory(), it->second.is_wasm_memory);
old_page->DecrementExternalBackingStoreBytes( old_page->DecrementExternalBackingStoreBytes(
ExternalBackingStoreType::kArrayBuffer, it->second.length); ExternalBackingStoreType::kArrayBuffer, length);
tracker->Add(new_buffer, size); tracker->Add(new_buffer, length);
} }
moved_memory += it->second.length; moved_memory += it->second.length;
} else if (result == kRemoveEntry) { } else if (result == kRemoveEntry) {
freed_memory += it->second.length; const size_t length = it->second.length;
freed_memory += length;
// We pass backing_store() and stored length to the collector for freeing // We pass backing_store() and stored length to the collector for freeing
// the backing store. Wasm allocations will go through their own tracker // the backing store. Wasm allocations will go through their own tracker
// based on the backing store. // based on the backing store.
backing_stores_to_free.push_back(it->second); backing_stores_to_free.push_back(it->second);
old_page->DecrementExternalBackingStoreBytes( old_page->DecrementExternalBackingStoreBytes(
ExternalBackingStoreType::kArrayBuffer, it->second.length); ExternalBackingStoreType::kArrayBuffer, length);
} else { } else {
UNREACHABLE(); UNREACHABLE();
} }