AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[baseline] Fix race between baseline compiler and GC on page flags

Browse Source 
We need to create the CodePageCollectionMemoryModificationScope *after*
setting up the LocalIsolate. Otherwise the destructor of that scope will
run after that thread detached from the isolate, when it isn't part of
the next GC safepoint anymore. This allows two concurrent operations
on the page flags:

1) The destructor of CodePageCollectionMemoryModificationScope protects
   the page again and accesses page flags in a DCHECK.
2) The GC unprotects the code pages for the collection and sets the
   the evacuation candidate flag.

Bug: chromium:1295738
Change-Id: I6de626bb075f43e26d74dba18e28fe34331fdfd2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3451714
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79025}
This commit is contained in:
Dominik Inführ 2022-02-10 08:54:20 +01:00 committed by V8 LUCI CQ
parent ed04f49fd1
commit 911f6f0365
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/baseline/baseline-batch-compiler.cc
View File

@ -152,12 +152,14 @@ class ConcurrentBaselineCompiler {
outgoing_queue_(outcoming_queue) {}
void Run(JobDelegate* delegate) override {
// Since we're going to compile an entire batch, this guarantees that
// we only switch back the memory chunks to RX at the end.
CodePageCollectionMemoryModificationScope batch_alloc(isolate_->heap());
LocalIsolate local_isolate(isolate_, ThreadKind::kBackground);
UnparkedScope unparked_scope(&local_isolate);
LocalHandleScope handle_scope(&local_isolate);
// Since we're going to compile an entire batch, this guarantees that
// we only switch back the memory chunks to RX at the end.
CodePageCollectionMemoryModificationScope batch_alloc(isolate_->heap());
while (!incoming_queue_->IsEmpty() && !delegate->ShouldYield()) {
std::unique_ptr<BaselineBatchCompilerJob> job;
if (!incoming_queue_->Dequeue(&job)) break;