AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix filtering of store buffer for large object pages.

Browse Source 
Our Heap::FreeQueuedChunks generates fake inner chunks in large object
pages queued for freeing, so that StoreBuffer::Filter can recognize them
as pages to be freed. This also relies on MemoryChunk::Contains to work
properly, which is why the size field needs to be initialized as well.

R=vegorov@chromium.org
BUG=v8:1817
TEST=mozilla/js1_5/Regress/regress-360969-05

Review URL: http://codereview.chromium.org/8536009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9964 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2011-11-11 09:45:12 +00:00
parent 58870fa9e5
commit 9dcf002f31
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/heap.cc
View File

@ -6434,8 +6434,8 @@ void Heap::FreeQueuedChunks() {
// it try to perform a search in the list of pages owned by of the large
// object space and queued chunks were detached from that list.
// To work around this we split large chunk into normal kPageSize aligned
// pieces and initialize owner field and flags of every piece.
// If FromAnyPointerAddress encounteres a slot that belongs to one of
// pieces and initialize size, owner and flags field of every piece.
// If FromAnyPointerAddress encounters a slot that belongs to one of
// these smaller pieces it will treat it as a slot on a normal Page.
MemoryChunk* inner = MemoryChunk::FromAddress(
chunk->address() + Page::kPageSize);
@ -6443,8 +6443,9 @@ void Heap::FreeQueuedChunks() {
chunk->address() + chunk->size() - 1);
while (inner <= inner_last) {
// Size of a large chunk is always a multiple of
// OS::AllocationAlignment() so there is always
// MemoryChunk::kAlignment so there is always
// enough space for a fake MemoryChunk header.
inner->set_size(Page::kPageSize);
inner->set_owner(lo_space());
inner->SetFlag(MemoryChunk::ABOUT_TO_BE_FREED);
inner = MemoryChunk::FromAddress(

4
src/spaces.h
View File

@ -504,6 +504,10 @@ class MemoryChunk {
size_t size() const { return size_; }
void set_size(size_t size) {
size_ = size;
}
Executability executable() {
return IsFlagSet(IS_EXECUTABLE) ? EXECUTABLE : NOT_EXECUTABLE;
}

4
test/mozilla/mozilla.status
View File

@ -48,10 +48,6 @@ def FAIL_OK = FAIL, OKAY
##################### SKIPPED TESTS #####################
# Skip one test until we figure out what is causing the regression.
# http://code.google.com/p/v8/issues/detail?id=1817
js1_5/Regress/regress-360969-05: SKIP
# This test checks that we behave properly in an out-of-memory
# situation. The test fails in V8 with an exception and takes a long
# time to do so.