AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Revert "[heap, runtime] Fix data race in prototype map transition during"

Browse Source 
This reverts commit b2d1f27209.

Reason for revert: assertion failure

Original change's description:
> [heap, runtime] Fix data race in prototype map transition during
> concurrent marking.
> 
> BUG=chromium:694255
> 
> Change-Id: I172167623e9deab692fb506d7d4211d210b09a80
> Reviewed-on: https://chromium-review.googlesource.com/579092
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46813}

TBR=ulan@chromium.org,ishell@chromium.org

Change-Id: Ida5c66c3e880b9a03ffacbc6f32b1d5b2cfc8260
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:694255
Reviewed-on: https://chromium-review.googlesource.com/581287
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46815}
This commit is contained in:
Ulan Degenbaev 2017-07-21 10:34:47 +00:00 committed by Commit Bot
parent c179400bdf
commit a9428d527e
2 changed files with 1 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/heap/heap.cc
View File

@ -4522,8 +4522,7 @@ void Heap::NotifyObjectLayoutChange(HeapObject* object,
incremental_marking()->MarkBlackAndPush(object);
}
#ifdef VERIFY_HEAP
DCHECK(pending_layout_change_object_ == nullptr ||
pending_layout_change_object_ == object);
DCHECK(pending_layout_change_object_ == nullptr);
pending_layout_change_object_ = object;
#endif
}

7
src/objects.cc
View File

@ -4129,13 +4129,6 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
// Slow-to-slow migration is trivial.
object->synchronized_set_map(*new_map);
} else if (!new_map->is_dictionary_map()) {
if (old_map->is_prototype_map()) {
DisallowHeapAllocation no_allocation;
// Ensure that the object is marked because its old map is going
// to drop the descriptor array and the layout descriptor, which
// is unsafe for the concurrent marker.
object->GetHeap()->NotifyObjectLayoutChange(*object, no_allocation);
}
MigrateFastToFast(object, new_map);
if (old_map->is_prototype_map()) {
DCHECK(!old_map->is_stable());