AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Revert "[runtime] Improve handling of enumeration index on global dictionary"

Browse Source 
This reverts commit 25d16574f8.

Reason for revert: breaks tree with new flakes. See, for example:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/31169
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim/21895
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/8490


Original change's description:
> [runtime] Improve handling of enumeration index on global dictionary
> 
> Bug: chromium:1056054
> Change-Id: Ie1f2da98bc54a2ad5189cbe2ee1686fe1ef7019a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079035
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#66504}

TBR=jkummerow@chromium.org,verwaest@chromium.org,seth.brenith@microsoft.com,victorgomes@chromium.org

Change-Id: I2baa48f6ed2b0b3e23b0d705b6a805d76ee4bb8f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056054
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080653
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66505}
This commit is contained in:
Francis McCabe 2020-02-28 19:28:45 +00:00 committed by Commit Bot
parent 25d16574f8
commit b66e24f0b3
3 changed files with 6 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/objects/objects.cc
View File

@ -7287,9 +7287,10 @@ int BaseNameDictionary<Derived, Shape>::NextEnumerationIndex(
// Check whether the next enumeration index is valid.
if (!PropertyDetails::IsValidIndex(index)) {
// If not, we generate new indices for the properties.
int length = dictionary->NumberOfElements();
Handle<FixedArray> iteration_order = IterationIndices(isolate, dictionary);
int length = iteration_order->length();
DCHECK_LE(length, dictionary->NumberOfElements());
DCHECK_EQ(length, iteration_order->length());
// Iterate over the dictionary using the enumeration order and update
// the dictionary with new enumeration indices.
@ -7533,8 +7534,8 @@ void BaseNameDictionary<Derived, Shape>::CopyEnumKeysTo(
template <typename Derived, typename Shape>
Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
Isolate* isolate, Handle<Derived> dictionary) {
Handle<FixedArray> array =
isolate->factory()->NewFixedArray(dictionary->NumberOfElements());
int length = dictionary->NumberOfElements();
Handle<FixedArray> array = isolate->factory()->NewFixedArray(length);
ReadOnlyRoots roots(isolate);
int array_size = 0;
{
@ -7546,13 +7547,7 @@ Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
array->set(array_size++, Smi::FromInt(i.as_int()));
}
// The global dictionary doesn't track its deletion count, so we may iterate
// fewer entries than the count of elements claimed by the dictionary.
if (std::is_same<Derived, GlobalDictionary>::value) {
DCHECK_LE(array_size, dictionary->NumberOfElements());
} else {
DCHECK_EQ(array_size, dictionary->NumberOfElements());
}
DCHECK_EQ(array_size, length);
EnumIndexComparator<Derived> cmp(raw_dictionary);
// Use AtomicSlot wrapper to ensure that std::sort uses atomic load and

1
test/mjsunit/mjsunit.status
View File

@ -177,7 +177,6 @@
'regress/regress-crbug-217858': [SKIP],
'regress/regress-crbug-808192': [SKIP],
'regress/regress-crbug-941743': [SKIP],
'regress/regress-crbug-1056054': [SKIP],
'regress/regress-create-exception': [SKIP],
# These tests run out of stack space in debug mode.

16
test/mjsunit/regress/regress-crbug-1056054.js
View File

@ -1,16 +0,0 @@
// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function (global) {
var e = [];
for (var i = 0; i < 1e5; ++i) {
e.push('a' + i);
}
for (var j = 0; j < 900; ++j) {
for(var i = 0; i < 1e4; ++i) {
global[e[i]] = j;
delete global[e[i]];
}
}
})(this);