AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[*] Im fucking retarded. (potentially?) resolve (one of many?) critical issues with spurious dereferences found under the mark pass of GC.

Browse Source 
This was seemingly less of an issue under older v8 for whatever reason. Could be how old AuRuntimeV8 managed threads and reimplementation of the gc-extension, dunno. Either way, this is fucked.

This modified torque object had not had its new members initialized under a no-gc scope of the factory.

Last aurora commit: f4b0ec56
Fixes a regression that happed somewhere unknown given the changes introduced in the, "speed glorious speed" commit: f86bf4d7
This commit is contained in:
Reece Wilson 2023-02-08 18:00:32 +00:00
parent f4b0ec560b
commit b8f6b544b0
2 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/heap/factory.cc
View File

@ -2086,6 +2086,7 @@ Map Factory::InitializeMap(Map map, InstanceType type, int instance_size,
map.SetInstanceDescriptors(isolate(), ro_roots.empty_descriptor_array(), 0); map.SetInstanceDescriptors(isolate(), ro_roots.empty_descriptor_array(), 0);
// Must be called only after |instance_type| and |instance_size| are set. // Must be called only after |instance_type| and |instance_size| are set.
map.set_visitor_id(Map::GetVisitorId(map)); map.set_visitor_id(Map::GetVisitorId(map));
map.set_cached_property_handler(*undefined_value());
DCHECK(!map.is_in_retained_map_list()); DCHECK(!map.is_in_retained_map_list());
map.clear_padding(); map.clear_padding();
map.set_elements_kind(elements_kind); map.set_elements_kind(elements_kind);

1
src/objects/map.tq
View File

@ -69,7 +69,6 @@ extern class Map extends HeapObject {
@ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void; @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
cached_property_handler: InterceptorInfo|Undefined; cached_property_handler: InterceptorInfo|Undefined;
pad: Undefined;
prototype: JSReceiver|Null; prototype: JSReceiver|Null;
constructor_or_back_pointer_or_native_context: Object; constructor_or_back_pointer_or_native_context: Object;