AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Reland "[heap, runtime] Fix data race in prototype map transition during"

Browse Source 
This reverts commit a9428d527e.

Original change's description:
 > [heap, runtime] Fix data race in prototype map transition during
 > concurrent marking.
 >
 > BUG=chromium:694255
 >
 > Change-Id: I172167623e9deab692fb506d7d4211d210b09a80
 > Reviewed-on: https://chromium-review.googlesource.com/579092
 > Reviewed-by: Igor Sheludko <ishell@chromium.org>
 > Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
 > Cr-Commit-Position: refs/heads/master@{#46813}

Change-Id: Ib4b4b989620800ce8a4f4247e4dae2a88c186be9
Reviewed-on: https://chromium-review.googlesource.com/581194
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46819}
This commit is contained in:
Ulan Degenbaev 2017-07-21 14:11:11 +02:00 committed by Commit Bot
parent 99248f4d86
commit d8846ffd5f
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/objects.cc
View File

@ -4131,6 +4131,11 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
} else if (!new_map->is_dictionary_map()) {
MigrateFastToFast(object, new_map);
if (old_map->is_prototype_map()) {
DisallowHeapAllocation no_allocation;
// Ensure that the object is marked because its old map is going
// to drop the descriptor array and the layout descriptor, which
// is unsafe for the concurrent marker.
object->GetHeap()->NotifyObjectLayoutChange(*object, no_allocation);
DCHECK(!old_map->is_stable());
DCHECK(new_map->is_stable());
// Clear out the old descriptor array to avoid problems to sharing
@ -4142,6 +4147,11 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
DCHECK_EQ(
0, TransitionArray::NumberOfTransitions(old_map->raw_transitions()));
DCHECK(new_map->GetBackPointer()->IsUndefined(new_map->GetIsolate()));
#ifdef VERIFY_HEAP
// When verify heap is on, NotifyObjectLayoutChange checks that
// it is followed by VerifyObjectLayoutChange after the map change.
object->GetHeap()->VerifyObjectLayoutChange(*object, *new_map);
#endif
}
} else {
MigrateFastToSlow(object, new_map, expected_additional_properties);