3f4e9bbe43
This is a reland ofc4a062a958
which was a reland of28a30c578c
which was a reland of5d7a29c90e
Fixes TSAN errors from non-atomic writes in the deserializer. Now all writes are (relaxed) atomic. Original change's description: > Reland^2 "[serializer] Allocate during deserialization" > > This is a reland of28a30c578c
> which was a reland of5d7a29c90e
> > The crashes were from calling RegisterDeserializerFinished on a null > Isolate pointer, for a deserializer that was never initialised > (specifically, ReadOnlyDeserializer when ROHeap is shared). > > Original change's description: > > Reland "[serializer] Allocate during deserialization" > > > > This is a reland of5d7a29c90e
> > > > This reland shuffles around the order of checks in Heap::AllocateRawWith > > to not check the new space addresses until it's known that this is a new > > space allocation. This fixes an UBSan failure during read-only space > > deserialization, which happens before the new space is initialized. > > > > It also fixes some issues discovered by --stress-snapshot, around > > serializing ThinStrings (which are now elided as part of serialization), > > handle counts (I bumped the maximum handle count in that check), and > > clearing map transitions (the map backpointer field needed a Smi > > uninitialized value check). > > > > Original change's description: > > > [serializer] Allocate during deserialization > > > > > > This patch removes the concept of reservations and a specialized > > > deserializer allocator, and instead makes the deserializer allocate > > > directly with the Heap's Allocate method. > > > > > > The major consequence of this is that the GC can now run during > > > deserialization, which means that: > > > > > > a) Deserialized objects are visible to the GC, and > > > b) Objects that the deserializer/deserialized objects point to can > > > move. > > > > > > Point a) is mostly not a problem due to previous work in making > > > deserialized objects "GC valid", i.e. making sure that they have a valid > > > size before any subsequent allocation/safepoint. We now additionally > > > have to initialize the allocated space with a valid tagged value -- this > > > is a magic Smi value to keep "uninitialized" checks simple. > > > > > > Point b) is solved by Handlifying the deserializer. This involves > > > changing any vectors of objects into vectors of Handles, and any object > > > keyed map into an IdentityMap (we can't use Handles as keys because > > > the object's address is no longer a stable hash). > > > > > > Back-references can no longer be direct chunk offsets, so instead the > > > deserializer stores a Handle to each deserialized object, and the > > > backreference is an index into this handle array. This encoding could > > > be optimized in the future with e.g. a second pass over the serialized > > > array which emits a different bytecode for objects that are and aren't > > > back-referenced. > > > > > > Additionally, the slot-walk over objects to initialize them can no > > > longer use absolute slot offsets, as again an object may move and its > > > slot address would become invalid. Now, slots are walked as relative > > > offsets to a Handle to the object, or as absolute slots for the case of > > > root pointers. A concept of "slot accessor" is introduced to share the > > > code between these two modes, and writing the slot (including write > > > barriers) is abstracted into this accessor. > > > > > > Finally, the Code body walk is modified to deserialize all objects > > > referred to by RelocInfos before doing the RelocInfo walk itself. This > > > is because RelocInfoIterator uses raw pointers, so we cannot allocate > > > during a RelocInfo walk. > > > > > > As a drive-by, the VariableRawData bytecode is tweaked to use tagged > > > size rather than byte size -- the size is expected to be tagged-aligned > > > anyway, so now we get an extra few bits in the size encoding. > > > > > > Bug: chromium:1075999 > > > Change-Id: I672c42f553f2669888cc5e35d692c1b8ece1845e > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404451 > > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > > Cr-Commit-Position: refs/heads/master@{#70229} > > > > Bug: chromium:1075999 > > Change-Id: Ibc77cc48b3440b4a28b09746cfc47e50c340ce54 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440828 > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#70267} > > Tbr: jgruber@chromium.org,ulan@chromium.org > Bug: chromium:1075999 > Change-Id: Iaa8dc54895866ada0e34a7c9e8fff9ae1cb13f2d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2444991 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70279} Tbr: jgruber@chromium.org,ulan@chromium.org Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng,v8_linux64_tsan_no_cm_rel_ng,v8_linux64_tsan_isolates_rel_ng Bug: chromium:1075999 Change-Id: I0b9b11644aebc4cc8b07c62a0f765b24e4d73d89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2445872 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#70288}
182 lines
7.2 KiB
C++
182 lines
7.2 KiB
C++
// Copyright 2012 the V8 project authors. All rights reserved.
|
|
// Redistribution and use in source and binary forms, with or without
|
|
// modification, are permitted provided that the following conditions are
|
|
// met:
|
|
//
|
|
// * Redistributions of source code must retain the above copyright
|
|
// notice, this list of conditions and the following disclaimer.
|
|
// * Redistributions in binary form must reproduce the above
|
|
// copyright notice, this list of conditions and the following
|
|
// disclaimer in the documentation and/or other materials provided
|
|
// with the distribution.
|
|
// * Neither the name of Google Inc. nor the names of its
|
|
// contributors may be used to endorse or promote products derived
|
|
// from this software without specific prior written permission.
|
|
//
|
|
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
|
|
// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
|
|
// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
|
|
// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
#include "src/init/v8.h"
|
|
#include "test/cctest/cctest.h"
|
|
|
|
#include "src/api/api-inl.h"
|
|
#include "src/builtins/accessors.h"
|
|
#include "src/heap/heap-inl.h"
|
|
#include "src/objects/api-callbacks.h"
|
|
#include "src/objects/objects-inl.h"
|
|
#include "src/objects/property.h"
|
|
#include "test/cctest/heap/heap-tester.h"
|
|
#include "test/cctest/heap/heap-utils.h"
|
|
|
|
namespace v8 {
|
|
namespace internal {
|
|
namespace heap {
|
|
|
|
Handle<Object> HeapTester::TestAllocateAfterFailures() {
|
|
// Similar to what the factory's retrying logic does in the last-resort case,
|
|
// we wrap the allocator function in an AlwaysAllocateScope. Test that
|
|
// all allocations succeed immediately without any retry.
|
|
CcTest::CollectAllAvailableGarbage();
|
|
Heap* heap = CcTest::heap();
|
|
AlwaysAllocateScopeForTesting scope(heap);
|
|
int size = FixedArray::SizeFor(100);
|
|
// Young generation.
|
|
HeapObject obj =
|
|
heap->AllocateRaw(size, AllocationType::kYoung).ToObjectChecked();
|
|
// In order to pass heap verification on Isolate teardown, mark the
|
|
// allocated area as a filler.
|
|
heap->CreateFillerObjectAt(obj.address(), size, ClearRecordedSlots::kNo);
|
|
|
|
// Old generation.
|
|
heap::SimulateFullSpace(heap->old_space());
|
|
obj = heap->AllocateRaw(size, AllocationType::kOld).ToObjectChecked();
|
|
heap->CreateFillerObjectAt(obj.address(), size, ClearRecordedSlots::kNo);
|
|
|
|
// Large object space.
|
|
static const size_t kLargeObjectSpaceFillerLength =
|
|
3 * (Page::kPageSize / 10);
|
|
static const size_t kLargeObjectSpaceFillerSize =
|
|
FixedArray::SizeFor(kLargeObjectSpaceFillerLength);
|
|
CHECK_GT(kLargeObjectSpaceFillerSize,
|
|
static_cast<size_t>(heap->old_space()->AreaSize()));
|
|
while (heap->OldGenerationSpaceAvailable() > kLargeObjectSpaceFillerSize) {
|
|
obj = heap->AllocateRaw(kLargeObjectSpaceFillerSize, AllocationType::kOld)
|
|
.ToObjectChecked();
|
|
heap->CreateFillerObjectAt(obj.address(), size, ClearRecordedSlots::kNo);
|
|
}
|
|
obj = heap->AllocateRaw(kLargeObjectSpaceFillerSize, AllocationType::kOld)
|
|
.ToObjectChecked();
|
|
heap->CreateFillerObjectAt(obj.address(), size, ClearRecordedSlots::kNo);
|
|
|
|
// Map space.
|
|
heap::SimulateFullSpace(heap->map_space());
|
|
obj = heap->AllocateRaw(Map::kSize, AllocationType::kMap).ToObjectChecked();
|
|
heap->CreateFillerObjectAt(obj.address(), Map::kSize,
|
|
ClearRecordedSlots::kNo);
|
|
|
|
// Code space.
|
|
heap::SimulateFullSpace(heap->code_space());
|
|
size = CcTest::i_isolate()->builtins()->builtin(Builtins::kIllegal).Size();
|
|
obj =
|
|
heap->AllocateRaw(size, AllocationType::kCode, AllocationOrigin::kRuntime)
|
|
.ToObjectChecked();
|
|
heap->CreateFillerObjectAt(obj.address(), size, ClearRecordedSlots::kNo);
|
|
return CcTest::i_isolate()->factory()->true_value();
|
|
}
|
|
|
|
|
|
HEAP_TEST(StressHandles) {
|
|
// For TestAllocateAfterFailures.
|
|
FLAG_stress_concurrent_allocation = false;
|
|
v8::HandleScope scope(CcTest::isolate());
|
|
v8::Local<v8::Context> env = v8::Context::New(CcTest::isolate());
|
|
env->Enter();
|
|
Handle<Object> o = TestAllocateAfterFailures();
|
|
CHECK(o->IsTrue(CcTest::i_isolate()));
|
|
env->Exit();
|
|
}
|
|
|
|
|
|
void TestGetter(
|
|
v8::Local<v8::Name> name,
|
|
const v8::PropertyCallbackInfo<v8::Value>& info) {
|
|
i::Isolate* isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
|
|
HandleScope scope(isolate);
|
|
info.GetReturnValue().Set(
|
|
v8::Utils::ToLocal(HeapTester::TestAllocateAfterFailures()));
|
|
}
|
|
|
|
void TestSetter(v8::Local<v8::Name> name, v8::Local<v8::Value> value,
|
|
const v8::PropertyCallbackInfo<v8::Boolean>& info) {
|
|
UNREACHABLE();
|
|
}
|
|
|
|
|
|
Handle<AccessorInfo> TestAccessorInfo(
|
|
Isolate* isolate, PropertyAttributes attributes) {
|
|
Handle<String> name = isolate->factory()->NewStringFromStaticChars("get");
|
|
return Accessors::MakeAccessor(isolate, name, &TestGetter, &TestSetter);
|
|
}
|
|
|
|
|
|
TEST(StressJS) {
|
|
// For TestAllocateAfterFailures in TestGetter.
|
|
FLAG_stress_concurrent_allocation = false;
|
|
Isolate* isolate = CcTest::i_isolate();
|
|
Factory* factory = isolate->factory();
|
|
v8::HandleScope scope(CcTest::isolate());
|
|
v8::Local<v8::Context> env = v8::Context::New(CcTest::isolate());
|
|
env->Enter();
|
|
|
|
NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
|
|
factory->function_string(), isolate->sloppy_function_map(),
|
|
Builtins::kEmptyFunction);
|
|
Handle<JSFunction> function = factory->NewFunction(args);
|
|
CHECK(!function->shared().construct_as_builtin());
|
|
|
|
// Force the creation of an initial map.
|
|
factory->NewJSObject(function);
|
|
|
|
// Patch the map to have an accessor for "get".
|
|
Handle<Map> map(function->initial_map(), isolate);
|
|
Handle<DescriptorArray> instance_descriptors(map->instance_descriptors(),
|
|
isolate);
|
|
CHECK_EQ(0, instance_descriptors->number_of_descriptors());
|
|
|
|
PropertyAttributes attrs = NONE;
|
|
Handle<AccessorInfo> foreign = TestAccessorInfo(isolate, attrs);
|
|
Map::EnsureDescriptorSlack(isolate, map, 1);
|
|
|
|
Descriptor d = Descriptor::AccessorConstant(
|
|
Handle<Name>(Name::cast(foreign->name()), isolate), foreign, attrs);
|
|
map->AppendDescriptor(isolate, &d);
|
|
|
|
// Add the Foo constructor the global object.
|
|
CHECK(env->Global()
|
|
->Set(env, v8::String::NewFromUtf8Literal(CcTest::isolate(), "Foo"),
|
|
v8::Utils::CallableToLocal(function))
|
|
.FromJust());
|
|
// Call the accessor through JavaScript.
|
|
v8::Local<v8::Value> result =
|
|
v8::Script::Compile(env, v8::String::NewFromUtf8Literal(CcTest::isolate(),
|
|
"(new Foo).get"))
|
|
.ToLocalChecked()
|
|
->Run(env)
|
|
.ToLocalChecked();
|
|
CHECK_EQ(true, result->BooleanValue(CcTest::isolate()));
|
|
env->Exit();
|
|
}
|
|
|
|
} // namespace heap
|
|
} // namespace internal
|
|
} // namespace v8
|