v8/test/mjsunit/regress/regress-1016703.js
Ulan Degenbaev b33a8508cc [heap]: Make addition of detached contexts robust for GC
The (age, context) pair has to be added atomically in to the weak
array of detached contexts. Otherwise, GC may happen after insertion
of age and observe inconsistent state.

Bug: chromium:1016703
Change-Id: Icb20bed4359904b2d976986a236558542e314bbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895573
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64820}
2019-11-06 17:59:21 +00:00

16 lines
366 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc
let realms = [];
for (let i = 0; i < 4; i++) {
realms.push(Realm.createAllowCrossRealmAccess());
}
for (let i = 0; i < 4; i++) {
Realm.detachGlobal(realms[i]);
gc();
}