ca4489972a
The problem here was that IncrementalMarking::Step was invoking new_space()->ResetOriginalTop() which sets original_top to the current top. IncrementalMarking::Step could be invoked during InvokeAllocationObservers(), which is called right after acquiring a new LAB and allocating the first object in it. However this first allocation might be from generated code with allocation folding enabled. The generated code might not use all of the memory it allocated and in that process move top backwards again. Nevertheless InvokeAllocationObservers() could already set original_top to the current top. If the generated code later not uses all of that memory, original_top can be bigger than top. Fix this problem by ensuring that original_top always equals the LAB start. Each time LAB start is moved/accounted for, original_top is now updated as well for the new space. Also IncrementalMarking::Step() isn't allowed to move original_top anymore. Bug: chromium:1116278, v8:10315 Change-Id: Ib18a0b07e2665b8ba933555387b84329cbecdf5b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398519 Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#69840} |
||
---|---|---|
build_overrides | ||
custom_deps | ||
docs | ||
gni | ||
include | ||
infra | ||
samples | ||
src | ||
test | ||
testing | ||
third_party | ||
tools | ||
.clang-format | ||
.clang-tidy | ||
.editorconfig | ||
.flake8 | ||
.git-blame-ignore-revs | ||
.gitattributes | ||
.gitignore | ||
.gn | ||
.vpython | ||
.ycm_extra_conf.py | ||
AUTHORS | ||
BUILD.gn | ||
CODE_OF_CONDUCT.md | ||
codereview.settings | ||
COMMON_OWNERS | ||
DEPS | ||
ENG_REVIEW_OWNERS | ||
INFRA_OWNERS | ||
INTL_OWNERS | ||
LICENSE | ||
LICENSE.fdlibm | ||
LICENSE.strongtalk | ||
LICENSE.v8 | ||
LICENSE.valgrind | ||
MIPS_OWNERS | ||
OWNERS | ||
PPC_OWNERS | ||
PRESUBMIT.py | ||
README.md | ||
S390_OWNERS | ||
WATCHLISTS |
V8 JavaScript Engine
V8 is Google's open source JavaScript engine.
V8 implements ECMAScript as specified in ECMA-262.
V8 is written in C++ and is used in Google Chrome, the open source browser from Google.
V8 can run standalone, or can be embedded into any C++ application.
V8 Project page: https://v8.dev/docs
Getting the Code
Checkout depot tools, and run
fetch v8
This will checkout V8 into the directory v8
and fetch all of its dependencies.
To stay up to date, run
git pull origin
gclient sync
For fetching all branches, add the following into your remote
configuration in .git/config
:
fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
fetch = +refs/tags/*:refs/tags/*
Contributing
Please follow the instructions mentioned at v8.dev/docs/contribute.