FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: cherry-pick 7a88ff3 from V8 upstream · nodejs/node@642ad4f · GitHub

/ node Public

Commit 642ad4f

Browse files
MylesBorins
committed
deps: cherry-pick 7a88ff3 from V8 upstream
Original commit message: Filter out stale left-trimmed handles for scavenges The missing part from https://codereview.chromium.org/2078403002/ R=jochen@chromium.org BUG=chromium:621869 LOG=N Review-Url: https://codereview.chromium.org/2077353004 Cr-Commit-Position: refs/heads/master@{#37184} PR-URL: #10666 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
1 parent 8cf3472 commit 642ad4f

7 files changed

Lines changed: 55 additions & 28 deletions

File tree

‎deps/v8/src/heap/heap-inl.h‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -449,6 +449,31 @@ void Heap::CopyBlock(Address dst, Address src, int byte_size) {
449449
static_cast<size_t>(byte_size / kPointerSize));
450450
}
451451

452+
bool Heap::PurgeLeftTrimmedObject(Object** object) {
453+
HeapObject* current = reinterpret_cast<HeapObject*>(*object);
454+
const MapWord map_word = current->map_word();
455+
if (current->IsFiller() && !map_word.IsForwardingAddress()) {
456+
#ifdef DEBUG
457+
// We need to find a FixedArrayBase map after walking the fillers.
458+
while (current->IsFiller()) {
459+
Address next = reinterpret_cast<Address>(current);
460+
if (current->map() == one_pointer_filler_map()) {
461+
next += kPointerSize;
462+
} else if (current->map() == two_pointer_filler_map()) {
463+
next += 2 * kPointerSize;
464+
} else {
465+
next += current->Size();
466+
}
467+
current = reinterpret_cast<HeapObject*>(next);
468+
}
469+
DCHECK(current->IsFixedArrayBase());
470+
#endif // DEBUG
471+
*object = nullptr;
472+
return true;
473+
}
474+
return false;
475+
}
476+
452477
template <Heap::FindMementoMode mode>
453478
AllocationMemento* Heap::FindAllocationMemento(HeapObject* object) {
454479
// Check if there is potentially a memento behind the object. If

‎deps/v8/src/heap/heap.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -602,6 +602,12 @@ class Heap {
602602
// stored on the map to facilitate fast dispatch for {StaticVisitorBase}.
603603
static int GetStaticVisitorIdForMap(Map* map);
604604

605+
// We cannot avoid stale handles to left-trimmed objects, but can only make
606+
// sure all handles still needed are updated. Filter out a stale pointer
607+
// and clear the slot to allow post processing of handles (needed because
608+
// the sweeper might actually free the underlying page).
609+
inline bool PurgeLeftTrimmedObject(Object** object);
610+
605611
// Notifies the heap that is ok to start marking or other activities that
606612
// should not happen during deserialization.
607613
void NotifyDeserializationComplete();

‎deps/v8/src/heap/mark-compact.cc‎

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1376,31 +1376,7 @@ class RootMarkingVisitor : public ObjectVisitor {
13761376

13771377
HeapObject* object = HeapObject::cast(*p);
13781378

1379-
// We cannot avoid stale handles to left-trimmed objects, but can only make
1380-
// sure all handles still needed are updated. Filter out any stale pointers
1381-
// and clear the slot to allow post processing of handles (needed because
1382-
// the sweeper might actually free the underlying page).
1383-
if (object->IsFiller()) {
1384-
#ifdef DEBUG
1385-
// We need to find a FixedArrayBase map after walking the fillers.
1386-
Heap* heap = collector_->heap();
1387-
HeapObject* current = object;
1388-
while (current->IsFiller()) {
1389-
Address next = reinterpret_cast<Address>(current);
1390-
if (current->map() == heap->one_pointer_filler_map()) {
1391-
next += kPointerSize;
1392-
} else if (current->map() == heap->two_pointer_filler_map()) {
1393-
next += 2 * kPointerSize;
1394-
} else {
1395-
next += current->Size();
1396-
}
1397-
current = reinterpret_cast<HeapObject*>(next);
1398-
}
1399-
DCHECK(current->IsFixedArrayBase());
1400-
#endif // DEBUG
1401-
*p = nullptr;
1402-
return;
1403-
}
1379+
if (collector_->heap()->PurgeLeftTrimmedObject(p)) return;
14041380

14051381
MarkBit mark_bit = Marking::MarkBitFrom(object);
14061382
if (Marking::IsBlackOrGrey(mark_bit)) return;

‎deps/v8/src/heap/scavenger.cc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -462,6 +462,9 @@ void ScavengeVisitor::VisitPointers(Object** start, Object** end) {
462462
void ScavengeVisitor::ScavengePointer(Object** p) {
463463
Object* object = *p;
464464
if (!heap_->InNewSpace(object)) return;
465+
466+
if (heap_->PurgeLeftTrimmedObject(p)) return;
467+
465468
Scavenger::ScavengeObject(reinterpret_cast<HeapObject**>(p),
466469
reinterpret_cast<HeapObject*>(object));
467470
}

‎deps/v8/src/objects-inl.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1261,8 +1261,7 @@ Map* MapWord::ToMap() {
12611261
return reinterpret_cast<Map*>(value_);
12621262
}
12631263

1264-
1265-
bool MapWord::IsForwardingAddress() {
1264+
bool MapWord::IsForwardingAddress() const {
12661265
return HAS_SMI_TAG(reinterpret_cast<Object*>(value_));
12671266
}
12681267

‎deps/v8/src/objects.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1476,7 +1476,7 @@ class MapWord BASE_EMBEDDED {
14761476
// True if this map word is a forwarding address for a scavenge
14771477
// collection. Only valid during a scavenge collection (specifically,
14781478
// when all map words are heap object pointers, i.e. not during a full GC).
1479-
inline bool IsForwardingAddress();
1479+
inline bool IsForwardingAddress() const;
14801480

14811481
// Create a map word from a forwarding address.
14821482
static inline MapWord FromForwardingAddress(HeapObject* object);

‎deps/v8/test/mjsunit/regress/regress-621869.js‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
// Copyright 2016 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --expose-gc
6+
7+
var o0 = [];
8+
var o1 = [];
9+
var cnt = 0;
10+
var only_scavenge = true;
11+
o1.__defineGetter__(0, function() {
12+
if (cnt++ > 2) return;
13+
o0.shift();
14+
gc(only_scavenge);
15+
o0.push((64));
16+
o0.concat(o1);
17+
});
18+
o1[0];

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL