FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: cherry-pick d800a65 from V8 upstream · nodejs/node@8cf3472 · GitHub

/ node Public

Commit 8cf3472

Browse files
MylesBorins
committed
deps: cherry-pick d800a65 from V8 upstream
Original commit message: Filter out stale left-trimmed handles BUG=chromium:620553 LOG=N R=jochen@chromium.org Review-Url: https://codereview.chromium.org/2078403002 Cr-Commit-Position: refs/heads/master@{#37108} PR-URL: #10666 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
1 parent 75821ba commit 8cf3472

4 files changed

Lines changed: 44 additions & 34 deletions

File tree

‎deps/v8/src/heap/heap.cc‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3166,10 +3166,6 @@ FixedArrayBase* Heap::LeftTrimFixedArray(FixedArrayBase* object,
31663166
DCHECK(!lo_space()->Contains(object));
31673167
DCHECK(object->map() != fixed_cow_array_map());
31683168

3169-
// Ensure that the no handle-scope has more than one pointer to the same
3170-
// backing-store.
3171-
SLOW_DCHECK(CountHandlesForObject(object) <= 1);
3172-
31733169
STATIC_ASSERT(FixedArrayBase::kMapOffset == 0);
31743170
STATIC_ASSERT(FixedArrayBase::kLengthOffset == kPointerSize);
31753171
STATIC_ASSERT(FixedArrayBase::kHeaderSize == 2 * kPointerSize);
@@ -5671,32 +5667,6 @@ void Heap::PrintHandles() {
56715667

56725668
#endif
56735669

5674-
#ifdef ENABLE_SLOW_DCHECKS
5675-
5676-
class CountHandleVisitor : public ObjectVisitor {
5677-
public:
5678-
explicit CountHandleVisitor(Object* object) : object_(object) {}
5679-
5680-
void VisitPointers(Object** start, Object** end) override {
5681-
for (Object** p = start; p < end; p++) {
5682-
if (object_ == reinterpret_cast<Object*>(*p)) count_++;
5683-
}
5684-
}
5685-
5686-
int count() { return count_; }
5687-
5688-
private:
5689-
Object* object_;
5690-
int count_ = 0;
5691-
};
5692-
5693-
int Heap::CountHandlesForObject(Object* object) {
5694-
CountHandleVisitor v(object);
5695-
isolate_->handle_scope_implementer()->Iterate(&v);
5696-
return v.count();
5697-
}
5698-
#endif
5699-
57005670
class CheckHandleCountVisitor : public ObjectVisitor {
57015671
public:
57025672
CheckHandleCountVisitor() : handle_count_(0) {}

‎deps/v8/src/heap/heap.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1394,9 +1394,6 @@ class Heap {
13941394
void ReportHeapStatistics(const char* title);
13951395
void ReportCodeStatistics(const char* title);
13961396
#endif
1397-
#ifdef ENABLE_SLOW_DCHECKS
1398-
int CountHandlesForObject(Object* object);
1399-
#endif
14001397

14011398
private:
14021399
class PretenuringScope;

‎deps/v8/src/heap/mark-compact.cc‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1374,8 +1374,34 @@ class RootMarkingVisitor : public ObjectVisitor {
13741374
void MarkObjectByPointer(Object** p) {
13751375
if (!(*p)->IsHeapObject()) return;
13761376

1377-
// Replace flat cons strings in place.
13781377
HeapObject* object = HeapObject::cast(*p);
1378+
1379+
// We cannot avoid stale handles to left-trimmed objects, but can only make
1380+
// sure all handles still needed are updated. Filter out any stale pointers
1381+
// and clear the slot to allow post processing of handles (needed because
1382+
// the sweeper might actually free the underlying page).
1383+
if (object->IsFiller()) {
1384+
#ifdef DEBUG
1385+
// We need to find a FixedArrayBase map after walking the fillers.
1386+
Heap* heap = collector_->heap();
1387+
HeapObject* current = object;
1388+
while (current->IsFiller()) {
1389+
Address next = reinterpret_cast<Address>(current);
1390+
if (current->map() == heap->one_pointer_filler_map()) {
1391+
next += kPointerSize;
1392+
} else if (current->map() == heap->two_pointer_filler_map()) {
1393+
next += 2 * kPointerSize;
1394+
} else {
1395+
next += current->Size();
1396+
}
1397+
current = reinterpret_cast<HeapObject*>(next);
1398+
}
1399+
DCHECK(current->IsFixedArrayBase());
1400+
#endif // DEBUG
1401+
*p = nullptr;
1402+
return;
1403+
}
1404+
13791405
MarkBit mark_bit = Marking::MarkBitFrom(object);
13801406
if (Marking::IsBlackOrGrey(mark_bit)) return;
13811407

‎deps/v8/test/mjsunit/regress/regress-620553.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
// Copyright 2016 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --expose-gc
6+
7+
var o0 = [];
8+
var o1 = [];
9+
var cnt = 0;
10+
o1.__defineGetter__(0, function() {
11+
if (cnt++ > 2) return;
12+
o0.shift();
13+
gc();
14+
o0.push(0);
15+
o0.concat(o1);
16+
});
17+
o1[0];

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL