Commit ee01d6b
committed
deps: V8: cherry-pick 2059ee813359
Original commit message:
[heap] Make CompactTransitionArray deserializer friendly
Add a pre-loop over transition arrays during compaction, that checks
whether compaction is needed at all, and whether any of the entries are
still uninitialized values as part of deserialization (and therefore no
other targets can be dead). Bails out of compaction early if this is the
case.
Bug: v8:11305
Change-Id: I27af792a8a0bd3df17892f54ac95ed15e4bdfcc0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622910
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72038}
Refs: v8/v8@2059ee8
PR-URL: #36139
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>1 parent 31a46f8 commit ee01d6b
3 files changed
Lines changed: 37 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -36,7 +36,7 @@ | |||
| 36 | 36 | ||
| 37 | 37 | # Reset this number to 0 on major V8 upgrades. | |
| 38 | 38 | # Increment by one for each non-official patch applied to deps/v8. | |
| 39 | - 'v8_embedder_string': '-node.17', | ||
| 39 | + 'v8_embedder_string': '-node.18', | ||
| 40 | 40 | ||
| 41 | 41 | ##### V8 defaults for Node.js ##### | |
| 42 | 42 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2288,11 +2288,45 @@ void MarkCompactCollector::ClearFullMapTransitions() { | |||
| 2288 | 2288 | } | |
| 2289 | 2289 | } | |
| 2290 | 2290 | ||
| 2291 | + // Returns false if no maps have died, or if the transition array is | ||
| 2292 | + // still being deserialized. | ||
| 2293 | + bool MarkCompactCollector::TransitionArrayNeedsCompaction( | ||
| 2294 | + TransitionArray transitions, int num_transitions) { | ||
| 2295 | + for (int i = 0; i < num_transitions; ++i) { | ||
| 2296 | + MaybeObject raw_target = transitions.GetRawTarget(i); | ||
| 2297 | + if (raw_target.IsSmi()) { | ||
| 2298 | + // This target is still being deserialized, | ||
| 2299 | + DCHECK(isolate()->has_active_deserializer()); | ||
| 2300 | + DCHECK_EQ(raw_target.ToSmi(), Deserializer::uninitialized_field_value()); | ||
| 2301 | + #ifdef DEBUG | ||
| 2302 | + // Targets can only be dead iff this array is fully deserialized. | ||
| 2303 | + for (int i = 0; i < num_transitions; ++i) { | ||
| 2304 | + DCHECK(!non_atomic_marking_state()->IsWhite(transitions.GetTarget(i))); | ||
| 2305 | + } | ||
| 2306 | + #endif | ||
| 2307 | + return false; | ||
| 2308 | + } else if (non_atomic_marking_state()->IsWhite( | ||
| 2309 | + TransitionsAccessor::GetTargetFromRaw(raw_target))) { | ||
| 2310 | + #ifdef DEBUG | ||
| 2311 | + // Targets can only be dead iff this array is fully deserialized. | ||
| 2312 | + for (int i = 0; i < num_transitions; ++i) { | ||
| 2313 | + DCHECK(!transitions.GetRawTarget(i).IsSmi()); | ||
| 2314 | + } | ||
| 2315 | + #endif | ||
| 2316 | + return true; | ||
| 2317 | + } | ||
| 2318 | + } | ||
| 2319 | + return false; | ||
| 2320 | + } | ||
| 2321 | + | ||
| 2291 | 2322 | bool MarkCompactCollector::CompactTransitionArray(Map map, | |
| 2292 | 2323 | TransitionArray transitions, | |
| 2293 | 2324 | DescriptorArray descriptors) { | |
| 2294 | 2325 | DCHECK(!map.is_prototype_map()); | |
| 2295 | 2326 | int num_transitions = transitions.number_of_entries(); | |
| 2327 | + if (!TransitionArrayNeedsCompaction(transitions, num_transitions)) { | ||
| 2328 | + return false; | ||
| 2329 | + } | ||
| 2296 | 2330 | bool descriptors_owner_died = false; | |
| 2297 | 2331 | int transition_index = 0; | |
| 2298 | 2332 | // Compact all live transitions to the left. | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -681,6 +681,8 @@ class MarkCompactCollector final : public MarkCompactCollectorBase { | |||
| 681 | 681 | void TrimEnumCache(Map map, DescriptorArray descriptors); | |
| 682 | 682 | bool CompactTransitionArray(Map map, TransitionArray transitions, | |
| 683 | 683 | DescriptorArray descriptors); | |
| 684 | + bool TransitionArrayNeedsCompaction(TransitionArray transitions, | ||
| 685 | + int num_transitions); | ||
| 684 | 686 | ||
| 685 | 687 | // After all reachable objects have been marked those weak map entries | |
| 686 | 688 | // with an unreachable key are removed from all encountered weak maps. | |
0 commit comments