heap: make array buffer maps disjoint

src/heap/mark-compact.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/heap/mark-compact.h"
 
 #include "src/base/atomicops.h"
 #include "src/base/bits.h"
 #include "src/code-stubs.h"
 #include "src/compilation-cache.h"
@@ skipping 1849 matching lines @@
           // has the same number of pages as from-space, so there is
           // always room.
           UNREACHABLE();
         }
         allocation = new_space->AllocateRaw(size, alignment);
         DCHECK(!allocation.IsRetry());
       }
       Object* target = allocation.ToObjectChecked();
 
       MigrateObject(HeapObject::cast(target), object, size, NEW_SPACE);
+      // If we end up needing more special cases, we should factor this out.

[Michael Lippautz, 2015/09/02 07:23:00]

Remove this comment.

[fedor.indutny, 2015/09/02 08:56:08]

Acknowledged.

+      if (V8_UNLIKELY(target->IsJSArrayBuffer())) {
+        heap()->RegisterLiveArrayBuffer(
+            true, JSArrayBuffer::cast(target)->backing_store());
+      }
       heap()->IncrementSemiSpaceCopiedObjectSize(size);
     }
     *cells = 0;
   }
   return survivors_size;
 }
 
 
 void MarkCompactCollector::DiscoverGreyObjectsInSpace(PagedSpace* space) {
   PageIterator it(space);
@@ skipping 2544 matching lines @@
     }
   }
 
   // Deallocate unmarked large objects.
   heap_->lo_space()->FreeUnmarkedObjects();
 
   // Give pages that are queued to be freed back to the OS. Invalid store
   // buffer entries are already filter out. We can just release the memory.
   heap()->FreeQueuedChunks();
 
+  EvacuateNewSpaceAndCandidates();
+
+  // NOTE: ArrayBuffers must be evacuated first, before freeing them. Otherwise
+  // not yet discovered buffers for scavenge will have all of them, and they
+  // will be erroneously freed.

[Michael Lippautz, 2015/09/02 07:23:00]

Replace to:

EvacuateNewSpaceAndCandidates iterates over new space objects and for
ArrayBuffers either re-registers them as live or promotes them. This is needed
to properly free them.

[fedor.indutny, 2015/09/02 08:56:08]

Acknowledged.

   heap()->FreeDeadArrayBuffers(false);
 
-  EvacuateNewSpaceAndCandidates();
-
   // Clear the marking state of live large objects.
   heap_->lo_space()->ClearMarkingStateOfLiveObjects();
 
   // Deallocate evacuated candidate pages.
   ReleaseEvacuationCandidates();
   CodeRange* code_range = heap()->isolate()->code_range();
   if (code_range != NULL && code_range->valid()) {
     code_range->ReserveEmergencyBlock();
   }
 
@@ skipping 358 matching lines @@
   SlotsBuffer* buffer = *buffer_address;
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 }  // namespace internal
 }  // namespace v8