Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(148)

Issue 144003007: Always record all the slots of descriptor arrays to avoid crashes due to (Closed)

Created:
6 years, 11 months ago by Toon Verwaest
Modified:
6 years, 6 months ago
Reviewers:
Michael Starzinger
CC:
v8-dev
Visibility:
Public.

Description

Always record all the slots of descriptor arrays to avoid crashes due to installing descriptors into the descriptor array before the descriptor array is installed into the map. This bug would be caused by, eg, appending a descriptor to an existing descriptor array in ShareDescriptor, before installed the descriptor array into the new map. If a GC occurs between installing the descriptor and installing the descriptor array, the pointer to an evacuated key or value will not be updated in the descriptor array. BUG=

Patch Set 1 #

Patch Set 2 : Only record the slots once #

Total comments: 3

Patch Set 3 : Remove duplicate VisitPointers #

Unified diffs Side-by-side diffs Delta from patch set Stats (+23 lines, -4 lines) Patch
M src/objects-visiting-inl.h View 1 2 3 chunks +23 lines, -4 lines 0 comments Download

Messages

Total messages: 2 (0 generated)
Toon Verwaest
PTAL
6 years, 11 months ago (2014-01-21 17:34:12 UTC) #1
Michael Starzinger
6 years, 11 months ago (2014-01-21 18:07:41 UTC) #2
LGTM if comments are addressed.

For the record, this breaks nice abstractions in the StaticMarkingVisitor and my
heart bleeds a little looking at this change.

https://codereview.chromium.org/144003007/diff/40001/src/objects-visiting-inl.h
File src/objects-visiting-inl.h (right):

https://codereview.chromium.org/144003007/diff/40001/src/objects-visiting-inl...
src/objects-visiting-inl.h:632: 
nit: Please drop the empty newline. The comment above shouldn't be separated
from the block of code below.

https://codereview.chromium.org/144003007/diff/40001/src/objects-visiting-inl...
src/objects-visiting-inl.h:648: StaticVisitor::VisitPointers(heap,
Can we move the visiting of the header slots to before we record the entry
slots? Then the memory is accessed sequentially. Also it is easier to read.

https://codereview.chromium.org/144003007/diff/40001/src/objects-visiting-inl...
src/objects-visiting-inl.h:655: StaticVisitor::VisitPointers(heap,
The call to VisitPointers here is obsolete.

Powered by Google App Engine
This is Rietveld 408576698