Chromium Code Reviews
DescriptionAlways record all the slots of descriptor arrays to avoid crashes due to
installing descriptors into the descriptor array before the descriptor array is
installed into the map.
This bug would be caused by, eg, appending a descriptor to an existing
descriptor array in ShareDescriptor, before installed the descriptor
array into the new map. If a GC occurs between installing the descriptor
and installing the descriptor array, the pointer to an evacuated key or
value will not be updated in the descriptor array.
BUG=
Patch Set 1 #Patch Set 2 : Only record the slots once #
Total comments: 3
Patch Set 3 : Remove duplicate VisitPointers #Messages
Total messages: 2 (0 generated)
|