VM: [GC] Array::MakeArray is racing with the sweeper.

runtime/vm/raw_object.h

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #ifndef RUNTIME_VM_RAW_OBJECT_H_
 #define RUNTIME_VM_RAW_OBJECT_H_
 
 #include "platform/assert.h"
 #include "vm/atomic.h"
 #include "vm/globals.h"
@@ skipping 417 matching lines @@
     return ((GetClassId() == kForwardingCorpse));
   }
   bool IsPseudoObject() const {
     return IsFreeListElement() || IsForwardingCorpse();
   }
 
   intptr_t Size() const {
     uword tags = ptr()->tags_;
     intptr_t result = SizeTag::decode(tags);
     if (result != 0) {
-      ASSERT(result == SizeFromClass());
+#if defined(DEBUG)
+      // TODO(22501) Array::MakeArray has a race with this code: we might have
+      // loaded tags field and then MakeArray could have updated it leading
+      // to inconsistency between SizeFromClass() and SizeTag::decode(tags).
+      // We are working around it by reloading tags_ and recomputing
+      // size from tags.
+      const intptr_t size_from_class = SizeFromClass();
+      if ((result > size_from_class) && (GetClassId() == kArrayCid) &&
+          (ptr()->tags_ != tags)) {
+        result = SizeTag::decode(ptr()->tags_);
+      }
+      ASSERT(result == size_from_class);
+#endif
       return result;
     }
     result = SizeFromClass();
     ASSERT(result > SizeTag::kMaxSizeTag);
     return result;
   }
 
   bool Contains(uword addr) const {
     intptr_t this_size = Size();
     uword this_addr = RawObject::ToAddr(this);
@@ skipping 1975 matching lines @@
   COMPILE_ASSERT(kExternalTypedDataInt8ArrayCid ==
                  kTypedDataInt8ArrayViewCid + 15);
   COMPILE_ASSERT(kByteBufferCid == kExternalTypedDataInt8ArrayCid + 14);
   COMPILE_ASSERT(kNullCid == kByteBufferCid + 1);
   return (kNullCid - kTypedDataInt8ArrayCid);
 }
 
 }  // namespace dart
 
 #endif  // RUNTIME_VM_RAW_OBJECT_H_