VM: [GC] Array::MakeArray is racing with the sweeper.

runtime/vm/raw_object.h

Index: runtime/vm/raw_object.h
diff --git a/runtime/vm/raw_object.h b/runtime/vm/raw_object.h
index a3edb3011362319997fa5ae110243bdd2083a608..6a4c10d2f7482ce2255576982981ef335bcffc7d 100644
--- a/runtime/vm/raw_object.h
+++ b/runtime/vm/raw_object.h
@@ -435,7 +435,19 @@ class RawObject {
     uword tags = ptr()->tags_;
     intptr_t result = SizeTag::decode(tags);
     if (result != 0) {
-      ASSERT(result == SizeFromClass());
+#if defined(DEBUG)
+      // TODO(22501) Array::MakeArray has a race with this code: we might have
+      // loaded tags field and then MakeArray could have updated it leading
+      // to inconsistency between SizeFromClass() and SizeTag::decode(tags).
+      // We are working around it by reloading tags_ and recomputing
+      // size from tags.
+      const intptr_t size_from_class = SizeFromClass();
+      if ((result > size_from_class) && (GetClassId() == kArrayCid) &&
+          (ptr()->tags_ != tags)) {
+        result = SizeTag::decode(ptr()->tags_);
+      }
+      ASSERT(result == size_from_class);
+#endif
       return result;
     }
     result = SizeFromClass();