Fix Object::Clone heap corruption under concurrent sweeping.

runtime/vm/object.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/object.h"
 
 #include "include/dart_api.h"
 #include "platform/assert.h"
 #include "vm/assembler.h"
 #include "vm/cpu.h"
@@ skipping 1727 matching lines @@
   return (IsZoneHandle() || IsReadOnlyHandle());
 }
 
 
 
 RawObject* Object::Clone(const Object& src, Heap::Space space) {
   const Class& cls = Class::Handle(src.clazz());
   intptr_t size = src.raw()->Size();
   RawObject* raw_obj = Object::Allocate(cls.id(), size, space);
   NoGCScope no_gc;
+  // Newly allocated objects are white ...
+  // TODO(koda): This will trip when we start allocating black.
+  // Update unmarking code below at that point.
+  ASSERT(!raw_obj->IsMarked());
   memmove(raw_obj->ptr(), src.raw()->ptr(), size);
+  // ... so ensure clone is too (see issue 21236).
+  if (raw_obj->IsMarked()) {
+    raw_obj->ClearMarkBit();
+  }
   if ((space == Heap::kOld) && !raw_obj->IsRemembered()) {

[Ivan Posva, 2014/10/06 05:18:53]

We should discuss this condition in person. I am not convinced this is correct.

[koda, 2014/10/06 05:35:35]

Agreed.

In general, this method seems awfully tricky to get right, considering new tags
might be added. We should go over all its uses to see whether it can be replaced
with something safer.

I will also add a check to --verify_before_gc that no objects are marked.

     StoreBufferUpdateVisitor visitor(Isolate::Current(), raw_obj);
     raw_obj->VisitPointers(&visitor);
   }
   return raw_obj;
 }
 
 
 RawString* Class::Name() const {
   // TODO(turnidge): This assert fails for the fake kFreeListElement class.
   // Fix this.
@@ skipping 18547 matching lines @@
   return tag_label.ToCString();
 }
 
 
 void UserTag::PrintJSONImpl(JSONStream* stream, bool ref) const {
   Instance::PrintJSONImpl(stream, ref);
 }
 
 
 }  // namespace dart