Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(664)

Unified Diff: src/heap/heap.cc

Issue 990173002: Recorded slots in store buffer are never in free space. Remove migration consistency check. (Closed) Base URL: https://chromium.googlesource.com/v8/v8.git@master
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: src/heap/heap.cc
diff --git a/src/heap/heap.cc b/src/heap/heap.cc
index 9ea06d26fde69cd1e1a255de435fc1c46315ca40..e88e50f6c395b66220af47d049782f66d8fcc860 100644
--- a/src/heap/heap.cc
+++ b/src/heap/heap.cc
@@ -2118,12 +2118,10 @@ class ScavengingVisitor : public StaticVisitorBase {
if (alignment != kObjectAlignment) {
target = EnsureDoubleAligned(heap, target, allocation_size);
}
+ MigrateObject(heap, object, target, object_size);
- // Order is important: slot might be inside of the target if target
- // was allocated over a dead object and slot comes from the store
- // buffer.
+ // Update slot to new target.
*slot = target;
- MigrateObject(heap, object, target, object_size);
heap->IncrementSemiSpaceCopiedObjectSize(object_size);
return true;
@@ -2157,23 +2155,11 @@ class ScavengingVisitor : public StaticVisitorBase {
if (alignment != kObjectAlignment) {
target = EnsureDoubleAligned(heap, target, allocation_size);
}
-
- // Order is important: slot might be inside of the target if target
- // was allocated over a dead object and slot comes from the store
- // buffer.
-
- // Unfortunately, the allocation can also write over the slot if the slot
- // was in free space and the allocation wrote free list data (such as the
- // free list map or entry size) over the slot. We guard against this by
- // checking that the slot still points to the object being moved. This
- // should be sufficient because neither the free list map nor the free
- // list entry size should look like a new space pointer (the former is an
- // old space pointer, the latter is word-aligned).
- if (*slot == object) {
- *slot = target;
- }
MigrateObject(heap, object, target, object_size);
+ // Update slot to new target.
+ *slot = target;
+
if (object_contents == POINTER_OBJECT) {
if (map->instance_type() == JS_FUNCTION_TYPE) {
heap->promotion_queue()->insert(target,
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698