Skip to content

Commit b4b9377

Browse files
mlippautzCommit bot
mlippautz
authored and
Commit bot
committed
Version 5.2.361.32 (cherry-pick)
Merged d800a65 Merged 7a88ff3 Merged a715957 [heap] Filter out stale left-trimmed handles [heap] Filter out stale left-trimmed handles for scavenges [heap] Iterate handles with special left-trim visitor BUG=chromium:620553,chromium:620553,chromium:621869 LOG=N R=hablich@chromium.org, hpayer@chromium.org NOTRY=true NOPRESUBMIT=true Review-Url: https://codereview.chromium.org/2111133002 Cr-Commit-Position: refs/branch-heads/5.2@{#38} Cr-Branched-From: 2cd36d6-refs/heads/5.2.361@{#1} Cr-Branched-From: 3fef34e-refs/heads/master@{#36332}
1 parent e0b7d9b commit b4b9377

9 files changed

Lines changed: 85 additions & 38 deletions

File tree

‎include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 5
1212
#define V8_MINOR_VERSION 2
1313
#define V8_BUILD_NUMBER 361
14-
#define V8_PATCH_LEVEL 31
14+
#define V8_PATCH_LEVEL 32
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎src/heap/heap.cc‎

Lines changed: 45 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3117,10 +3117,6 @@ FixedArrayBase* Heap::LeftTrimFixedArray(FixedArrayBase* object,
31173117
DCHECK(!lo_space()->Contains(object));
31183118
DCHECK(object->map() != fixed_cow_array_map());
31193119

3120-
// Ensure that the no handle-scope has more than one pointer to the same
3121-
// backing-store.
3122-
SLOW_DCHECK(CountHandlesForObject(object) <= 1);
3123-
31243120
STATIC_ASSERT(FixedArrayBase::kMapOffset == 0);
31253121
STATIC_ASSERT(FixedArrayBase::kLengthOffset == kPointerSize);
31263122
STATIC_ASSERT(FixedArrayBase::kHeaderSize == 2 * kPointerSize);
@@ -4763,6 +4759,49 @@ void Heap::IterateSmiRoots(ObjectVisitor* v) {
47634759
v->Synchronize(VisitorSynchronization::kSmiRootList);
47644760
}
47654761

4762+
// We cannot avoid stale handles to left-trimmed objects, but can only make
4763+
// sure all handles still needed are updated. Filter out a stale pointer
4764+
// and clear the slot to allow post processing of handles (needed because
4765+
// the sweeper might actually free the underlying page).
4766+
class FixStaleLeftTrimmedHandlesVisitor : public ObjectVisitor {
4767+
public:
4768+
explicit FixStaleLeftTrimmedHandlesVisitor(Heap* heap) : heap_(heap) {
4769+
USE(heap_);
4770+
}
4771+
4772+
void VisitPointer(Object** p) override { FixHandle(p); }
4773+
4774+
void VisitPointers(Object** start, Object** end) override {
4775+
for (Object** p = start; p < end; p++) FixHandle(p);
4776+
}
4777+
4778+
private:
4779+
inline void FixHandle(Object** p) {
4780+
HeapObject* current = reinterpret_cast<HeapObject*>(*p);
4781+
if (!current->IsHeapObject()) return;
4782+
const MapWord map_word = current->map_word();
4783+
if (!map_word.IsForwardingAddress() && current->IsFiller()) {
4784+
#ifdef DEBUG
4785+
// We need to find a FixedArrayBase map after walking the fillers.
4786+
while (current->IsFiller()) {
4787+
Address next = reinterpret_cast<Address>(current);
4788+
if (current->map() == heap_->one_pointer_filler_map()) {
4789+
next += kPointerSize;
4790+
} else if (current->map() == heap_->two_pointer_filler_map()) {
4791+
next += 2 * kPointerSize;
4792+
} else {
4793+
next += current->Size();
4794+
}
4795+
current = reinterpret_cast<HeapObject*>(next);
4796+
}
4797+
DCHECK(current->IsFixedArrayBase());
4798+
#endif // DEBUG
4799+
*p = nullptr;
4800+
}
4801+
}
4802+
4803+
Heap* heap_;
4804+
};
47664805

47674806
void Heap::IterateStrongRoots(ObjectVisitor* v, VisitMode mode) {
47684807
v->VisitPointers(&roots_[0], &roots_[kStrongRootListLength]);
@@ -4783,6 +4822,8 @@ void Heap::IterateStrongRoots(ObjectVisitor* v, VisitMode mode) {
47834822
v->Synchronize(VisitorSynchronization::kCompilationCache);
47844823

47854824
// Iterate over local handles in handle scopes.
4825+
FixStaleLeftTrimmedHandlesVisitor left_trim_visitor(this);
4826+
isolate_->handle_scope_implementer()->Iterate(&left_trim_visitor);
47864827
isolate_->handle_scope_implementer()->Iterate(v);
47874828
isolate_->IterateDeferredHandles(v);
47884829
v->Synchronize(VisitorSynchronization::kHandleScope);
@@ -5632,32 +5673,6 @@ void Heap::PrintHandles() {
56325673

56335674
#endif
56345675

5635-
#ifdef ENABLE_SLOW_DCHECKS
5636-
5637-
class CountHandleVisitor : public ObjectVisitor {
5638-
public:
5639-
explicit CountHandleVisitor(Object* object) : object_(object) {}
5640-
5641-
void VisitPointers(Object** start, Object** end) override {
5642-
for (Object** p = start; p < end; p++) {
5643-
if (object_ == reinterpret_cast<Object*>(*p)) count_++;
5644-
}
5645-
}
5646-
5647-
int count() { return count_; }
5648-
5649-
private:
5650-
Object* object_;
5651-
int count_ = 0;
5652-
};
5653-
5654-
int Heap::CountHandlesForObject(Object* object) {
5655-
CountHandleVisitor v(object);
5656-
isolate_->handle_scope_implementer()->Iterate(&v);
5657-
return v.count();
5658-
}
5659-
#endif
5660-
56615676
class CheckHandleCountVisitor : public ObjectVisitor {
56625677
public:
56635678
CheckHandleCountVisitor() : handle_count_(0) {}

‎src/heap/heap.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1389,9 +1389,6 @@ class Heap {
13891389
void ReportHeapStatistics(const char* title);
13901390
void ReportCodeStatistics(const char* title);
13911391
#endif
1392-
#ifdef ENABLE_SLOW_DCHECKS
1393-
int CountHandlesForObject(Object* object);
1394-
#endif
13951392

13961393
private:
13971394
class PretenuringScope;

‎src/heap/mark-compact.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1406,8 +1406,8 @@ class RootMarkingVisitor : public ObjectVisitor {
14061406
void MarkObjectByPointer(Object** p) {
14071407
if (!(*p)->IsHeapObject()) return;
14081408

1409-
// Replace flat cons strings in place.
14101409
HeapObject* object = HeapObject::cast(*p);
1410+
14111411
MarkBit mark_bit = Marking::MarkBitFrom(object);
14121412
if (Marking::IsBlackOrGrey(mark_bit)) return;
14131413

‎src/heap/scavenger.cc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,7 @@ void ScavengeVisitor::VisitPointers(Object** start, Object** end) {
466466
void ScavengeVisitor::ScavengePointer(Object** p) {
467467
Object* object = *p;
468468
if (!heap_->InNewSpace(object)) return;
469+
469470
Scavenger::ScavengeObject(reinterpret_cast<HeapObject**>(p),
470471
reinterpret_cast<HeapObject*>(object));
471472
}

‎src/objects-inl.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1263,8 +1263,7 @@ Map* MapWord::ToMap() {
12631263
return reinterpret_cast<Map*>(value_);
12641264
}
12651265

1266-
1267-
bool MapWord::IsForwardingAddress() {
1266+
bool MapWord::IsForwardingAddress() const {
12681267
return HAS_SMI_TAG(reinterpret_cast<Object*>(value_));
12691268
}
12701269

‎src/objects.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1487,7 +1487,7 @@ class MapWord BASE_EMBEDDED {
14871487
// True if this map word is a forwarding address for a scavenge
14881488
// collection. Only valid during a scavenge collection (specifically,
14891489
// when all map words are heap object pointers, i.e. not during a full GC).
1490-
inline bool IsForwardingAddress();
1490+
inline bool IsForwardingAddress() const;
14911491

14921492
// Create a map word from a forwarding address.
14931493
static inline MapWord FromForwardingAddress(HeapObject* object);

‎test/mjsunit/regress/regress-620553.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
// Copyright 2016 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --expose-gc
6+
7+
var o0 = [];
8+
var o1 = [];
9+
var cnt = 0;
10+
o1.__defineGetter__(0, function() {
11+
if (cnt++ > 2) return;
12+
o0.shift();
13+
gc();
14+
o0.push(0);
15+
o0.concat(o1);
16+
});
17+
o1[0];

‎test/mjsunit/regress/regress-621869.js‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
// Copyright 2016 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --expose-gc
6+
7+
var o0 = [];
8+
var o1 = [];
9+
var cnt = 0;
10+
var only_scavenge = true;
11+
o1.__defineGetter__(0, function() {
12+
if (cnt++ > 2) return;
13+
o0.shift();
14+
gc(only_scavenge);
15+
o0.push((64));
16+
o0.concat(o1);
17+
});
18+
o1[0];

0 commit comments

Comments
 (0)