Revision: 25143
Author: [email protected]
Date: Wed Nov 5 11:27:34 2014 UTC
Log: Handle store buffer slot overwrite during object promotion.
The bad scenario this fix handles:
We have a slot in a free list, then promote the object pointed-to by
the slot during scavenge. When allocating the space for the promoted
object, we overwrite the slot with the free list entry map if the
object is allocated just before the slot. After the allocation,
ScavengingVisitor::PromoteObject overwrites the slot with the
address of the allocated object, thus corrupting the free list.
Unfortunately, we do not have a way to construct a reliable repro
case because we would need to somehow craft a free list and store
buffer slot to be in the right configuration.
[email protected]
BUG=
Review URL: https://codereview.chromium.org/695213004
https://code.google.com/p/v8/source/detail?r=25143
Modified:
/branches/bleeding_edge/src/heap/heap.cc
=======================================
--- /branches/bleeding_edge/src/heap/heap.cc Mon Nov 3 08:43:20 2014 UTC
+++ /branches/bleeding_edge/src/heap/heap.cc Wed Nov 5 11:27:34 2014 UTC
@@ -2038,7 +2038,17 @@
// Order is important: slot might be inside of the target if target
// was allocated over a dead object and slot comes from the store
// buffer.
- *slot = target;
+
+ // Unfortunately, the allocation can also write over the slot if the
slot
+ // was in free space and the allocation wrote free list data (such
as the
+ // free list map or entry size) over the slot. We guard against
this by
+ // checking that the slot still points to the object being moved.
This
+ // should be sufficient because neither the free list map nor the
free
+ // list entry size should look like a new space pointer (the former
is an
+ // old space pointer, the latter is word-aligned).
+ if (*slot == object) {
+ *slot = target;
+ }
MigrateObject(heap, object, target, object_size);
if (object_contents == POINTER_OBJECT) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
