I don't think it's MigrateToMap itself that's causing the problem in this case (I tried doing a GC right before MigrateToMap and _that_ GC triggered a verification failure), but rather the setup code, which synthesizes a descriptor array and a JSObject before initializing it.
I ended up doing (2) in https://chromium-review.googlesource.com/c/486062/ for both tests (and it sounds like, from Jakob and Igor's comments, that's the right way to go generally). On Mon, Apr 24, 2017 at 10:23 PM, Yang Guo <[email protected]> wrote: > JSObject::MigrateToMap can allocate. In this test, it apparently leaves > the heap in an inconsistent state. Sounds like a bug to me. > > Cheers, > > Yang > > On Tue, Apr 25, 2017 at 1:48 AM Adam Klein <[email protected]> wrote: > >> The test cctest/test-unboxed-doubles/Regress436816 >> <https://cs.chromium.org/chromium/src/v8/test/cctest/test-unboxed-doubles.cc?rcl=72d17915df27ddf10d504f76be379a560820fd01&l=913> >> is >> currently failing on the arm64 nosnap bot. From a quick investigation, >> it seems the problem is that in this particular configuration, the call to >> JSObject::MigrateToMap in the test is triggering a GC (and an associated >> heap verification) before the test expects it to happen. >> >> What's the right pattern here? I can think of some possibilities: >> >> 1) Should the test disable heap verification for its body and only turn >> it on at the end? >> 2) Should it try to collect garbage more aggressively in the test? >> >> (1) seems relatively reasonable, except I worry it would result in losing >> coverage. (2) seems cludgy but likely effective. >> >> Thoughts? >> >> - Adam >> >> -- >> -- >> v8-dev mailing list >> [email protected] >> http://groups.google.com/group/v8-dev >> --- >> You received this message because you are subscribed to the Google Groups >> "v8-dev" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> > -- > > > > * • * > *Yang Guo** • **Google Germany GmbH* > * • *Erika-Mann-Str. 33 > * • *80636 Munich > > • [email protected] > > > Geschäftsführer: Matthew Scott Sucherman, Paul Terence Manicle > > Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: > Hamburg > > Diese E-Mail ist vertraulich. Wenn Sie nicht der richtige Adressat sind, > leiten Sie diese bitte nicht weiter, informieren Sie den Absender und > löschen Sie die E-Mail und alle Anhänge. Vielen Dank. This e-mail is > confidential. If you are not the right addressee please do not forward it, > please inform the sender, and please erase this e-mail including any > attachments. Thanks. > > -- > -- > v8-dev mailing list > [email protected] > http://groups.google.com/group/v8-dev > --- > You received this message because you are subscribed to the Google Groups > "v8-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev --- You received this message because you are subscribed to the Google Groups "v8-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
