Reviewers: Vyacheslav Egorov,
Message:
PTAL.
Description:
Fix map modification in transition tree traversal.
[email protected]
BUG=v8:1672
TEST=cctest/test-decls/Present
Please review this at http://codereview.chromium.org/8082023/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files:
M src/objects-inl.h
M src/objects.h
M src/objects.cc
Index: src/objects-inl.h
diff --git a/src/objects-inl.h b/src/objects-inl.h
index
cc70bfa8e53a1e96ade1dbf2f6f0c0b17da4a017..bafa8b3299c18dfb8a3e0cf99acbea65169ed558
100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -1229,9 +1229,9 @@ Map* HeapObject::map() {
}
-void HeapObject::set_map(Map* value) {
+void HeapObject::set_map(Map* value, WriteBarrierMode mode) {
set_map_word(MapWord::FromMap(value));
- if (value != NULL) {
+ if (mode == UPDATE_WRITE_BARRIER && value != NULL) {
// TODO(1600) We are passing NULL as a slot because maps can never be
on
// evacuation candidate.
value->GetHeap()->incremental_marking()->RecordWrite(this, NULL,
value);
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
aa0b6f227f25b9a74089097467f4742c26f59854..a50a96cd50a6d40b3357a77fe1ec85c2ee85379c
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4474,7 +4474,7 @@ void Map::TraverseTransitionTree(TraverseCallback
callback, void* data) {
// of the next map and recording the index in the transition
array in
// the map field of the array.
Map* next = Map::cast(contents->get(i));
- next->set_map(current);
+ next->set_map(current, SKIP_WRITE_BARRIER);
*map_or_index_field = Smi::FromInt(i + 2);
current = next;
map_done = false;
@@ -4499,7 +4499,7 @@ void Map::TraverseTransitionTree(TraverseCallback
callback, void* data) {
Object* perhaps_map = prototype_transitions->get(i);
if (perhaps_map->IsMap()) {
Map* next = Map::cast(perhaps_map);
- next->set_map(current);
+ next->set_map(current, SKIP_WRITE_BARRIER);
*proto_map_or_index_field =
Smi::FromInt(i + kProtoTransitionElementsPerEntry);
current = next;
@@ -4515,7 +4515,7 @@ void Map::TraverseTransitionTree(TraverseCallback
callback, void* data) {
// the map field, which is being used to track the traversal and put
the
// correct map (the meta_map) in place while we do the callback.
Map* prev = current->map();
- current->set_map(meta_map);
+ current->set_map(meta_map, SKIP_WRITE_BARRIER);
callback(current, data);
current = prev;
}
Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index
ad6deed8caeac31a60a2cd292ac49479a5e676b1..c26e2a03993ac57e17ad2e184d0c3aea96aa0073
100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -1126,7 +1126,7 @@ class HeapObject: public Object {
// [map]: Contains a map which contains the object's reflective
// information.
inline Map* map();
- inline void set_map(Map* value);
+ inline void set_map(Map* value, WriteBarrierMode mode =
UPDATE_WRITE_BARRIER);
// During garbage collection, the map word of a heap object does not
// necessarily contain a map pointer.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
