Reviewers: Hannes Payer, Michael Starzinger,
Message:
Hi Hannes, here is the code we discussed. Michael, would you take a quick
look
at the Heap::Contains() call in objects.cc?
thx,
--Michael
Description:
Chromium 284577 needs a mitigation CL added. There is a TODO to remove
the mitigation when the cause of the bug is discovered.
BUG=
Please review this at https://codereview.chromium.org/23606032/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+17, -41 lines):
M src/heap.cc
M src/hydrogen.cc
M src/objects-debug.cc
M src/objects.cc
Index: src/heap.cc
diff --git a/src/heap.cc b/src/heap.cc
index
108cfb373e71674f0a976e49d981a959e1be6051..86c2b4aac59a102bdd4b9d41c8a06f283dfd50b5
100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -4310,10 +4310,7 @@ MaybeObject* Heap::AllocateWithAllocationSite(Map*
map, AllocationSpace space,
AllocationMemento* alloc_memento = reinterpret_cast<AllocationMemento*>(
reinterpret_cast<Address>(result) + map->instance_size());
alloc_memento->set_map_no_write_barrier(allocation_memento_map());
-
- // TODO(mvstanton): To diagnose bug 284577, some extra checks
- CHECK(allocation_site->map() == allocation_site_map());
-
+ ASSERT(allocation_site->map() == allocation_site_map());
alloc_memento->set_allocation_site(*allocation_site, SKIP_WRITE_BARRIER);
return result;
}
@@ -5057,10 +5054,7 @@ MaybeObject* Heap::CopyJSObjectWithAllocationSite(
AllocationMemento* alloc_memento;
if (maybe_alloc_memento->To(&alloc_memento)) {
alloc_memento->set_map_no_write_barrier(allocation_memento_map());
-
- // TODO(mvstanton): To diagnose bug 284577, some extra checks
- CHECK(site->map() == allocation_site_map());
-
+ ASSERT(site->map() == allocation_site_map());
alloc_memento->set_allocation_site(site, SKIP_WRITE_BARRIER);
}
}
@@ -5083,10 +5077,7 @@ MaybeObject* Heap::CopyJSObjectWithAllocationSite(
AllocationMemento* alloc_memento =
reinterpret_cast<AllocationMemento*>(
reinterpret_cast<Address>(clone) + object_size);
alloc_memento->set_map_no_write_barrier(allocation_memento_map());
-
- // TODO(mvstanton): To diagnose bug 284577, some extra checks
- CHECK(site->map() == allocation_site_map());
-
+ ASSERT(site->map() == allocation_site_map());
alloc_memento->set_allocation_site(site, SKIP_WRITE_BARRIER);
}
Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index
b567f615d234c3ee59e0f9d808e493b6bfd475b1..9401c4ec584096136368102864cf18806434e2d9
100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -1823,26 +1823,12 @@ void HGraphBuilder::BuildCompareNil(
HValue* HGraphBuilder::BuildCreateAllocationMemento(HValue*
previous_object,
int
previous_object_size,
HValue* alloc_site) {
- // TODO(mvstanton): ASSERT altered to CHECK to diagnose chromium bug
284577
- CHECK(alloc_site != NULL);
+ ASSERT(alloc_site != NULL);
HInnerAllocatedObject* alloc_memento = Add<HInnerAllocatedObject>(
previous_object, previous_object_size);
Handle<Map> alloc_memento_map(
isolate()->heap()->allocation_memento_map());
AddStoreMapConstant(alloc_memento, alloc_memento_map);
-
- {
- // TODO(mvstanton): the code below is turned on to diagnose chromium
bug
- // 284577.
- Handle<Map> alloc_site_map(isolate()->heap()->allocation_site_map());
- IfBuilder builder(this);
- builder.If<HCompareMap>(alloc_site, alloc_site_map);
- builder.Then();
- builder.Else();
- Add<HDebugBreak>();
- builder.End();
- }
-
HObjectAccess access = HObjectAccess::ForAllocationMementoSite();
Add<HStoreNamedField>(alloc_memento, access, alloc_site);
return alloc_memento;
Index: src/objects-debug.cc
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index
acb00da40ed55d5d550758037dba05f1346b6863..ad13d7f5a56a54c9a315a23ee52310835caa7e9d
100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -692,11 +692,6 @@ void JSArray::JSArrayVerify() {
CHECK(elements()->IsUndefined() ||
elements()->IsFixedArray() ||
elements()->IsFixedDoubleArray());
- // TODO(mvstanton): to diagnose chromium bug 284577, remove after.
- AllocationMemento* memento = AllocationMemento::FindForJSObject(this);
- if (memento != NULL && memento->IsValid()) {
- memento->AllocationMementoVerify();
- }
}
}
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
d586c4abf7e292da963c6f2aba3f031ce1b9b700..1fbfbd3b31eae3a9edb95111d07a2d4d7771b54f
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9016,8 +9016,7 @@ AllocationMemento*
AllocationMemento::FindForJSObject(JSObject* object) {
// involves carefully checking the object immediately after the JSArray
// (if there is one) to see if it's an AllocationMemento.
if (FLAG_track_allocation_sites &&
object->GetHeap()->InNewSpace(object)) {
- // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove
after.
- CHECK(object->GetHeap()->InToSpace(object));
+ ASSERT(object->GetHeap()->InToSpace(object));
Address ptr_end = (reinterpret_cast<Address>(object) - kHeapObjectTag)
+
object->Size();
if ((ptr_end + AllocationMemento::kSize) <=
@@ -9027,15 +9026,20 @@ AllocationMemento*
AllocationMemento::FindForJSObject(JSObject* object) {
reinterpret_cast<Map**>(ptr_end);
if (*possible_allocation_memento_map ==
object->GetHeap()->allocation_memento_map()) {
- Address ptr_object = reinterpret_cast<Address>(object);
- // TODO(mvstanton): CHECK to diagnose chromium bug 284577, remove
after.
- // If this check fails it points to the very unlikely case that
we've
- // misinterpreted a page header as an allocation memento. Follow up
- // with a real fix.
- CHECK(Page::FromAddress(ptr_object) == Page::FromAddress(ptr_end));
AllocationMemento* memento = AllocationMemento::cast(
reinterpret_cast<Object*>(ptr_end + kHeapObjectTag));
- return memento;
+
+ // TODO(mvstanton): because of chromium bug 284577, put extra care
+ // into validating that the memento points to a valid
AllocationSite.
+ // This check is expensive so remove it asap. Also, this check
+ // HIDES bug 284577, so it must be disabled to debug/diagnose.
+ Object* site = memento->allocation_site();
+ Address site_address = (reinterpret_cast<Address>(site) -
+ kHeapObjectTag);
+ if (IsAddressAligned(site_address, kPointerSize) &&
+ object->GetHeap()->Contains(site_address)) {
+ return memento;
+ }
}
}
}
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
