commit | 5b434929a34f846f0002857765a3f505e0a2d736 | [log] [tgz] |
---|---|---|
author | Ulan Degenbaev <ulan@chromium.org> | Tue Aug 07 19:15:43 2018 |
committer | Commit Bot <commit-bot@chromium.org> | Tue Aug 07 19:15:58 2018 |
tree | 44616370f3609fbaebf10325fd90ec8d13fa75fb | |
parent | 719d23c032a5d92998505fb642a7afd361f3e3ea [diff] |
Revert "Fix invalidation of old-to-old slots after object trimming." This reverts commit 719d23c032a5d92998505fb642a7afd361f3e3ea. Reason for revert: TSAN failures Original change's description: > Fix invalidation of old-to-old slots after object trimming. > > A recorded old-to-old slot may be overwritten with a pointer to a new > space object. If the object containing the slot is trimmed later on, > then the mark-compactor may crash on a stale pointer to new space. > > This patch ensures that: > 1) On trimming of an object we add it to the invalidated_slots sets. > 2) The InvalidatedSlotsFilter::IsValid returns false for slots outside > the invalidated object unless the page was already swept. > > Array left-trimming is handled as a special case because object start > moves and cannot be added to the invalidated set. Instead, we clear > the freed memory so that the recorded slots contain Smi values. > > Bug: chromium:870226,chromium:816426 > Change-Id: Iffc05a58fcf52ece45fdb085b5d1fd4b3acb5d53 > Reviewed-on: https://chromium-review.googlesource.com/1163784 > Commit-Queue: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/master@{#54953} TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org Change-Id: I2e1ff83c2db7902488951a8f597d38133aeb3b04 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:870226, chromium:816426 Reviewed-on: https://chromium-review.googlesource.com/1165862 Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#54954}
V8 is Google's open source JavaScript engine.
V8 implements ECMAScript as specified in ECMA-262.
V8 is written in C++ and is used in Google Chrome, the open source browser from Google.
V8 can run standalone, or can be embedded into any C++ application.
V8 Project page: https://github.com/v8/v8/wiki
Checkout depot tools, and run
fetch v8
This will checkout V8 into the directory v8
and fetch all of its dependencies. To stay up to date, run
git pull origin gclient sync
For fetching all branches, add the following into your remote configuration in .git/config
:
fetch = +refs/branch-heads/*:refs/remotes/branch-heads/* fetch = +refs/tags/*:refs/tags/*
Please follow the instructions mentioned on the V8 wiki.