• Seth Brenith's avatar
    Add verifier for retaining paths in heap snapshots · d937a0bb
    Seth Brenith authored
    The web app owner who notified me about bugs v8:12112 and v8:12126 asked
    me a reasonable question: "how am I ever supposed to trust the retaining
    paths in the devtools, if the heap snapshot is generated by a different
    component than the actual marking code?". This change is my attempt to
    answer that question. If verification is enabled, the heap snapshot
    generator will visit each heap object with a realistic marking visitor
    to find all references from that object. It will then check that those
    references match the HeapGraphEdges in the snapshot.
    
    I also considered the idea that we could collect retaining information
    during the last GC cycle before taking the heap snapshot, or during an
    extra GC cycle immediately after. However, running the full GC provides
    the embedder with the opportunity to run arbitrary code (including JS)
    both before and after PerformGarbageCollection, so there is no clear
    guarantee that the heap state during the snapshot actually matches the
    heap state during marking.
    
    Bug: v8:12112, v8:12126
    Change-Id: Id29e75ecf9eee19e35daedbdb4a3e1df64785380
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3299590Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
    Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
    Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
    Cr-Commit-Position: refs/heads/main@{#78952}
    d937a0bb
reference-summarizer.cc 4.06 KB