• Clemens Hammacher's avatar
    [wasm][gc] Fix infinite GC loop · ac497d1c
    Clemens Hammacher authored
    One fundamental assumption of the wasm code GC is that code becomes
    "potentially dead" at most once; if the ref counts drops to zero later,
    it should be freed for real.
    In the current implementation, it happens that code becomes potentially
    dead, then becomes dead for real (it's removed from the set of
    potentially dead code), and then we remove the last reference. At that
    point, we re-add the code to the potentially dead code, considering it
    for garbage collection again. This can lead to an endless loop.
    
    This CL fixes that by remembering which code was already detected as
    dead, and does not consider this code for another GC.
    This requires freeing code via the {WasmEngine} such that the set of
    dead code can be cleaned up.
    
    R=mstarzinger@chromium.org
    
    Bug: v8:8217
    Change-Id: If6a95a7918db2ad82edfad5447c536593243db7d
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585845Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
    Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#61073}
    ac497d1c
wasm-engine.h 10.6 KB