• Benedikt Meurer's avatar
    [es9] Fix object cloning wrt. MutableHeapNumbers. · 80f7c4a8
    Benedikt Meurer authored
    Previously the object cloning fast-path had a single loop which would
    initialize the object _and_ at the same time clone MutableHeapNumbers.
    But since that can trigger GCs, the heap verifier was a bit sad to see
    double fields holding undefined values. This was flushed out by the CL
    https://chromium-review.googlesource.com/1655291, which changed the GC
    timing slightly and thus made the test crash in the verifier.
    
    So instead of the one loop, we now have a second loop that takes care
    of cloning any MutableHeapNumbers. This has the advantage that the first
    loop can always run without write barriers.
    
    Bug: chromium:964748, chromium:973045, v8:7611, v8:9114, v8:9183, v8:9343
    Change-Id: I724a1c1e534243ce9ecde95bf0c07ca26363b515
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655307
    Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
    Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
    Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#62114}
    80f7c4a8
accessor-assembler.cc 146 KB