• Ulan Degenbaev's avatar
    Make Map::instance_type accessors atomic · 4d07f3f2
    Ulan Degenbaev authored
    This fixes a false positive TSAN report where an object transitions to
    a new map in StoreIC. The scenario:
    1) Object a transitions from map1 to a newly created map2 in runtime.
       The map is installed with a release-store.
    2) Object b transitions from map1 to map2 in StoreIC in generated code
       that is not visible to TSAN.
    3) Concurrent marker visits object b and loads it map with an acquire
       load.
    
    Since TSAN does not see the store in step (2) it thinks that the map
    loaded in (3) is freshly allocated and is not guarded by a release
    store.
    
    Bug: v8:11353
    Change-Id: Ifcace9edff987761a4098d3fdfb98c6190f1ee1e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2682641Reviewed-by: 's avatarDominik Inführ <dinfuehr@chromium.org>
    Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#72578}
    4d07f3f2
map-inl.h 30.1 KB