• Clemens Backes's avatar
    Fix data race in TypedArray::copyWithin · 974190b4
    Clemens Backes authored
    Just like many other operations implemented in elements.cc, copyWithin
    also needs to use relaxed atomics if operating on a shared array buffer
    to avoid races with other threads.
    Since the ranges can overlap, this CL also adds a {Relaxed_Memmove}
    function that either copies forwards (like {Relaxed_Memcpy}) or
    backwards depending on the ordering of source and destination.
    
    R=leszeks@chromium.org
    
    Bug: chromium:1221035
    Change-Id: I76b7e43810ac9b85f4ff9abbc5a0406618771c25
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3032084Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#75752}
    974190b4
regress-1221035.js 444 Bytes