• Dominik Inführ's avatar
    Reland^3: [heap] Store size with invalidated object · 34da5f5b
    Dominik Inführ authored
    This is a reland of commit 2b79eefe
    
    A DCHECK was using map[key] and inadvertently inserted into the map
    that way.
    
    Original change's description:
    > Reland^2: [heap] Store size with invalidated object
    >
    > This is a reland of commit 23b2d571
    >
    > When updating pointers during a full GC, a page might not be swept
    > already. In such cases there might be invalid objects and slots
    > recorded in free memory. Updating tagged slots in free memory is fine
    > even though not strictly necessary.
    >
    > However, the GC also needs to calculate the size of potentially dead
    > invalid objects in order to be able to check whether a slot is within
    > that object. But since that object is dead, its map might be dead as
    > well which makes size calculation impossible on such objects. The CL
    > changes this to cache the size of invalid objects. A follow-up CL will
    > also check the marking bit of invalid objects.
    >
    > Reason for reverts:
    >
    > Revert #2: In-object slack tracking on JSObjects doesn't update the
    > cached size of invalidated objects. The fix here was to stop
    > invalidating recorded slots on JSObjects at all and avoid that problem
    > completely (see https://crrev.com/c/3620274).
    >
    > Revert #1: Not all size changes go through NotifyObjectLayoutChange, so
    > https://crrev.com/c/3607992 introduced NotifyObjectSizeChange as a
    > bottleneck for object size changes/right-trimming. This method is
    > now used to update the size of invalidated objects.
    >
    > Bug: v8:12578, chromium:1316289
    > Change-Id: I0478d04601c0270ddb39419ca6cf98719951eb4d
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623542
    > Reviewed-by: Jakob Linke <jgruber@chromium.org>
    > Reviewed-by: Patrick Thier <pthier@chromium.org>
    > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
    > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
    > Cr-Commit-Position: refs/heads/main@{#80344}
    
    Bug: v8:12578, chromium:1316289
    Change-Id: Ibcc04c209213c584860a7c473082526cb4e53c59
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627635Reviewed-by: 's avatarPatrick Thier <pthier@chromium.org>
    Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
    Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
    Reviewed-by: 's avatarNico Hartmann <nicohartmann@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#80542}
    34da5f5b
invalidated-slots-inl.h 2.64 KB