• Bill Budge's avatar
    Revert "[compiler] Consider IsPendingAllocation in Ref construction" · d23dbf3b
    Bill Budge authored
    This reverts commit 5f0ac36c.
    
    Reason for revert: Seems to be associated with multiple Sanitizer failures:
    
    https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/3176
    
    Original change's description:
    > [compiler] Consider IsPendingAllocation in Ref construction
    >
    > The logic in JSHeapBroker::TryGetOrCreateData assumes that parts
    > of the object are safe to read. In particular, the instance type
    > must be readable for the chain of `Is##Name()` type checks.
    >
    > This is guaranteed if
    >
    >  - a global memory fence happened after object initialization and
    >    prior to the read by the compiler; or
    >  - the object was published through a release store and read through
    >    an acquire read.
    >
    > The former is protected by the new call to ObjectMayBeUninitialized
    > (which internally calls IsPendingAllocation) in TryGetOrCreateData.
    >
    > The latter must be marked explicitly by calling the new
    > MakeRefAssumeMemoryFence variant.
    >
    > Note that support in this CL is expected to be incomplete and will
    > have to be extended in the future as more cases show up in which
    > MakeRef calls must be converted to MakeRefAssumeMemoryFence or to
    > TryMakeRef.
    >
    > Bug: v8:7790,v8:11711
    > Change-Id: Ic2f7d9fc46e4bfc3f6bbe42816f73fc5ec174337
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874663
    > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    > Reviewed-by: Georg Neis <neis@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#74474}
    
    Bug: v8:7790
    Bug: v8:11711
    Change-Id: Ia736cd1143da30ca25fdc2c3c1a2056ebf18d596
    No-Presubmit: true
    No-Tree-Checks: true
    No-Try: true
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883245
    Auto-Submit: Bill Budge <bbudge@chromium.org>
    Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
    Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
    Cr-Commit-Position: refs/heads/master@{#74484}
    d23dbf3b
js-heap-broker.cc 44.3 KB