• Dominik Inführ's avatar
    [heap] Check liveness of invalidated objects in UpdateUntypedPointers · e9af212a
    Dominik Inführ authored
    This is a follow-up CL to https://crrev.com/c/3623542.
    
    When updating pointers during a full GC, a page might not be swept
    already. In such cases there might be invalid objects in free memory.
    Since these objects might be dead, their maps might have been reclaimed
    already as well.
    
    The previous CL cached the size of invalid objects in order to avoid
    accessing an invalid object's map. However, as soon as a slot is within
    an invalid object, we also need to check whether this slot is still a
    tagged pointer which would require map access. This CL checks marking
    bits on invalid objects to skip that check on such invalid objects.
    
    Bug: v8:12578, chromium:1316289
    Change-Id: Ie1d736f897a2994dbed7bfb95ed37732cd3b0882
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596123Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
    Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#80609}
    e9af212a
test-invalidated-slots.cc 17.2 KB