• Seth Brenith's avatar
    Fix crashes introduced by "Fix leaks due to deoptimization literals" · 6e9f5de2
    Seth Brenith authored
    My previous change https://crrev.com/c/3160299 introduced a runtime
    CHECK that crashes the process if V8 attempts to read a deoptimization
    literal which has been cleared. That CHECK is indeed crashing the
    process.
    
    It appears that the trouble arises in cases where the deoptimization
    data indicates that an object should be materialized as needed. In those
    cases, one of the deoptimization literals is the Map to use when
    materializing the object. It is possible to reach a part of the code
    that requires the materialized object, and therefore the Map, without
    there being any other owner of that Map. This is in contrast to most
    other deoptimization literals, which are logically equivalent to omitted
    values from the stack frame and therefore can't be reached without a
    real owner somewhere to keep them alive.
    
    To fix, I propose referring to Maps strongly from the deoptimization
    literals. The cases I investigated in v8:4578 didn't involve Maps, so I
    believe that the observed memory leaks are still fixed with this change.
    
    Bug: chromium:1268681, chromium:1268683, chromium:1268825, v8:12300
    Change-Id: Ifd32a7f9cc29e0384650013ab16e05646bf57895
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3272880
    Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
    Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#77857}
    6e9f5de2
code-inl.h 44 KB