• Anna Henningsen's avatar
    [snapshot] Do not defer ArrayBuffers during snapshotting · ea0719b8
    Anna Henningsen authored
    ArrayBuffer instances are serialized by first re-assigning a index
    to the backing store field, then serializing the object, and then
    storing the actual backing store address again (and the same for the
    ArrayBufferExtension). If serialization of the object itself is deferred,
    the real backing store address is written into the snapshot, which cannot be
    processed when deserializing, leading to a crash.
    
    This fixes this by not deferring ArrayBuffer serialization and adding a DCHECK
    for the crash that previously occurred.
    
    Change-Id: Id9bea8268061bd0770cde7bfeb6695248978f994
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144123
    Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    Reviewed-by: 's avatarDan Elphick <delphick@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#67114}
    ea0719b8
deserializer.h 7.7 KB