• Michael Lippautz's avatar
    cppgc: Fix CTP destruction · 760682da
    Michael Lippautz authored
    Double-checked locking pattern for destruction was missing the acquire
    barrier for the initial load.
    
    TSAN complained with a data race where:
    T1: ClearAllUsedNodes(), clearing out the node
    T2: a. if(GetNodeSafe()) { Lock; ... }
    T2: b. operator delete
    
    Since GetNodeSafe() was a relaxed load, operator delete was allowed to
    be reordered which raced with ClearAllUsedNodes().
    
    Bug: chromium:1239081, chromium:1242795
    Change-Id: I3906555b13cc51538a1a54b7ca481a96d81fd84e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3132264
    Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
    Reviewed-by: 's avatarOmer Katz <omerkatz@chromium.org>
    Reviewed-by: 's avatarAnton Bikineev <bikineev@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#76599}
    760682da
cross-thread-persistent.h 14.7 KB