• Dominik Inführ's avatar
    Revert "Reland^2: [heap] Store size with invalidated object" · 7840320f
    Dominik Inführ authored
    This reverts commit 2b79eefe.
    
    Reason for revert: Speculative revert because of https://crbug.com/1322305
    
    Original change's description:
    > Reland^2: [heap] Store size with invalidated object
    >
    > This is a reland of commit 23b2d571
    >
    > When updating pointers during a full GC, a page might not be swept
    > already. In such cases there might be invalid objects and slots
    > recorded in free memory. Updating tagged slots in free memory is fine
    > even though not strictly necessary.
    >
    > However, the GC also needs to calculate the size of potentially dead
    > invalid objects in order to be able to check whether a slot is within
    > that object. But since that object is dead, its map might be dead as
    > well which makes size calculation impossible on such objects. The CL
    > changes this to cache the size of invalid objects. A follow-up CL will
    > also check the marking bit of invalid objects.
    >
    > Reason for reverts:
    >
    > Revert #2: In-object slack tracking on JSObjects doesn't update the
    > cached size of invalidated objects. The fix here was to stop
    > invalidating recorded slots on JSObjects at all and avoid that problem
    > completely (see https://crrev.com/c/3620274).
    >
    > Revert #1: Not all size changes go through NotifyObjectLayoutChange, so
    > https://crrev.com/c/3607992 introduced NotifyObjectSizeChange as a
    > bottleneck for object size changes/right-trimming. This method is
    > now used to update the size of invalidated objects.
    >
    > Bug: v8:12578, chromium:1316289
    > Change-Id: I0478d04601c0270ddb39419ca6cf98719951eb4d
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623542
    > Reviewed-by: Jakob Linke <jgruber@chromium.org>
    > Reviewed-by: Patrick Thier <pthier@chromium.org>
    > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
    > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
    > Cr-Commit-Position: refs/heads/main@{#80344}
    
    Bug: v8:12578, chromium:1316289
    Change-Id: I6dd2dd13583123b9cb7933b15e2113fddc0c0b0b
    No-Presubmit: true
    No-Tree-Checks: true
    No-Try: true
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627511
    Owners-Override: Leszek Swirski <leszeks@chromium.org>
    Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
    Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
    Commit-Queue: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#80357}
    7840320f
test-invalidated-slots.cc 16.1 KB