Commit 190fea60 authored by Ulan Degenbaev's avatar Ulan Degenbaev Committed by Commit Bot

Change FastArrayShift stub to use for-loop instead of memmove for SMIs.

The concurrent marker visits arrays with fast SMI elements because they
have the same visitor id as arrays with tagged elements.

Visiting concurrently with memmove can be unsafe depending on memmove
implementation.

Bug: chromium:694255
Change-Id: Ic6c2cae8761e5b1b042e4274d4f90ac59f32d91f
Reviewed-on: https://chromium-review.googlesource.com/712158
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48454}
parent e44fdc70
...@@ -1167,17 +1167,16 @@ TF_BUILTIN(FastArrayShift, CodeStubAssembler) { ...@@ -1167,17 +1167,16 @@ TF_BUILTIN(FastArrayShift, CodeStubAssembler) {
BIND(&fast_elements_smi); BIND(&fast_elements_smi);
{ {
Node* value = LoadFixedArrayElement(elements, 0); Node* value = LoadFixedArrayElement(elements, 0);
int32_t header_size = FixedDoubleArray::kHeaderSize - kHeapObjectTag; BuildFastLoop(IntPtrConstant(0), new_length,
Node* memmove = [&](Node* index) {
ExternalConstant(ExternalReference::libc_memmove_function(isolate())); StoreFixedArrayElement(
Node* start = IntPtrAdd( elements, index,
BitcastTaggedToWord(elements), LoadFixedArrayElement(
ElementOffsetFromIndex(IntPtrConstant(0), HOLEY_SMI_ELEMENTS, elements, IntPtrAdd(index, IntPtrConstant(1))),
INTPTR_PARAMETERS, header_size)); SKIP_WRITE_BARRIER);
CallCFunction3(MachineType::AnyTagged(), MachineType::Pointer(), },
MachineType::Pointer(), MachineType::UintPtr(), memmove, 1, ParameterMode::INTPTR_PARAMETERS,
start, IntPtrAdd(start, IntPtrConstant(kPointerSize)), IndexAdvanceMode::kPost);
IntPtrMul(new_length, IntPtrConstant(kPointerSize)));
StoreFixedArrayElement(elements, new_length, TheHoleConstant()); StoreFixedArrayElement(elements, new_length, TheHoleConstant());
GotoIf(WordEqual(value, TheHoleConstant()), &return_undefined); GotoIf(WordEqual(value, TheHoleConstant()), &return_undefined);
args.PopAndReturn(value); args.PopAndReturn(value);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment