Commit 4d2869dc authored by Mike Stanton's avatar Mike Stanton Committed by V8 LUCI CQ

[compiler] Fix data race in JSObject::RawFastInobjectPropertyAtPut

Mark the write of the property as relaxed atomic. The compiler thread
is examining the value. It is fine if the value is stale or new, we
simply need to let TSAN know we are aware of the race.

BUG=v8:11896

Change-Id: I42505a6e12c7eb3c1ef8d9376d7a420567646d62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2968403Reviewed-by: 's avatarSantiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75209}
parent 52b62586
......@@ -384,7 +384,7 @@ void JSObject::RawFastInobjectPropertyAtPut(FieldIndex index, Object value,
WriteBarrierMode mode) {
DCHECK(index.is_inobject());
int offset = index.offset();
WRITE_FIELD(*this, offset, value);
RELAXED_WRITE_FIELD(*this, offset, value);
CONDITIONAL_WRITE_BARRIER(*this, offset, value, mode);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment