Commit 5c8295be authored by Michael Lippautz's avatar Michael Lippautz Committed by V8 LUCI CQ

[heap] Do not assume non-empty TracedReference in marker

Most paths filter out empty reference on cppgc::Visitor or
v8::JSVisitor level. For v8::TracedReference we may end up with empty
reference in case of ephemeron tracing which cannot perfom the null
checks on the outer visitor.

Bug: chromium:1315550, v8:12600
Change-Id: I5ebb466100a6f2cf25a75585fc2267a632497548
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3582124Reviewed-by: 's avatarOmer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79943}
parent 13407a88
...@@ -18,9 +18,18 @@ namespace internal { ...@@ -18,9 +18,18 @@ namespace internal {
class BasicTracedReferenceExtractor { class BasicTracedReferenceExtractor {
public: public:
static Address* ObjectReference(const TracedReferenceBase& ref) { static Object GetObjectForMarking(const TracedReferenceBase& ref) {
return const_cast<Address*>( Address* global_handle_location = const_cast<Address*>(
reinterpret_cast<const Address*>(ref.GetSlotThreadSafe())); reinterpret_cast<const Address*>(ref.GetSlotThreadSafe()));
// We cannot assume that the reference is non-null as we may get here by
// tracing an ephemeron which doesn't have early bailouts, see
// `cppgc::Visitor::TraceEphemeron()` for non-Member values.
if (!global_handle_location) return Object();
GlobalHandles::MarkTraced(global_handle_location);
return Object(
reinterpret_cast<std::atomic<Address>*>(global_handle_location)
->load(std::memory_order_relaxed));
} }
}; };
...@@ -29,13 +38,7 @@ void UnifiedHeapMarkingState::MarkAndPush( ...@@ -29,13 +38,7 @@ void UnifiedHeapMarkingState::MarkAndPush(
// The following code will crash with null pointer derefs when finding a // The following code will crash with null pointer derefs when finding a
// non-empty `TracedReferenceBase` when `CppHeap` is in detached mode. // non-empty `TracedReferenceBase` when `CppHeap` is in detached mode.
Address* global_handle_location = Object object = BasicTracedReferenceExtractor::GetObjectForMarking(reference);
BasicTracedReferenceExtractor::ObjectReference(reference);
DCHECK_NOT_NULL(global_handle_location);
GlobalHandles::MarkTraced(global_handle_location);
Object object(reinterpret_cast<std::atomic<Address>*>(global_handle_location)
->load(std::memory_order_relaxed));
if (!object.IsHeapObject()) { if (!object.IsHeapObject()) {
// The embedder is not aware of whether numbers are materialized as heap // The embedder is not aware of whether numbers are materialized as heap
// objects are just passed around as Smis. // objects are just passed around as Smis.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment