Commit 60f62177 authored by Sigurd Schneider's avatar Sigurd Schneider Committed by Commit Bot

[heap] Fix benign race in CopyElements

Bug: v8:9032
Change-Id: Ibd607d164bbc31aa41887db51c4ade575a37b227
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1547658Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60555}
parent d4550f4a
...@@ -1526,18 +1526,38 @@ void Heap::MoveElements(FixedArray array, int dst_index, int src_index, int len, ...@@ -1526,18 +1526,38 @@ void Heap::MoveElements(FixedArray array, int dst_index, int src_index, int len,
FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(this, array, dst_index, len); FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(this, array, dst_index, len);
} }
void Heap::CopyElements(FixedArray dst, FixedArray src, int dst_index, void Heap::CopyElements(FixedArray dst_array, FixedArray src_array,
int src_index, int len, WriteBarrierMode mode) { int dst_index, int src_index, int len,
DCHECK_NE(dst, src); WriteBarrierMode mode) {
DCHECK_NE(dst_array, src_array);
if (len == 0) return; if (len == 0) return;
DCHECK_NE(dst->map(), ReadOnlyRoots(this).fixed_cow_array_map()); DCHECK_NE(dst_array->map(), ReadOnlyRoots(this).fixed_cow_array_map());
ObjectSlot dst_slot = dst->RawFieldOfElementAt(dst_index); ObjectSlot dst = dst_array->RawFieldOfElementAt(dst_index);
ObjectSlot src_slot = src->RawFieldOfElementAt(src_index); ObjectSlot src = src_array->RawFieldOfElementAt(src_index);
MemMove(dst_slot.ToVoidPtr(), src_slot.ToVoidPtr(), len * kTaggedSize); if (FLAG_concurrent_marking && incremental_marking()->IsMarking()) {
if (dst < src) {
for (int i = 0; i < len; i++) {
dst.Relaxed_Store(src.Relaxed_Load());
++dst;
++src;
}
} else {
// Copy backwards.
dst += len - 1;
src += len - 1;
for (int i = 0; i < len; i++) {
dst.Relaxed_Store(src.Relaxed_Load());
--dst;
--src;
}
}
} else {
// TODO(sigurds): Figure out whether we can use MemCopy here.
MemMove(dst.ToVoidPtr(), src.ToVoidPtr(), len * kTaggedSize);
}
if (mode == SKIP_WRITE_BARRIER) return; if (mode == SKIP_WRITE_BARRIER) return;
FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(this, dst, dst_index, len); FIXED_ARRAY_ELEMENTS_WRITE_BARRIER(this, dst_array, dst_index, len);
} }
#ifdef VERIFY_HEAP #ifdef VERIFY_HEAP
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment