Commit 6fbbe93c authored by Ulan Degenbaev's avatar Ulan Degenbaev Committed by Commit Bot

Revert "[heap, runtime] Fix data race in prototype map transition during"

This reverts commit d8846ffd.

Reason: the fix doesn't work, the proper fix is to not mutate the map.

BUG=chromium:694255
TBR=ishell@chromium.org

Change-Id: Iebef7cd01081145c172902727e0035a8745703b7
Reviewed-on: https://chromium-review.googlesource.com/594727Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47020}
parent 30a7d497
...@@ -4178,11 +4178,6 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map, ...@@ -4178,11 +4178,6 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
} else if (!new_map->is_dictionary_map()) { } else if (!new_map->is_dictionary_map()) {
MigrateFastToFast(object, new_map); MigrateFastToFast(object, new_map);
if (old_map->is_prototype_map()) { if (old_map->is_prototype_map()) {
DisallowHeapAllocation no_allocation;
// Ensure that the object is marked because its old map is going
// to drop the descriptor array and the layout descriptor, which
// is unsafe for the concurrent marker.
object->GetHeap()->NotifyObjectLayoutChange(*object, no_allocation);
DCHECK(!old_map->is_stable()); DCHECK(!old_map->is_stable());
DCHECK(new_map->is_stable()); DCHECK(new_map->is_stable());
// Clear out the old descriptor array to avoid problems to sharing // Clear out the old descriptor array to avoid problems to sharing
...@@ -4193,11 +4188,6 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map, ...@@ -4193,11 +4188,6 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
// Ensure that no transition was inserted for prototype migrations. // Ensure that no transition was inserted for prototype migrations.
DCHECK_EQ(0, TransitionsAccessor(old_map).NumberOfTransitions()); DCHECK_EQ(0, TransitionsAccessor(old_map).NumberOfTransitions());
DCHECK(new_map->GetBackPointer()->IsUndefined(new_map->GetIsolate())); DCHECK(new_map->GetBackPointer()->IsUndefined(new_map->GetIsolate()));
#ifdef VERIFY_HEAP
// When verify heap is on, NotifyObjectLayoutChange checks that
// it is followed by VerifyObjectLayoutChange after the map change.
object->GetHeap()->VerifyObjectLayoutChange(*object, *new_map);
#endif
} }
} else { } else {
MigrateFastToSlow(object, new_map, expected_additional_properties); MigrateFastToSlow(object, new_map, expected_additional_properties);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment