Commit a9428d52 authored by Ulan Degenbaev's avatar Ulan Degenbaev Committed by Commit Bot

Revert "[heap, runtime] Fix data race in prototype map transition during"

This reverts commit b2d1f272.

Reason for revert: assertion failure

Original change's description:
> [heap, runtime] Fix data race in prototype map transition during
> concurrent marking.
> 
> BUG=chromium:694255
> 
> Change-Id: I172167623e9deab692fb506d7d4211d210b09a80
> Reviewed-on: https://chromium-review.googlesource.com/579092
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46813}

TBR=ulan@chromium.org,ishell@chromium.org

Change-Id: Ida5c66c3e880b9a03ffacbc6f32b1d5b2cfc8260
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:694255
Reviewed-on: https://chromium-review.googlesource.com/581287Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46815}
parent c179400b
......@@ -4522,8 +4522,7 @@ void Heap::NotifyObjectLayoutChange(HeapObject* object,
incremental_marking()->MarkBlackAndPush(object);
}
#ifdef VERIFY_HEAP
DCHECK(pending_layout_change_object_ == nullptr ||
pending_layout_change_object_ == object);
DCHECK(pending_layout_change_object_ == nullptr);
pending_layout_change_object_ = object;
#endif
}
......
......@@ -4129,13 +4129,6 @@ void JSObject::MigrateToMap(Handle<JSObject> object, Handle<Map> new_map,
// Slow-to-slow migration is trivial.
object->synchronized_set_map(*new_map);
} else if (!new_map->is_dictionary_map()) {
if (old_map->is_prototype_map()) {
DisallowHeapAllocation no_allocation;
// Ensure that the object is marked because its old map is going
// to drop the descriptor array and the layout descriptor, which
// is unsafe for the concurrent marker.
object->GetHeap()->NotifyObjectLayoutChange(*object, no_allocation);
}
MigrateFastToFast(object, new_map);
if (old_map->is_prototype_map()) {
DCHECK(!old_map->is_stable());
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment