• Omer Katz's avatar
    cppgc: Fix termination GCs · 7a22cf7a
    Omer Katz authored
    Whenever we destroy an object that contains a
    (Weak)(CrossThread)Persistent, we call the Persistent's dtor which frees
    the relevant PersistentNode. To get the PersistentRegion for the node,
    we get the value, then get the the relevant page which holds a reference
    to the heap which holds the regions.
    
    During a termination GC there is no marking and no weak callback
    processing. That means that, when destroying a Persistent, the page on
    which the object referenced by the Persistent resides may have already
    been swept and destroyed. Then when we try to get the page we cleared or
    unallocated memory and crash.
    This issue presented as a sweeper crash in the web tests and
    content_browsertests.
    
    This issue affects only Weak(CrossThread)Persistent since the region for
    their strong counterparts are already cleared at the start of a
    termination GC.
    This is not an issue in the Blink impl because (1) Blink finds the
    elevant regions through ThreadState without going through pages, and
    (2) Blink runs a  full GC on termination that includes executing weak
    callbacks.
    
    Alternatively we could trace the Weak(CrossThread)Persistent region
    which will run the weakness callbacks and clear all WeakPersistents.
    The cost and outcome is equivalent.
    
    Bug: chromium:1056170
    Change-Id: I3db5b01424500eb695f9876247ef0c787d0d9ef2
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2708645
    Commit-Queue: Omer Katz <omerkatz@chromium.org>
    Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#72897}
    7a22cf7a
Name
Last commit
Last update
.github Loading commit data...
build_overrides Loading commit data...
custom_deps Loading commit data...
docs Loading commit data...
gni Loading commit data...
include Loading commit data...
infra Loading commit data...
samples Loading commit data...
src Loading commit data...
test Loading commit data...
testing Loading commit data...
third_party Loading commit data...
tools Loading commit data...
.clang-format Loading commit data...
.clang-tidy Loading commit data...
.editorconfig Loading commit data...
.flake8 Loading commit data...
.git-blame-ignore-revs Loading commit data...
.gitattributes Loading commit data...
.gitignore Loading commit data...
.gn Loading commit data...
.vpython Loading commit data...
.ycm_extra_conf.py Loading commit data...
AUTHORS Loading commit data...
BUILD.gn Loading commit data...
CODE_OF_CONDUCT.md Loading commit data...
COMMON_OWNERS Loading commit data...
DEPS Loading commit data...
DIR_METADATA Loading commit data...
ENG_REVIEW_OWNERS Loading commit data...
INFRA_OWNERS Loading commit data...
INTL_OWNERS Loading commit data...
LICENSE Loading commit data...
LICENSE.fdlibm Loading commit data...
LICENSE.strongtalk Loading commit data...
LICENSE.v8 Loading commit data...
MIPS_OWNERS Loading commit data...
OWNERS Loading commit data...
PPC_OWNERS Loading commit data...
PRESUBMIT.py Loading commit data...
README.md Loading commit data...
RISCV_OWNERS Loading commit data...
S390_OWNERS Loading commit data...
WATCHLISTS Loading commit data...
codereview.settings Loading commit data...