-
ulan authored
The mutator can convert a pointer slot of a JSObject to an unboxed double slot. To make it we safe for the concurrent marker, we require synchronization using the object markbits. The concurrent marker visits the JSObject as follows: - save snapshot of object slot addresses and values. - visit the snapshot only after successful transition of the object from grey to black. Before an unsafe layout change the mutator colors the object black and visits it using the bailout marking deque. BUG=chromium:694255 Review-Url: https://codereview.chromium.org/2876553002 Cr-Commit-Position: refs/heads/master@{#45254}
8a5382b7