-
Michael Achenbach authored
This reverts commit 3d846115. Reason for revert: The test hangs flakily on windows: https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/20612 https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20nosnap%20-%20shared/33147 https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20debug/19945 Original change's description: > [typedarray] Fix crash when sorting SharedArrayBuffers > > TypedArray#sort has a fast-path when the user does not provide a > comparison function. This fast-path utilizes std::sort which operates > directly on the raw data. Per spec, std::sort requires the "less than" > operation to be anti-symmetric and transitive. > > When sorting SharedArrayBuffers (SAB) that are concurrently modified during > sorting, the "less than" operator stops being consistent as the > underlying data is constantly modified. This breaks some invariants > in std::sort resulting in infinite loops or straight out segfaults. > > This CL fixes this by copying the data before sorting SABs and > writing the sorted result back. > > Note: The added regression test is tailored for ASAN bots as a > normal build would need too many iterations to consistently crash. > > R=neis@chromium.org, petermarshall@chromium.org > > Bug: v8:9161 > Change-Id: Ic089928652f75865bfdb11e7453806faa6ecb988 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1581641 > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Simon Zünd <szuend@chromium.org> > Cr-Commit-Position: refs/heads/master@{#61004} TBR=neis@chromium.org,petermarshall@chromium.org,szuend@chromium.org Change-Id: I046da3e4228bb1a8a3aa89d9c9d8de11875a9273 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9161 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1583725Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#61007}
a5941ac9