• Jakob Gruber's avatar
    Reland "[compiler] Consider IsPendingAllocation in Ref construction" · 24ff68e8
    Jakob Gruber authored
    This is the second reland of 4683d6fe
    
    Initial CL:   crrev.com/c/2874663
    First reland: crrev.com/c/2886861
    
    The first reland fixes Ref construction failures in:
    - MapRef::instance_descriptors
    - NativeContext reads (see also crrev.com/c/2891575)
    
    The second reland (this CL):
    - Adds required infrastructure (e.g. kAssumeMemoryFence) but
      without enabling the IsPendingAllocation check. Enabling the check
      will be done separately to avoid further revert chains.
    
    Original change's description:
    > [compiler] Consider IsPendingAllocation in Ref construction
    >
    > The logic in JSHeapBroker::TryGetOrCreateData assumes that parts
    > of the object are safe to read. In particular, the instance type
    > must be readable for the chain of `Is##Name()` type checks.
    >
    > This is guaranteed if
    >
    >  - a global memory fence happened after object initialization and
    >    prior to the read by the compiler; or
    >  - the object was published through a release store and read through
    >    an acquire read.
    >
    > The former is protected by the new call to ObjectMayBeUninitialized
    > (which internally calls IsPendingAllocation) in TryGetOrCreateData.
    >
    > The latter must be marked explicitly by calling the new
    > MakeRefAssumeMemoryFence variant.
    >
    > Note that support in this CL is expected to be incomplete and will
    > have to be extended in the future as more cases show up in which
    > MakeRef calls must be converted to MakeRefAssumeMemoryFence or to
    > TryMakeRef.
    >
    > Bug: v8:7790,v8:11711
    > Change-Id: Ic2f7d9fc46e4bfc3f6bbe42816f73fc5ec174337
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874663
    > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    > Reviewed-by: Georg Neis <neis@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#74474}
    
    Bug: v8:7790,v8:11711,chromium:1207680,chromium:1207679
    Change-Id: I123b2962df724a13dd2c7334ae949234bc3bf27a
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902738Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
    Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#74638}
    24ff68e8
Name
Last commit
Last update
..
api Loading commit data...
asmjs Loading commit data...
ast Loading commit data...
base Loading commit data...
baseline Loading commit data...
bigint Loading commit data...
builtins Loading commit data...
codegen Loading commit data...
common Loading commit data...
compiler Loading commit data...
compiler-dispatcher Loading commit data...
d8 Loading commit data...
date Loading commit data...
debug Loading commit data...
deoptimizer Loading commit data...
diagnostics Loading commit data...
execution Loading commit data...
extensions Loading commit data...
flags Loading commit data...
handles Loading commit data...
heap Loading commit data...
ic Loading commit data...
init Loading commit data...
inspector Loading commit data...
interpreter Loading commit data...
json Loading commit data...
libplatform Loading commit data...
libsampler Loading commit data...
logging Loading commit data...
numbers Loading commit data...
objects Loading commit data...
parsing Loading commit data...
profiler Loading commit data...
protobuf Loading commit data...
regexp Loading commit data...
roots Loading commit data...
runtime Loading commit data...
sanitizer Loading commit data...
snapshot Loading commit data...
strings Loading commit data...
tasks Loading commit data...
third_party Loading commit data...
torque Loading commit data...
tracing Loading commit data...
trap-handler Loading commit data...
utils Loading commit data...
wasm Loading commit data...
web-snapshot Loading commit data...
zone Loading commit data...
DEPS Loading commit data...
DIR_METADATA Loading commit data...
OWNERS Loading commit data...