Skip to content

Commit 4213e97

Browse files
thomasmichaelwallacerichardlau
authored andcommitted
deps: V8: cherry-pick 81181a8ad80a
Original commit message: [JSON] Fix GC issue in BuildJsonObject We must ensure that the sweeper is not running or has already swept mutable_double_buffer. Otherwise the GC can add it to the free list. Bug: v8:11837 Change-Id: Ifd9cf15f1c94f664fd6489c70bb38b59730cdd78 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928181 Commit-Queue: Victor Gomes <[email protected]> Reviewed-by: Toon Verwaest <[email protected]> Reviewed-by: Dominik Inführ <[email protected]> Cr-Commit-Position: refs/heads/master@{#74859} Refs: v8/v8@81181a8 PR-URL: #39187 Fixes: #37553 Refs: v8/v8@81181a8 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Gireesh Punathil <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
1 parent ccecea5 commit 4213e97

File tree

4 files changed

+12
-1
lines changed

4 files changed

+12
-1
lines changed

common.gypi

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636

3737
# Reset this number to 0 on major V8 upgrades.
3838
# Increment by one for each non-official patch applied to deps/v8.
39-
'v8_embedder_string': '-node.72',
39+
'v8_embedder_string': '-node.73',
4040

4141
##### V8 defaults for Node.js #####
4242

deps/v8/src/heap/heap.cc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3347,6 +3347,10 @@ void Heap::MakeHeapIterable() {
33473347
mark_compact_collector()->EnsureSweepingCompleted();
33483348
}
33493349

3350+
void Heap::EnsureSweepingCompleted() {
3351+
mark_compact_collector()->EnsureSweepingCompleted();
3352+
}
3353+
33503354
namespace {
33513355

33523356
double ComputeMutatorUtilizationImpl(double mutator_speed, double gc_speed) {

deps/v8/src/heap/heap.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1001,6 +1001,8 @@ class Heap {
10011001
Reservation* reservations, const std::vector<HeapObject>& large_objects,
10021002
const std::vector<Address>& maps);
10031003

1004+
void EnsureSweepingCompleted();
1005+
10041006
IncrementalMarking* incremental_marking() {
10051007
return incremental_marking_.get();
10061008
}

deps/v8/src/json/json-parser.cc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -633,6 +633,11 @@ Handle<Object> JsonParser<Char>::BuildJsonObject(
633633
DCHECK_EQ(mutable_double_address, end);
634634
}
635635
#endif
636+
// Before setting the length of mutable_double_buffer back to zero, we
637+
// must ensure that the sweeper is not running or has already swept the
638+
// object's page. Otherwise the GC can add the contents of
639+
// mutable_double_buffer to the free list.
640+
isolate()->heap()->EnsureSweepingCompleted();
636641
mutable_double_buffer->set_length(0);
637642
}
638643
}

0 commit comments

Comments
 (0)