diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc index 2b5ff9cd1aeaac..3e8e14493955b6 100644 --- a/deps/v8/src/heap/heap.cc +++ b/deps/v8/src/heap/heap.cc @@ -3166,10 +3166,6 @@ FixedArrayBase* Heap::LeftTrimFixedArray(FixedArrayBase* object, DCHECK(!lo_space()->Contains(object)); DCHECK(object->map() != fixed_cow_array_map()); - // Ensure that the no handle-scope has more than one pointer to the same - // backing-store. - SLOW_DCHECK(CountHandlesForObject(object) <= 1); - STATIC_ASSERT(FixedArrayBase::kMapOffset == 0); STATIC_ASSERT(FixedArrayBase::kLengthOffset == kPointerSize); STATIC_ASSERT(FixedArrayBase::kHeaderSize == 2 * kPointerSize); @@ -5671,32 +5667,6 @@ void Heap::PrintHandles() { #endif -#ifdef ENABLE_SLOW_DCHECKS - -class CountHandleVisitor : public ObjectVisitor { - public: - explicit CountHandleVisitor(Object* object) : object_(object) {} - - void VisitPointers(Object** start, Object** end) override { - for (Object** p = start; p < end; p++) { - if (object_ == reinterpret_cast(*p)) count_++; - } - } - - int count() { return count_; } - - private: - Object* object_; - int count_ = 0; -}; - -int Heap::CountHandlesForObject(Object* object) { - CountHandleVisitor v(object); - isolate_->handle_scope_implementer()->Iterate(&v); - return v.count(); -} -#endif - class CheckHandleCountVisitor : public ObjectVisitor { public: CheckHandleCountVisitor() : handle_count_(0) {} diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h index bbe1f05e4f2659..2d2029912cd717 100644 --- a/deps/v8/src/heap/heap.h +++ b/deps/v8/src/heap/heap.h @@ -1394,9 +1394,6 @@ class Heap { void ReportHeapStatistics(const char* title); void ReportCodeStatistics(const char* title); #endif -#ifdef ENABLE_SLOW_DCHECKS - int CountHandlesForObject(Object* object); -#endif private: class PretenuringScope; diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc index 9abcd1a4b334a6..e3c56b04ee275d 100644 --- a/deps/v8/src/heap/mark-compact.cc +++ b/deps/v8/src/heap/mark-compact.cc @@ -1374,8 +1374,34 @@ class RootMarkingVisitor : public ObjectVisitor { void MarkObjectByPointer(Object** p) { if (!(*p)->IsHeapObject()) return; - // Replace flat cons strings in place. HeapObject* object = HeapObject::cast(*p); + + // We cannot avoid stale handles to left-trimmed objects, but can only make + // sure all handles still needed are updated. Filter out any stale pointers + // and clear the slot to allow post processing of handles (needed because + // the sweeper might actually free the underlying page). + if (object->IsFiller()) { +#ifdef DEBUG + // We need to find a FixedArrayBase map after walking the fillers. + Heap* heap = collector_->heap(); + HeapObject* current = object; + while (current->IsFiller()) { + Address next = reinterpret_cast
(current); + if (current->map() == heap->one_pointer_filler_map()) { + next += kPointerSize; + } else if (current->map() == heap->two_pointer_filler_map()) { + next += 2 * kPointerSize; + } else { + next += current->Size(); + } + current = reinterpret_cast(next); + } + DCHECK(current->IsFixedArrayBase()); +#endif // DEBUG + *p = nullptr; + return; + } + MarkBit mark_bit = Marking::MarkBitFrom(object); if (Marking::IsBlackOrGrey(mark_bit)) return; diff --git a/deps/v8/test/mjsunit/regress/regress-620553.js b/deps/v8/test/mjsunit/regress/regress-620553.js new file mode 100644 index 00000000000000..461b9bb189e559 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-620553.js @@ -0,0 +1,17 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --expose-gc + +var o0 = []; +var o1 = []; +var cnt = 0; +o1.__defineGetter__(0, function() { + if (cnt++ > 2) return; + o0.shift(); + gc(); + o0.push(0); + o0.concat(o1); +}); +o1[0];