diff --git a/patches/v8/.patches b/patches/v8/.patches index e9d3918e584d6..df697f5781540 100644 --- a/patches/v8/.patches +++ b/patches/v8/.patches @@ -9,4 +9,5 @@ fix_build_deprecated_attirbute_for_older_msvc_versions.patch cherry-pick-e38d55313ad9.patch cherry-pick-1234770.patch cherry-pick-1231950.patch +cherry-pick-1228036.patch cherry-pick-1234764.patch diff --git a/patches/v8/cherry-pick-1228036.patch b/patches/v8/cherry-pick-1228036.patch new file mode 100644 index 0000000000000..41923cf1bb0e9 --- /dev/null +++ b/patches/v8/cherry-pick-1228036.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Georg Neis +Date: Mon, 26 Jul 2021 16:40:39 +0200 +Subject: Finish concurrent sweeping before overwriting ByteArrays + +Bug: chromium:1228036 +Change-Id: I5abe7009920d2c8f81f024c9ae7bb6b13607da1a +Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3054119 +Commit-Queue: Georg Neis +Reviewed-by: Hannes Payer + +diff --git a/src/deoptimizer/translated-state.cc b/src/deoptimizer/translated-state.cc +index 02c473d22b18a0a4c288e655afdb73340a0d0ffc..b5378a553a49e41c96713cf3f2ed901f7cfe4626 100644 +--- a/src/deoptimizer/translated-state.cc ++++ b/src/deoptimizer/translated-state.cc +@@ -514,6 +514,12 @@ Handle TranslatedValue::GetValue() { + // pass the verifier. + container_->EnsureObjectAllocatedAt(this); + ++ // Finish any sweeping so that it becomes safe to overwrite the ByteArray ++ // headers. ++ // TODO(hpayer): Find a cleaner way to support a group of ++ // non-fully-initialized objects. ++ isolate()->heap()->mark_compact_collector()->EnsureSweepingCompleted(); ++ + // 2. Initialize the objects. If we have allocated only byte arrays + // for some objects, we now overwrite the byte arrays with the + // correct object fields. Note that this phase does not allocate +@@ -1397,9 +1403,9 @@ TranslatedValue* TranslatedState::GetValueByObjectIndex(int object_index) { + } + + Handle TranslatedState::InitializeObjectAt(TranslatedValue* slot) { +- slot = ResolveCapturedObject(slot); +- + DisallowGarbageCollection no_gc; ++ ++ slot = ResolveCapturedObject(slot); + if (slot->materialization_state() != TranslatedValue::kFinished) { + std::stack worklist; + worklist.push(slot->object_index());