From a8287fe6c5be1606ea55a1241c97c54b56d6d38c Mon Sep 17 00:00:00 2001 From: Daniel Bevenius Date: Tue, 15 Sep 2020 08:26:48 +0200 Subject: [PATCH 1/4] [deps] V8: cherry-pick 71736859756b2bd0444bdb0a87a Original commit message: [heap] Add large_object_threshold to AllocateRaw This commit adds a check in Heap::AllocateRaw when setting the large_object variable, when the AllocationType is of type kCode, to take into account the size of the CodeSpace's area size. The motivation for this change is that without this check it is possible that size_in_bytes is less than 128, and hence not considered a large object, but it might be larger than the available space in code_space->AreaSize(), which will cause the object to be created in the CodeLargeObjectSpace. This will later cause a segmentation fault when calling the following chain of functions: if (!large_object) { MemoryChunk::FromHeapObject(heap_object) ->GetCodeObjectRegistry() ->RegisterNewlyAllocatedCodeObject(heap_object.address()); } We (Red Hat) ran into this issue when running Node.js v12.16.1 in combination with yarn on aarch64 (this was the only architecture that this happed on). Bug: v8:10808 Change-Id: I0c396b0eb64bc4cc91d9a3be521254f3130eac7b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390665 Commit-Queue: Ulan Degenbaev Reviewed-by: Ulan Degenbaev Cr-Commit-Position: refs/heads/master@{#69876} Refs: https://github.com/v8/v8/commit/71736859756b2bd0444bdb0a87a61a0b090cbba2 --- common.gypi | 2 +- deps/v8/src/heap/heap-inl.h | 14 +++++++---- deps/v8/src/heap/heap.h | 6 +++-- deps/v8/test/cctest/heap/heap-tester.h | 1 + deps/v8/test/cctest/heap/test-heap.cc | 32 ++++++++++++++++++++++++++ 5 files changed, 48 insertions(+), 7 deletions(-) diff --git a/common.gypi b/common.gypi index f57a054434f281..43a2fcb8167351 100644 --- a/common.gypi +++ b/common.gypi @@ -34,7 +34,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.40', + 'v8_embedder_string': '-node.41', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h index 01d208b1bd63ed..1e85ba73c78fbb 100644 --- a/deps/v8/src/heap/heap-inl.h +++ b/deps/v8/src/heap/heap-inl.h @@ -171,7 +171,13 @@ AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationType type, IncrementObjectCounters(); #endif - bool large_object = size_in_bytes > kMaxRegularHeapObjectSize; + size_t large_object_threshold = + AllocationType::kCode == type + ? std::min(kMaxRegularHeapObjectSize, code_space()->AreaSize()) + : kMaxRegularHeapObjectSize; + bool large_object = + static_cast(size_in_bytes) > large_object_threshold; + HeapObject object; AllocationResult allocation; @@ -200,10 +206,10 @@ AllocationResult Heap::AllocateRaw(int size_in_bytes, AllocationType type, allocation = old_space_->AllocateRaw(size_in_bytes, alignment, origin); } } else if (AllocationType::kCode == type) { - if (size_in_bytes <= code_space()->AreaSize() && !large_object) { - allocation = code_space_->AllocateRawUnaligned(size_in_bytes); - } else { + if (large_object) { allocation = code_lo_space_->AllocateRaw(size_in_bytes); + } else { + allocation = code_space_->AllocateRawUnaligned(size_in_bytes); } } else if (AllocationType::kMap == type) { allocation = map_space_->AllocateRawUnaligned(size_in_bytes); diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h index 2b8b963a798b2f..10ebf7589aa98e 100644 --- a/deps/v8/src/heap/heap.h +++ b/deps/v8/src/heap/heap.h @@ -1262,8 +1262,10 @@ class Heap { // Heap object allocation tracking. ========================================== // =========================================================================== - void AddHeapObjectAllocationTracker(HeapObjectAllocationTracker* tracker); - void RemoveHeapObjectAllocationTracker(HeapObjectAllocationTracker* tracker); + V8_EXPORT_PRIVATE void AddHeapObjectAllocationTracker( + HeapObjectAllocationTracker* tracker); + V8_EXPORT_PRIVATE void RemoveHeapObjectAllocationTracker( + HeapObjectAllocationTracker* tracker); bool has_heap_object_allocation_tracker() const { return !allocation_trackers_.empty(); } diff --git a/deps/v8/test/cctest/heap/heap-tester.h b/deps/v8/test/cctest/heap/heap-tester.h index 6f6cfb46b5c256..eca9e4b98d0eb3 100644 --- a/deps/v8/test/cctest/heap/heap-tester.h +++ b/deps/v8/test/cctest/heap/heap-tester.h @@ -11,6 +11,7 @@ // Tests that should have access to private methods of {v8::internal::Heap}. // Those tests need to be defined using HEAP_TEST(Name) { ... }. #define HEAP_TEST_METHODS(V) \ + V(CodeLargeObjectSpace) \ V(CompactionFullAbortedPage) \ V(CompactionPartiallyAbortedPage) \ V(CompactionPartiallyAbortedPageIntraAbortedPointers) \ diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc index 10bd50294ef6f0..41f4696541fdae 100644 --- a/deps/v8/test/cctest/heap/test-heap.cc +++ b/deps/v8/test/cctest/heap/test-heap.cc @@ -6754,6 +6754,38 @@ TEST(CodeObjectRegistry) { CHECK(MemoryChunk::FromAddress(code2_address)->Contains(code2_address)); } +class TestAllocationTracker : public HeapObjectAllocationTracker { + public: + explicit TestAllocationTracker(int expected_size) : expected_size_(expected_size) {} + + void AllocationEvent(Address addr, int size) { + CHECK(expected_size_ == size); + address_ = addr; + } + + Address address() { return address_; } + + private: + int expected_size_; + Address address_; +}; + +HEAP_TEST(CodeLargeObjectSpace) { + Heap* heap = CcTest::heap(); + int size_in_bytes = kMaxRegularHeapObjectSize + kSystemPointerSize; + TestAllocationTracker allocation_tracker{size_in_bytes}; + heap->AddHeapObjectAllocationTracker(&allocation_tracker); + + AllocationResult allocation = heap->AllocateRaw( + size_in_bytes, AllocationType::kCode, AllocationOrigin::kGeneratedCode, + AllocationAlignment::kCodeAligned); + + CHECK(allocation.ToAddress() == allocation_tracker.address()); + heap->CreateFillerObjectAt(allocation.ToAddress(), size_in_bytes, + ClearRecordedSlots::kNo); + heap->RemoveHeapObjectAllocationTracker(&allocation_tracker); +} + } // namespace heap } // namespace internal } // namespace v8 From 5c214a33ae09935eef16310380d520a839daaf9d Mon Sep 17 00:00:00 2001 From: Daniel Bevenius Date: Tue, 22 Sep 2020 06:10:26 +0200 Subject: [PATCH 2/4] squash: use ToObjectChecked instead of ToAddress() --- deps/v8/test/cctest/heap/test-heap.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc index 41f4696541fdae..106236453f0db7 100644 --- a/deps/v8/test/cctest/heap/test-heap.cc +++ b/deps/v8/test/cctest/heap/test-heap.cc @@ -6780,7 +6780,7 @@ HEAP_TEST(CodeLargeObjectSpace) { size_in_bytes, AllocationType::kCode, AllocationOrigin::kGeneratedCode, AllocationAlignment::kCodeAligned); - CHECK(allocation.ToAddress() == allocation_tracker.address()); + CHECK(allocation.ToObjectChecked().address() == allocation_tracker.address()); heap->CreateFillerObjectAt(allocation.ToAddress(), size_in_bytes, ClearRecordedSlots::kNo); heap->RemoveHeapObjectAllocationTracker(&allocation_tracker); From 11a0593ced2ec3aceba2cbf1b05179ce5da5b4e7 Mon Sep 17 00:00:00 2001 From: Daniel Bevenius Date: Tue, 22 Sep 2020 08:19:02 +0200 Subject: [PATCH 3/4] squash: use ToObjectChecked in CreateFillerObjectAt --- deps/v8/test/cctest/heap/test-heap.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc index 106236453f0db7..078df9fee4026d 100644 --- a/deps/v8/test/cctest/heap/test-heap.cc +++ b/deps/v8/test/cctest/heap/test-heap.cc @@ -6781,8 +6781,8 @@ HEAP_TEST(CodeLargeObjectSpace) { AllocationAlignment::kCodeAligned); CHECK(allocation.ToObjectChecked().address() == allocation_tracker.address()); - heap->CreateFillerObjectAt(allocation.ToAddress(), size_in_bytes, - ClearRecordedSlots::kNo); + heap->CreateFillerObjectAt(allocation.ToObjectChecked().address(), + size_in_bytes, ClearRecordedSlots::kNo); heap->RemoveHeapObjectAllocationTracker(&allocation_tracker); } From b02c5631446d6a3ecd917ac95a6ea997da20d9c4 Mon Sep 17 00:00:00 2001 From: Daniel Bevenius Date: Wed, 23 Sep 2020 16:21:46 +0200 Subject: [PATCH 4/4] squash: use AllocationAlignment::KWordAligned --- deps/v8/test/cctest/heap/test-heap.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc index 078df9fee4026d..0c8e946c1f7f90 100644 --- a/deps/v8/test/cctest/heap/test-heap.cc +++ b/deps/v8/test/cctest/heap/test-heap.cc @@ -6778,7 +6778,7 @@ HEAP_TEST(CodeLargeObjectSpace) { AllocationResult allocation = heap->AllocateRaw( size_in_bytes, AllocationType::kCode, AllocationOrigin::kGeneratedCode, - AllocationAlignment::kCodeAligned); + AllocationAlignment::kWordAligned); CHECK(allocation.ToObjectChecked().address() == allocation_tracker.address()); heap->CreateFillerObjectAt(allocation.ToObjectChecked().address(),