Skip to content

Commit 1fada6b

Browse files
sygV8 LUCI CQ
authored and
V8 LUCI CQ
committed
[symbol-as-weakmap-key] Fix DCHECKs when clearing JS weakrefs
Bug: chromium:1372500, v8:12947 Fixed: chromium:1372500 Change-Id: Id6330de5886e4ea72544b307c358e2190ea47d9c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3942586 Reviewed-by: Anton Bikineev <[email protected]> Commit-Queue: Shu-yu Guo <[email protected]> Cr-Commit-Position: refs/heads/main@{#83632}
1 parent e977516 commit 1fada6b

File tree

2 files changed

+17
-2
lines changed

2 files changed

+17
-2
lines changed

src/heap/mark-compact.cc

+3-2
Original file line numberDiff line numberDiff line change
@@ -3479,7 +3479,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
34793479
};
34803480
HeapObject target = HeapObject::cast(weak_cell.target());
34813481
if (!non_atomic_marking_state()->IsBlackOrGrey(target)) {
3482-
DCHECK(!target.IsUndefined());
3482+
DCHECK(target.CanBeHeldWeakly());
34833483
// The value of the WeakCell is dead.
34843484
JSFinalizationRegistry finalization_registry =
34853485
JSFinalizationRegistry::cast(weak_cell.finalization_registry());
@@ -3501,6 +3501,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
35013501

35023502
HeapObject unregister_token = weak_cell.unregister_token();
35033503
if (!non_atomic_marking_state()->IsBlackOrGrey(unregister_token)) {
3504+
DCHECK(unregister_token.CanBeHeldWeakly());
35043505
// The unregister token is dead. Remove any corresponding entries in the
35053506
// key map. Multiple WeakCell with the same token will have all their
35063507
// unregister_token field set to undefined when processing the first
@@ -3509,7 +3510,7 @@ void MarkCompactCollector::ClearJSWeakRefs() {
35093510
JSFinalizationRegistry finalization_registry =
35103511
JSFinalizationRegistry::cast(weak_cell.finalization_registry());
35113512
finalization_registry.RemoveUnregisterToken(
3512-
JSReceiver::cast(unregister_token), isolate(),
3513+
unregister_token, isolate(),
35133514
JSFinalizationRegistry::kKeepMatchedCellsInRegistry,
35143515
gc_notify_updated_slot);
35153516
} else {
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Copyright 2022 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --harmony-symbol-as-weakmap-key --expose-gc
6+
7+
// Register an object in a FinalizationRegistry with a Symbol as the unregister
8+
// token.
9+
let fr = new FinalizationRegistry(function () {});
10+
(function register() {
11+
fr.register({}, "holdings", Symbol('unregisterToken'));
12+
})();
13+
// The unregister token should be dead, trigger its collection.
14+
gc();

0 commit comments

Comments
 (0)