[heap] Gate DescriptorArray trimming behind a flag [v8/v8 : main]

0 views
Skip to first unread message

Omer Katz (Gerrit)

unread,
Jan 8, 2026, 9:54:40 AM (20 hours ago) Jan 8
to Patrick Thier, V8 LUCI CQ, Hannes Payer, mlippau...@chromium.org, v8-flag...@chromium.org, v8-re...@googlegroups.com
Attention needed from Patrick Thier

Omer Katz added 1 comment

Patchset-level comments
Open in Gerrit

Related details

Attention is currently required from:
  • Patrick Thier
Submit Requirements:
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: Ie3358c4aa297512edfdb66acd4f2d80a89d1d8ec
Gerrit-Change-Number: 7368053
Gerrit-PatchSet: 6
Gerrit-Owner: Omer Katz <omer...@chromium.org>
Gerrit-Reviewer: Omer Katz <omer...@chromium.org>
Gerrit-Reviewer: Patrick Thier <pth...@chromium.org>
Gerrit-CC: Hannes Payer <hpa...@chromium.org>
Gerrit-Attention: Patrick Thier <pth...@chromium.org>
Gerrit-Comment-Date: Thu, 08 Jan 2026 14:54:35 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

Patrick Thier (Gerrit)

unread,
Jan 8, 2026, 11:44:34 AM (19 hours ago) Jan 8
to Omer Katz, V8 LUCI CQ, Hannes Payer, mlippau...@chromium.org, v8-flag...@chromium.org, v8-re...@googlegroups.com
Attention needed from Omer Katz

Patrick Thier added 4 comments

Patchset-level comments
Patrick Thier . resolved

Sorry I didn't realize this immediately when we briefly talked at lunch, but with the requirement to clear entries this will unfortunately not solve the problem 😞
This will just turn a potential OOB read into a type confusion: We expect the keys to be `Name`s.
Another option could be to use holes instead of undefines. With Leszeks recent changes (having an unmapped page after the hole map), we would crash and therefore prevent any issues. I haven't fully thought this through yet, but wanted to post my reply before going home.

Commit Message
Line 10, Patchset 6 (Latest):during GCs with stack. These flags are meant ot allow experimenting
Patrick Thier . unresolved

```suggestion
during GCs with stack. These flags are meant to allow experimenting
```

File src/heap/mark-compact.cc
Line 3962, Patchset 6 (Latest): HandleDeadArraySlotsCallback handle_dead_array_slots) {
Patrick Thier . unresolved
```suggestion
const HandleDeadArraySlotsCallback&& handle_dead_array_slots) {
```

Probably doesn't fit into 80 columns anymore and needs some extra formatting.

Line 4040, Patchset 6 (Latest): DCHECK(descriptors->number_of_all_descriptors() ==
number_of_own_descriptors);
Patrick Thier . unresolved
```suggestion
DCHECK_EQ(descriptors->number_of_all_descriptors(),
number_of_own_descriptors);
```
Open in Gerrit

Related details

Attention is currently required from:
  • Omer Katz
Submit Requirements:
    • requirement satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: v8/v8
    Gerrit-Branch: main
    Gerrit-Change-Id: Ie3358c4aa297512edfdb66acd4f2d80a89d1d8ec
    Gerrit-Change-Number: 7368053
    Gerrit-PatchSet: 6
    Gerrit-Owner: Omer Katz <omer...@chromium.org>
    Gerrit-Reviewer: Omer Katz <omer...@chromium.org>
    Gerrit-Reviewer: Patrick Thier <pth...@chromium.org>
    Gerrit-CC: Hannes Payer <hpa...@chromium.org>
    Gerrit-Attention: Omer Katz <omer...@chromium.org>
    Gerrit-Comment-Date: Thu, 08 Jan 2026 16:44:29 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Omer Katz (Gerrit)

    unread,
    Jan 8, 2026, 4:42:35 PM (14 hours ago) Jan 8
    to Patrick Thier, V8 LUCI CQ, Hannes Payer, mlippau...@chromium.org, v8-flag...@chromium.org, v8-re...@googlegroups.com
    Attention needed from Patrick Thier

    Omer Katz added 4 comments

    Patchset-level comments
    Patrick Thier . resolved

    Sorry I didn't realize this immediately when we briefly talked at lunch, but with the requirement to clear entries this will unfortunately not solve the problem 😞
    This will just turn a potential OOB read into a type confusion: We expect the keys to be `Name`s.
    Another option could be to use holes instead of undefines. With Leszeks recent changes (having an unmapped page after the hole map), we would crash and therefore prevent any issues. I haven't fully thought this through yet, but wanted to post my reply before going home.

    Omer Katz

    Good point. I need to think this through a bit more. Thanks!

    Commit Message
    Line 10, Patchset 6:during GCs with stack. These flags are meant ot allow experimenting
    Patrick Thier . resolved

    ```suggestion
    during GCs with stack. These flags are meant to allow experimenting
    ```

    Omer Katz

    Done

    File src/heap/mark-compact.cc
    Line 3962, Patchset 6: HandleDeadArraySlotsCallback handle_dead_array_slots) {
    Patrick Thier . resolved
    ```suggestion
    const HandleDeadArraySlotsCallback&& handle_dead_array_slots) {
    ```

    Probably doesn't fit into 80 columns anymore and needs some extra formatting.

    Omer Katz

    Done

    Line 4040, Patchset 6: DCHECK(descriptors->number_of_all_descriptors() ==
    number_of_own_descriptors);
    Patrick Thier . resolved
    ```suggestion
    DCHECK_EQ(descriptors->number_of_all_descriptors(),
    number_of_own_descriptors);
    ```
    Omer Katz

    Done

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Patrick Thier
    Submit Requirements:
      • requirement satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: v8/v8
      Gerrit-Branch: main
      Gerrit-Change-Id: Ie3358c4aa297512edfdb66acd4f2d80a89d1d8ec
      Gerrit-Change-Number: 7368053
      Gerrit-PatchSet: 8
      Gerrit-Owner: Omer Katz <omer...@chromium.org>
      Gerrit-Reviewer: Omer Katz <omer...@chromium.org>
      Gerrit-Reviewer: Patrick Thier <pth...@chromium.org>
      Gerrit-CC: Hannes Payer <hpa...@chromium.org>
      Gerrit-Attention: Patrick Thier <pth...@chromium.org>
      Gerrit-Comment-Date: Thu, 08 Jan 2026 21:42:30 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      Comment-In-Reply-To: Patrick Thier <pth...@chromium.org>
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy
      Reply all
      Reply to author
      Forward
      0 new messages