711165 - GC: DenseArrays are missing some barrier calls

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

When we do memcpy and memset on the elements array, we miss calling some important barriers.  The one I know about specifically is JSObject::initDenseArrayElements.  If we init array elements of an object in the long-lived heap with a GCThing in the nursery and miss this barrier, then we miss an important cross-generation pointer.

Comment 1

[Terrence Cole [:terrence]]

Attachment: v1: Replacing all uses of memcpy

This has no measurable effect on v8 performance.

I only updated places where we used memcpy on elements.  If you know of others, I can add them to this patch, or we can wait for the verifier to catch more later.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 582118 [details] [diff] [review]
v1: Replacing all uses of memcpy

Cool, thanks.

Comment 3

[Terrence Cole [:terrence]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/fd9444ecf9a1

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/fd9444ecf9a1