737195 - GC: missing barrier on JSFunction::atom

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

We appear to trace through JSFunction::atom.  We only ever initialized it, so we don't need incremental barriers on it, but we do need generation barriers here.

Comment 1

[Terrence Cole [:terrence]]

Attachment: v0

Does this make sense?  It would be less code to just trigger the atom post barrier manually in the two places where it is needed, but this way seems cleaner.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I think this misses the barrier in the js_XDRAtom case. The right way to handle that is similar to what we do with script in that function. Basically, define a local variable |atom|. In the encode case, set it to fun->atom. In the decode case, set it to NULL. Then pass &atom to js_XDRAtom. Later, in the JSXDR_DECODE section, call fun->atom.init(atom).

Related to this, I think that the fun->setScript(script) statement can be changed to initScript.

Comment 3

[Terrence Cole [:terrence]]

Attachment: v1: fixed xdring of the wrapped atom

Comment 4

[Terrence Cole [:terrence]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/af799044d21e

Comment 5

[Mounir Lamouri (:mounir)]

https://hg.mozilla.org/mozilla-central/rev/e367339ba6b2

Comment 6

[Mounir Lamouri (:mounir)]

https://hg.mozilla.org/mozilla-central/rev/af799044d21e