780653 - CellIter on shapes/types is empty during incremental sweeping

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

This seems to be causing a crash with the patch in bug 778724.  If I iterate over all type objects in a compartment outside of a GC, sometimes the iteration turns up empty (there are several hundred types in the compartment).

If I break in gdb at a point where the iteration is empty, I see in cx->compartment->arenas that the freeLists and arenaLists for FINALIZE_TYPE_OBJECT are both empty, but that arenaListsToSweep[FINALIZE_TYPE_OBJECT] is non-NULL but ignored by CellIter.  cx->runtime->gcIncrementalState is SWEEP.

I'm guessing this is due to bug 729760.

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: patch

I think this should fix the problem. I need to work on a testcase, though.

Comment 2

[Jon Coppeard (:jonco)]

Comment on attachment 649407 [details] [diff] [review]
patch

Review of attachment 649407 [details] [diff] [review]:
-----------------------------------------------------------------

Ah yes, I didn't think of that.

Cheers for fixing this.  The patch looks fine, the only problem might be that we are handing out references to objects that are about to be finalized so hopefully CellIter is not used in a way that will cause any of these to become live again.

Comment 3

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/61037dd2fc68

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/61037dd2fc68