1043888 - JS::GetGCThingZone and GetObjectZone don't take account of nursery objects

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Jon Coppeard (:jonco)]

Spotted by jandem.

These functions are defined in HeapAPI.h so they are public and are used in a couple of places, notably the cycle collector.

Since we don't have the definition of JSObject here it seems they can only work for tenured objects.  So we should put "tenured" in the name to make this clear and assert if they are passed nursery objects, or move them somewhere else and make them work properly (although they won't be inlined any more).

Comment 1

[Jon Coppeard (:jonco)]

Attachment: bug1043888-zone-apis

Patch to rename GetGCThingZone() to GetTenuredGCThingZone() and assert that its argument is tenured, as there's no way to make this work correctly for nursery objects since we don't have the type.

I made GetObjectZone() work correctly for nursery objects since that was presumably the point of separating these out.

I also renamed IsIncrementalBarrierNeededOnGCThing() to IsIncrementalBarrierNeededOnTenuredGCThing() to make it clear it expects not to be passed a nursery pointer, although the name is getting a bit long now.

Comment 2

[Terrence Cole [:terrence]]

Comment on attachment 8462586 [details] [diff] [review]
bug1043888-zone-apis

Review of attachment 8462586 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks! That is clearer. I've been using the interfaces so closely, lately, that I didn't even notice the incorrect naming.

Comment 3

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c03c2e8e2a21

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c03c2e8e2a21