1105232 - Assertion failure running v8-v5/check-splay.js test with compacting GC

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Jon Coppeard (:jonco)]

When running the v8-v5/check-splay.js jit test with h4writer's tracelogger patches applied I see:

Assertion failure: overlay->isForwarded(), at /home/jon/clone/compacting/js/src/jsgc.h:1312

Comment 1

[Jon Coppeard (:jonco)]

Attachment: bug1105232-fix-splay-assertion

This is a race condition between multiple threads attempting to update a copy-on-write array object's owner object, caused by the fact that we update cells in parallel now.

This actually doesn't matter if this happens because we will always write the same updated pointer for the owner, so we just need to stop this triggering the assertion.

Comment 2

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/75f3468a4ae7

Comment 3

[Jon Coppeard (:jonco)]

As per dicussion with Waldo on irc, the compiler is allowed to tear the owner value so this code is still wrong.  Even with that fixed it's very hard to determine whether this is actually safe on all memory architectures.  So we're going to try and make updating the owner pointer for COW arrays use atomic operations here.

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/75f3468a4ae7

Comment 5

[Jon Coppeard (:jonco)]

Attachment: bug1105232-fixup-cow-owner-earlier

A better idea is to remove the race condition entirely, which is what this patch does.

We update the elements to owner pointer for copy on write objects which own their elements when we relocate the object in the first place.  This takes place on the main thread with no other threads running at the same time.

Comment 6

[Terrence Cole [:terrence]]

Comment on attachment 8532041 [details] [diff] [review]
bug1105232-fixup-cow-owner-earlier

Review of attachment 8532041 [details] [diff] [review]:
-----------------------------------------------------------------

Makes sense.

Comment 7

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/73a54f3b33f4

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/73a54f3b33f4