Closed Bug 1259306 Opened 4 years ago Closed 4 years ago

Intermittent bug-1252329.js | Unknown (code -1073741819, args "--ion-eager --ion-offthread-compile=off")


(Core :: JavaScript: GC, defect)

Not set



Tracking Status
firefox48 --- fixed


(Reporter: philor, Assigned: jonco)



(Keywords: intermittent-failure)


(2 files, 1 obsolete file)

Attached patch bug1215834-trace-shape-tables (obsolete) — Splinter Review
It seems we don't currently trace ShapeTables.  This doesn't matter in most cases because if a shape is unreachable then any base shape that has a shape table containing it will be unreachable too.  

In this situation however a base shape is marked because it's part of a Rooted<StackShape> without any shapes in its shape table necessarily be marked.  Compacting GC then visits the shape table to fix it up and tries to access dead shapes.

It should probably have occurred to me when writing the fixup method that we really needed to trace this instead.
Assignee: nobody → jcoppeard
Attachment #8734363 - Flags: review?(terrence)
Comment on attachment 8734363 [details] [diff] [review]

Review of attachment 8734363 [details] [diff] [review]:

Yeah, that's always bothered me.
Attachment #8734363 - Flags: review?(terrence) → review+
The patch here causes quite a few stack overflows on try.  It looks like this is because of the CC recursively tracing through BaseShapes.
Update patch with correct bug number
Attachment #8734363 - Attachment is obsolete: true
Attachment #8735878 - Flags: review+
It turns out that when the cycle collector traces object groups we can get into long cycles tracing through shape tables.  As noted elsewhere, the cycle collector doesn't need to see any of these edges so we can just ignore base shapes in this case.

Try is looking much greener now.
Attachment #8735879 - Flags: review?(terrence)
Attachment #8735879 - Flags: review?(terrence) → review+
Duplicate of this bug: 1260405
Duplicate of this bug: 1260331
Duplicate of this bug: 1260158
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
Depends on: 1262203
You need to log in before you can comment on or make changes to this bug.