Closed
Bug 1308200
Opened 7 years ago
Closed 7 years ago
Assert that writing to a function's extended slots doesn't create black->gray edges
Categories
(Core :: JavaScript: GC, defect)
Core
JavaScript: GC
Tracking
()
RESOLVED
FIXED
mozilla52
Tracking | Status | |
---|---|---|
firefox52 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
Details
Attachments
(1 file)
2.25 KB,
patch
|
sfink
:
review+
|
Details | Diff | Splinter Review |
We added assertions (in HeapSlot) to handle objects' slots in the general case. Let's add this to extended function slots too. This may help to track down bug 1299780.
Assignee | ||
Comment 1•7 years ago
|
||
Attachment #8798460 -
Flags: review?(sphink)
Comment 2•7 years ago
|
||
Comment on attachment 8798460 [details] [diff] [review] function-gray-assertion Review of attachment 8798460 [details] [diff] [review]: ----------------------------------------------------------------- This is good, though I feel like our current problems have to do with gray things being put onto the jit stack. Note that this is also asserting that you won't call setExtendedSlot(gray) on a dead nursery object. But I don't think that can ever happen.
Attachment #8798460 -
Flags: review?(sphink) → review+
Pushed by jcoppeard@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/09bbad43f50e Assert that we don't create a black->gray edge when writing to a function's extended slots r=sfink
Comment 4•7 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/09bbad43f50e
Status: NEW → RESOLVED
Closed: 7 years ago
status-firefox52:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
You need to log in
before you can comment on or make changes to this bug.
Description
•