1308200 - Assert that writing to a function's extended slots doesn't create black->gray edges

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Jon Coppeard (:jonco)]

We added assertions (in HeapSlot) to handle objects' slots in the general case.  Let's add this to extended function slots too.  This may help to track down bug 1299780.

Comment 1

[Jon Coppeard (:jonco)]

Attachment: function-gray-assertion

Comment 2

[Steve Fink [:sfink] [:s:]]

Comment on attachment 8798460 [details] [diff] [review]
function-gray-assertion

Review of attachment 8798460 [details] [diff] [review]:
-----------------------------------------------------------------

This is good, though I feel like our current problems have to do with gray things being put onto the jit stack.

Note that this is also asserting that you won't call setExtendedSlot(gray) on a dead nursery object. But I don't think that can ever happen.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/09bbad43f50e
Assert that we don't create a black->gray edge when writing to a function's extended slots r=sfink

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/09bbad43f50e