Closed Bug 1308200 Opened 6 years ago Closed 6 years ago

Assert that writing to a function's extended slots doesn't create black->gray edges

Categories

(Core :: JavaScript: GC, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla52
Tracking Status
firefox52 --- fixed

People

(Reporter: jonco, Assigned: jonco)

Details

Attachments

(1 file)

We added assertions (in HeapSlot) to handle objects' slots in the general case.  Let's add this to extended function slots too.  This may help to track down bug 1299780.
Attachment #8798460 - Flags: review?(sphink)
Comment on attachment 8798460 [details] [diff] [review]
function-gray-assertion

Review of attachment 8798460 [details] [diff] [review]:
-----------------------------------------------------------------

This is good, though I feel like our current problems have to do with gray things being put onto the jit stack.

Note that this is also asserting that you won't call setExtendedSlot(gray) on a dead nursery object. But I don't think that can ever happen.
Attachment #8798460 - Flags: review?(sphink) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/09bbad43f50e
Assert that we don't create a black->gray edge when writing to a function's extended slots r=sfink
https://hg.mozilla.org/mozilla-central/rev/09bbad43f50e
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla52
You need to log in before you can comment on or make changes to this bug.