Closed Bug 1308200 Opened 7 years ago Closed 7 years ago

Assert that writing to a function's extended slots doesn't create black->gray edges

Categories

(Core :: JavaScript: GC, defect)

Product:
Core
Component:
JavaScript: GC
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla52
Tracking Flags:
Tracking Status
firefox52 --- fixed

People

(Reporter: jonco, Assigned: jonco)

Details

Attachments

(1 file)

function-gray-assertion
2.25 KB, patch
sfink
: review+
Details | Diff | Splinter Review 
We added assertions (in HeapSlot) to handle objects' slots in the general case.  Let's add this to extended function slots too.  This may help to track down bug 1299780.

        Attachment #8798460 -
        Flags: review?(sphink)

    
    

    
  
Comment on attachment 8798460 [details] [diff] [review]
function-gray-assertion

Review of attachment 8798460 [details] [diff] [review]:
-----------------------------------------------------------------

This is good, though I feel like our current problems have to do with gray things being put onto the jit stack.

Note that this is also asserting that you won't call setExtendedSlot(gray) on a dead nursery object. But I don't think that can ever happen.

        Attachment #8798460 -
        Flags: review?(sphink) → review+

    
    

    
  
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/09bbad43f50e
Assert that we don't create a black->gray edge when writing to a function's extended slots r=sfink

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/09bbad43f50e
Status: NEW → RESOLVED
Closed: 7 years ago

          status-firefox52:
          --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla52

          You need to log in
          before you can comment on or make changes to this bug.