Investigate whether TypeSetRef is safe

RESOLVED FIXED in Firefox 61

Status

()

enhancement
P2
normal
RESOLVED FIXED
Last year
Last year

People

(Reporter: jonco, Assigned: jonco)

Tracking

unspecified
mozilla61
Points:
---

Firefox Tracking Flags

(firefox61 fixed)

Details

Attachments

(1 attachment)

Assignee

Description

Last year
tcampbell suggested looking into whether TypeSetRef was safe, since it's a poorly understood mechanism at the intersection of TI and GC.

So far it seems to be fine, but could use some more assertions like we have for other data structures that are updated on minor GC.

They are exercised by our test code but only in a handful of places, specifically the following jit-tests:

    auto-regress/bug499169.js
    baseline/no-such-property-getprop.js
    basic/teleporting-mutable-proto.js
    class/superSetPropThrow.js
    class/superPropMegamorphic.js
    class/superSetProperty.js
    collections/Map-forEach.js
    collections/WeakSet-delete.js
    collections/iterator-proto-1.js
    collections/iterator-proto-surfaces.js
Assignee

Comment 1

Last year
Add some assertions around updating ConstraintTypeSet on minor GC.
Attachment #8961000 - Flags: review?(tcampbell)
Priority: -- → P2
Comment on attachment 8961000 [details] [diff] [review]
bug1447693-type-set-assertions

Review of attachment 8961000 [details] [diff] [review]:
-----------------------------------------------------------------

We talked this over and it looks good.
Attachment #8961000 - Flags: review?(tcampbell) → review+

Comment 3

Last year
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f46b5589e603
Add some assertions around updating type sets after minor GC r=tcampbell
https://hg.mozilla.org/mozilla-central/rev/f46b5589e603
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in before you can comment on or make changes to this bug.