1447693 - Investigate whether TypeSetRef is safe

Status: RESOLVED FIXED

(Core :: JavaScript: GC, enhancement, P2)

Description

[Jon Coppeard (:jonco)]

tcampbell suggested looking into whether TypeSetRef was safe, since it's a poorly understood mechanism at the intersection of TI and GC.

So far it seems to be fine, but could use some more assertions like we have for other data structures that are updated on minor GC.

They are exercised by our test code but only in a handful of places, specifically the following jit-tests:

    auto-regress/bug499169.js
    baseline/no-such-property-getprop.js
    basic/teleporting-mutable-proto.js
    class/superSetPropThrow.js
    class/superPropMegamorphic.js
    class/superSetProperty.js
    collections/Map-forEach.js
    collections/WeakSet-delete.js
    collections/iterator-proto-1.js
    collections/iterator-proto-surfaces.js

Comment 1

[Jon Coppeard (:jonco)]

Attachment: bug1447693-type-set-assertions

Add some assertions around updating ConstraintTypeSet on minor GC.

Comment 2

[Ted Campbell [:tcampbell]]

Comment on attachment 8961000 [details] [diff] [review]
bug1447693-type-set-assertions

Review of attachment 8961000 [details] [diff] [review]:
-----------------------------------------------------------------

We talked this over and it looks good.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f46b5589e603
Add some assertions around updating type sets after minor GC r=tcampbell

Comment 4

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/f46b5589e603