Closed Bug 1447693 Opened 2 years ago Closed 2 years ago

Investigate whether TypeSetRef is safe

Categories

(Core :: JavaScript: GC, enhancement, P2)

enhancement

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox61 --- fixed

People

(Reporter: jonco, Assigned: jonco)

Details

Attachments

(1 file)

tcampbell suggested looking into whether TypeSetRef was safe, since it's a poorly understood mechanism at the intersection of TI and GC.

So far it seems to be fine, but could use some more assertions like we have for other data structures that are updated on minor GC.

They are exercised by our test code but only in a handful of places, specifically the following jit-tests:

    auto-regress/bug499169.js
    baseline/no-such-property-getprop.js
    basic/teleporting-mutable-proto.js
    class/superSetPropThrow.js
    class/superPropMegamorphic.js
    class/superSetProperty.js
    collections/Map-forEach.js
    collections/WeakSet-delete.js
    collections/iterator-proto-1.js
    collections/iterator-proto-surfaces.js
Add some assertions around updating ConstraintTypeSet on minor GC.
Attachment #8961000 - Flags: review?(tcampbell)
Priority: -- → P2
Comment on attachment 8961000 [details] [diff] [review]
bug1447693-type-set-assertions

Review of attachment 8961000 [details] [diff] [review]:
-----------------------------------------------------------------

We talked this over and it looks good.
Attachment #8961000 - Flags: review?(tcampbell) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f46b5589e603
Add some assertions around updating type sets after minor GC r=tcampbell
https://hg.mozilla.org/mozilla-central/rev/f46b5589e603
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in before you can comment on or make changes to this bug.