Investigate whether TypeSetRef is safe

RESOLVED FIXED in Firefox 61

Status

()

enhancement
P2
normal
RESOLVED FIXED
a year ago
a year ago

People

(Reporter: jonco, Assigned: jonco)

Tracking

unspecified
mozilla61
Points:
---

Firefox Tracking Flags

(firefox61 fixed)

Details

Attachments

(1 attachment)

(Assignee)

Description

a year ago
tcampbell suggested looking into whether TypeSetRef was safe, since it's a poorly understood mechanism at the intersection of TI and GC.

So far it seems to be fine, but could use some more assertions like we have for other data structures that are updated on minor GC.

They are exercised by our test code but only in a handful of places, specifically the following jit-tests:

    auto-regress/bug499169.js
    baseline/no-such-property-getprop.js
    basic/teleporting-mutable-proto.js
    class/superSetPropThrow.js
    class/superPropMegamorphic.js
    class/superSetProperty.js
    collections/Map-forEach.js
    collections/WeakSet-delete.js
    collections/iterator-proto-1.js
    collections/iterator-proto-surfaces.js
(Assignee)

Comment 1

a year ago
Add some assertions around updating ConstraintTypeSet on minor GC.
Attachment #8961000 - Flags: review?(tcampbell)
Priority: -- → P2
Comment on attachment 8961000 [details] [diff] [review]
bug1447693-type-set-assertions

Review of attachment 8961000 [details] [diff] [review]:
-----------------------------------------------------------------

We talked this over and it looks good.
Attachment #8961000 - Flags: review?(tcampbell) → review+

Comment 3

a year ago
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f46b5589e603
Add some assertions around updating type sets after minor GC r=tcampbell
https://hg.mozilla.org/mozilla-central/rev/f46b5589e603
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in before you can comment on or make changes to this bug.