Closed
Bug 1458008
Opened 6 years ago
Closed 6 years ago
Shuffle Shape flags around to avoid races
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla61
Tracking | Status | |
---|---|---|
firefox61 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file)
28.51 KB,
patch
|
jonco
:
review+
|
Details | Diff | Splinter Review |
Shape::slotInfo stores the number of slots, number of fixed slots, and the number of linear searches. The latter is mutable and this really upsets TSan when an Ion compilation thread calls numFixedSlots on a template object's shape while the main thread increments the number of linear searches. Shape::flags has a similar issue. The attached patch renames slotInfo => immutableFlags and flags => mutableFlags and moves some flags around. Now immutableFlags stores the slot info and the is-dictionary/is-accessor-shape flags. The mutableFlags byte stores the number of linear searches, the overwritten flag, and the isBigEnoughForAShapeTable bits. This fixes most of our TSan races when running jit-tests.
Attachment #8972112 -
Flags: review?(jcoppeard)
Updated•6 years ago
|
Priority: -- → P1
Comment 3•6 years ago
|
||
Comment on attachment 8972112 [details] [diff] [review] Patch Review of attachment 8972112 [details] [diff] [review]: ----------------------------------------------------------------- Nice regorganisation.
Attachment #8972112 -
Flags: review?(jcoppeard) → review+
Pushed by jandemooij@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/1a9703589230 Shuffle Shape flags around to avoid races with off-thread compilation. r=jonco
Comment 5•6 years ago
|
||
Backed out for failing tests\jit-test\jit-test\tests\basic\testMatchAsCondition.js Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=1a97035892300bf1b50130dc89d3c10f59321011 Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=176441847&repo=mozilla-inbound&lineNumber=30314 Backout: https://hg.mozilla.org/integration/mozilla-inbound/rev/0b48238e5e77ee9a2f59fece611704bc4378872a
Assignee | ||
Comment 6•6 years ago
|
||
Weird, this only fails on Win32 debug. Will see if it repros...
Assignee | ||
Comment 7•6 years ago
|
||
So maybe this is just https://bugzilla.mozilla.org/show_bug.cgi?id=1444168 Fingers crossed.
Pushed by jandemooij@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/fe9b912b577a Shuffle Shape flags around to avoid races with off-thread compilation. r=jonco
Assignee | ||
Comment 9•6 years ago
|
||
(In reply to Jan de Mooij [:jandem] from comment #7) > So maybe this is just https://bugzilla.mozilla.org/show_bug.cgi?id=1444168 > Fingers crossed. Retriggers are green today so I pushed this again.
Comment 10•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/fe9b912b577a
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
status-firefox61:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in
before you can comment on or make changes to this bug.
Description
•