Closed Bug 1458008 Opened 6 years ago Closed 6 years ago

Shuffle Shape flags around to avoid races

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox61 --- fixed

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

Attached patch PatchSplinter Review
Shape::slotInfo stores the number of slots, number of fixed slots, and the number of linear searches. The latter is mutable and this really upsets TSan when an Ion compilation thread calls numFixedSlots on a template object's shape while the main thread increments the number of linear searches. Shape::flags has a similar issue.

The attached patch renames slotInfo => immutableFlags and flags => mutableFlags and moves some flags around. Now immutableFlags stores the slot info and the is-dictionary/is-accessor-shape flags. The mutableFlags byte stores the number of linear searches, the overwritten flag, and the isBigEnoughForAShapeTable bits.

This fixes most of our TSan races when running jit-tests.
Attachment #8972112 - Flags: review?(jcoppeard)
Priority: -- → P1
Comment on attachment 8972112 [details] [diff] [review]
Patch

Review of attachment 8972112 [details] [diff] [review]:
-----------------------------------------------------------------

Nice regorganisation.
Attachment #8972112 - Flags: review?(jcoppeard) → review+
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1a9703589230
Shuffle Shape flags around to avoid races with off-thread compilation. r=jonco
Weird, this only fails on Win32 debug. Will see if it repros...
So maybe this is just https://bugzilla.mozilla.org/show_bug.cgi?id=1444168 Fingers crossed.
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fe9b912b577a
Shuffle Shape flags around to avoid races with off-thread compilation. r=jonco
(In reply to Jan de Mooij [:jandem] from comment #7)
> So maybe this is just https://bugzilla.mozilla.org/show_bug.cgi?id=1444168
> Fingers crossed.

Retriggers are green today so I pushed this again.
https://hg.mozilla.org/mozilla-central/rev/fe9b912b577a
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
You need to log in before you can comment on or make changes to this bug.