TypedArray objects from JIT code with non-inline elements are always foreground finalized

RESOLVED FIXED in Firefox 66

Status

()

enhancement
RESOLVED FIXED
4 months ago
3 months ago

People

(Reporter: anba, Assigned: anba)

Tracking

Trunk
mozilla66
Points:
---

Firefox Tracking Flags

(firefox66 fixed)

Details

Attachments

(1 attachment)

(Assignee)

Description

4 months ago
|JSObject::allocKindForTenure| doesn't return a background allocation kind for TypedArray objects from JIT code with non-inline elements, which means these TypedArray objects are always finalized on the main thread.

It's not entirely clear to me if foreground finalization is required in this case  or just an oversight. If it is the former, the code should be commented accordingly to explain the rationale. But if it's the latter, we should apply the attached patch.
(Assignee)

Comment 1

4 months ago
Nice catch!

I can't see any reason why we need to finalize TypedArray objects on the main thread and the tests pass locally with this patch.
Attachment #9034171 - Flags: review+
(Assignee)

Updated

3 months ago
Assignee: nobody → andrebargull
Status: NEW → ASSIGNED

Comment 4

3 months ago

Pushed by cbrindusan@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b1c3821412f8
Use background allocation kind when tenuring typed arrays allocated from JIT code. r=jonco

Keywords: checkin-needed

Comment 5

3 months ago
bugherder
Status: ASSIGNED → RESOLVED
Last Resolved: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
You need to log in before you can comment on or make changes to this bug.