Closed Bug 1517461 Opened 2 years ago Closed 2 years ago

TypedArray objects from JIT code with non-inline elements are always foreground finalized

Categories

(Core :: JavaScript Engine, enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla66
Tracking Status
firefox66 --- fixed

People

(Reporter: anba, Assigned: anba)

Details

Attachments

(1 file)

|JSObject::allocKindForTenure| doesn't return a background allocation kind for TypedArray objects from JIT code with non-inline elements, which means these TypedArray objects are always finalized on the main thread.

It's not entirely clear to me if foreground finalization is required in this case  or just an oversight. If it is the former, the code should be commented accordingly to explain the rationale. But if it's the latter, we should apply the attached patch.
Attached patch bug1517461.patchSplinter Review
Nice catch!

I can't see any reason why we need to finalize TypedArray objects on the main thread and the tests pass locally with this patch.
Attachment #9034171 - Flags: review+
Assignee: nobody → andrebargull
Status: NEW → ASSIGNED

Pushed by cbrindusan@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b1c3821412f8
Use background allocation kind when tenuring typed arrays allocated from JIT code. r=jonco

Keywords: checkin-needed
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
You need to log in before you can comment on or make changes to this bug.