Moving a HeapPtr asserts the contents are not gray
Categories
(Core :: JavaScript: GC, defect, P1)
Tracking
()
Tracking | Status | |
---|---|---|
firefox72 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(3 files)
This is showing up with the debugger changes in bug 1592116:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=276383216&repo=try&lineNumber=25499
We want to assert that we don't assign a HeapPtr with a pointer to a gray GC thing, but I think that moving a HeapPtr should not check this. Also, it shouldn't trigger barriers which it looks like this will do.
Assignee | ||
Updated•5 years ago
|
Assignee | ||
Comment 1•5 years ago
|
||
(In reply to Jon Coppeard (:jonco) from comment #0)
Also, it shouldn't trigger barriers which it looks like this will do.
It's triggering barriers on the destination of the move, which is correct.
Assignee | ||
Comment 2•5 years ago
|
||
Updated•5 years ago
|
Assignee | ||
Comment 3•5 years ago
|
||
More use is being made of C++ move semantics recently and this imporves support for moving our GC wrapper types. In this case we don't want to trigger the pre-barrier on the source of the move because we are not modifying the object graph. We also do not want to check that wrapper contents are non gray, because this is valid (it's not valid to create a new heap pointer to a GC thing).
The patch adds a release() method to wrappers that returns the original contents of the wrapper after clearing it, without triggering a pre-barrier. Also it adds setUnchecked() methods to set wrapper contents without the gray marking check.
Depends on D54304
Assignee | ||
Comment 4•5 years ago
|
||
Comment 6•5 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/2607f7ba81ba
https://hg.mozilla.org/mozilla-central/rev/d3e369f6977c
https://hg.mozilla.org/mozilla-central/rev/f4a33a4dbfa7
Description
•