Closed Bug 1694209 Opened 3 months ago Closed 3 months ago

Stop the pre-write barrier accessing the mark stack directly


(Core :: JavaScript: GC, task, P3)




88 Branch
Tracking Status
firefox88 --- fixed


(Reporter: jonco, Assigned: jonco)


(Blocks 1 open bug)



(2 files)

For concurrent marking we want to ensure that only one thread accesses the mark stack at one time. To do this we need to change the per-write barrier, since that can currently access the mark stack from the main thread when the barrier is triggered.

Currently the barrier will mark unmarked cells and traverse them. Depending on the cell type this may push cell onto the mark stack or it may eagerly scan it and process its children.

The plan is to change the barrier to mark the barriered cell black (to prevent the barrier firing for this cell again) and then add it to a separate buffer for later processing. This buffer will be processed as part of normal marking, with a fallback if the buffer grows too large.

Hopefully this will not noticeably affect performance.

This refactors GCMarker::traverse into markAndTraverse and traverse methods, so that we can mark a cell in the barrier but traverse its children later.

The aim of this is to mark cells in the barrier but delay marking of their children (which can access the mark stack) until a later point when the barrier buffer is processed in one go.

One problem that came up was with strings barriered during rope flattening. These are valid in the barrier but then have some of their contents overwritten with temporary data during flattening. If we try and process the barrier buffer at this point we will crash. Fortunately we don't actually need to process the children of ropes here because this code performs the barrier for all ropes in the tree already.

I had to change some test code because unmarking cells that had been marked by the barrier broke some of the assertions I added.

Depends on D106150

Pushed by
Add a GCMarker method to traverse previously marked GC things r=sfink
Buffer GC things in the pre-write barrier and process them later r=sfink
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → 88 Branch
Regressions: 1695861
Regressions: 1695891
Regressions: 1696026
You need to log in before you can comment on or make changes to this bug.