Closed
Bug 1765338
Opened 3 years ago
Closed 3 years ago
Allow transplanting nursery objects
Categories
(Core :: JavaScript Engine, task, P3)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
101 Branch
| Tracking | Status | |
|---|---|---|
| firefox101 | --- | fixed |
People
(Reporter: jonco, Assigned: jonco)
References
Details
Attachments
(2 files)
Currently we only allow tenured objects to be transplanted with JSObject::swap. Allowing this would enable allocating more DOM wrappers in the nursery and this may may help react based workloads which currently see high nursery promotion rates.
|
Assignee | |
Comment 1•3 years ago
|
||
|
|
Assignee | |
Comment 2•3 years ago
|
||
Depends on D144019
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/3ab34a61f679
Allow transplanting of nursery objects r=jandem
https://hg.mozilla.org/integration/autoland/rev/ace593c684db
Don't force the result of JS_CloneObject to be tenured r=jandem
|
||
Comment 4•3 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/3ab34a61f679
https://hg.mozilla.org/mozilla-central/rev/ace593c684db
Status: NEW → RESOLVED
Closed: 3 years ago
status-firefox101:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 101 Branch
|
|
Assignee | |
Updated•2 years ago
|
Regressions: CVE-2023-37202
You need to log in
before you can comment on or make changes to this bug.
Description
•