Closed
Bug 707842
Opened 12 years ago
Closed 12 years ago
Multiple shapes are sharing BaseShapes that have PropertyTables, which shouldn't happen
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla11
People
(Reporter: n.nethercote, Assigned: bhackett1024)
References
Details
Attachments
(1 file)
8.45 KB,
patch
|
luke
:
review+
|
Details | Diff | Splinter Review |
DMD tells me that PropertyTables are being counted twice. The attached file contains the error message. There's only one place that PropertyTables are counted (the shape->sizeOfPropertyTable() call in XPCJSRuntime.cpp), so the problem doesn't appear to be with the memory reporting code. bhackett said on IRC: "base shapes with property tables are supposed to be 1:1 with the shapes that own them, but if multiple shapes have the same owned base shape then the double counting could happen". So it's probably a problem with the handling of Shapes and BaseShapes.
![]() |
Reporter | |
Updated•12 years ago
|
Blocks: ObjectShrink
No longer depends on: ObjectShrink
Assignee | ||
Comment 1•12 years ago
|
||
Improve the types of the shape constructors to require that an unowned base shape be initially supplied. Doing this caught one instance we were passing a possibly owned base shape, in JSObject::addPropertyInternal, though I haven't confirmed this is definitely the cause of this bug.
Attachment #579762 -
Flags: review?(luke)
![]() |
||
Comment 2•12 years ago
|
||
Comment on attachment 579762 [details] [diff] [review] improve Shape constructors Mmm types.
Attachment #579762 -
Flags: review?(luke) → review+
Assignee | ||
Comment 3•12 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/a4a742eac3ab
![]() |
Reporter | |
Comment 4•12 years ago
|
||
I just did a couple of DMD runs and I'm not getting the warnings about double-counting any more! Good news. bhackett, could bad things have happened as a result of this bug?
Assignee | ||
Comment 5•12 years ago
|
||
(In reply to Nicholas Nethercote [:njn] from comment #4) > I just did a couple of DMD runs and I'm not getting the warnings about > double-counting any more! Good news. > > bhackett, could bad things have happened as a result of this bug? Sharing an owned base shape between multiple shapes could cause incorrect lookups --- one or the other shape will have an incorrect property table, and when doing a search for a native property of the object a shape might not be found even though it is on the object. I *think* that is the only fallout of this particular problem.
Comment 6•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/a4a742eac3ab
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla11
You need to log in
before you can comment on or make changes to this bug.
Description
•