BaseShape::getterObj (and setterObj) are not write barriered

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla11
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
These fields are immutable, so they do not necessarily need a barrier for incremental collection -- they do, however, need a barrier for generational collection, and for reliable verification of the barriers.  It would be nice to make these HeapPtr's, rather than manually calling the barrier functions, but the fields are unioned with a function pointer, so this is not trivial.
(Assignee)

Comment 1

6 years ago
Created attachment 582155 [details] [diff] [review]
v1: post barrier BaseShape::getterObj and setterObj

This is how we are adding barriers for the unioned fields in String, so I think this is probably fine.
Assignee: general → terrence
Status: NEW → ASSIGNED
Attachment #582155 - Flags: review?(wmccloskey)
Comment on attachment 582155 [details] [diff] [review]
v1: post barrier BaseShape::getterObj and setterObj

Yeah, I guess this is fine.
Attachment #582155 - Flags: review?(wmccloskey) → review+
(Assignee)

Comment 3

6 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/ea39fc88f948

Comment 4

6 years ago
https://hg.mozilla.org/mozilla-central/rev/ea39fc88f948
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla11
You need to log in before you can comment on or make changes to this bug.