Closed
Bug 711165
Opened 13 years ago
Closed 13 years ago
GC: DenseArrays are missing some barrier calls
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla11
People
(Reporter: terrence, Assigned: terrence)
References
Details
Attachments
(1 file)
|
1.56 KB,
patch
|
billm
:
review+
|
Details | Diff | Splinter Review |
When we do memcpy and memset on the elements array, we miss calling some important barriers. The one I know about specifically is JSObject::initDenseArrayElements. If we init array elements of an object in the long-lived heap with a GCThing in the nursery and miss this barrier, then we miss an important cross-generation pointer.
|
Assignee | |
Comment 1•13 years ago
|
||
This has no measurable effect on v8 performance.
I only updated places where we used memcpy on elements. If you know of others, I can add them to this patch, or we can wait for the verifier to catch more later.
Comment on attachment 582118 [details] [diff] [review]
v1: Replacing all uses of memcpy
Cool, thanks.
Attachment #582118 -
Flags: review?(wmccloskey) → review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
|
||
Comment 4•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla11
You need to log in
before you can comment on or make changes to this bug.
Description
•