When we do memcpy and memset on the elements array, we miss calling some important barriers. The one I know about specifically is JSObject::initDenseArrayElements. If we init array elements of an object in the long-lived heap with a GCThing in the nursery and miss this barrier, then we miss an important cross-generation pointer.
Created attachment 582118 [details] [diff] [review] v1: Replacing all uses of memcpy This has no measurable effect on v8 performance. I only updated places where we used memcpy on elements. If you know of others, I can add them to this patch, or we can wait for the verifier to catch more later.
Comment on attachment 582118 [details] [diff] [review] v1: Replacing all uses of memcpy Cool, thanks.