GC: DenseArrays are missing some barrier calls

RESOLVED FIXED in mozilla11

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla11
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
When we do memcpy and memset on the elements array, we miss calling some important barriers.  The one I know about specifically is JSObject::initDenseArrayElements.  If we init array elements of an object in the long-lived heap with a GCThing in the nursery and miss this barrier, then we miss an important cross-generation pointer.
(Assignee)

Comment 1

5 years ago
Created attachment 582118 [details] [diff] [review]
v1: Replacing all uses of memcpy

This has no measurable effect on v8 performance.

I only updated places where we used memcpy on elements.  If you know of others, I can add them to this patch, or we can wait for the verifier to catch more later.
Assignee: general → terrence
Status: NEW → ASSIGNED
Attachment #582118 - Flags: review?(wmccloskey)
Comment on attachment 582118 [details] [diff] [review]
v1: Replacing all uses of memcpy

Cool, thanks.
Attachment #582118 - Flags: review?(wmccloskey) → review+
(Assignee)

Comment 3

5 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/fd9444ecf9a1
https://hg.mozilla.org/mozilla-central/rev/fd9444ecf9a1
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla11
You need to log in before you can comment on or make changes to this bug.