Last Comment Bug 711165 - GC: DenseArrays are missing some barrier calls
: GC: DenseArrays are missing some barrier calls
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla11
Assigned To: Terrence Cole [:terrence]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: 673454
  Show dependency treegraph
Reported: 2011-12-15 10:43 PST by Terrence Cole [:terrence]
Modified: 2011-12-16 05:52 PST (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

v1: Replacing all uses of memcpy (1.56 KB, patch)
2011-12-15 15:03 PST, Terrence Cole [:terrence]
wmccloskey: review+
Details | Diff | Splinter Review

Description Terrence Cole [:terrence] 2011-12-15 10:43:37 PST
When we do memcpy and memset on the elements array, we miss calling some important barriers.  The one I know about specifically is JSObject::initDenseArrayElements.  If we init array elements of an object in the long-lived heap with a GCThing in the nursery and miss this barrier, then we miss an important cross-generation pointer.
Comment 1 Terrence Cole [:terrence] 2011-12-15 15:03:24 PST
Created attachment 582118 [details] [diff] [review]
v1: Replacing all uses of memcpy

This has no measurable effect on v8 performance.

I only updated places where we used memcpy on elements.  If you know of others, I can add them to this patch, or we can wait for the verifier to catch more later.
Comment 2 [PTO to Dec5] Bill McCloskey (:billm) 2011-12-15 15:06:56 PST
Comment on attachment 582118 [details] [diff] [review]
v1: Replacing all uses of memcpy

Cool, thanks.
Comment 3 Terrence Cole [:terrence] 2011-12-15 15:30:25 PST
Comment 4 :Ms2ger (⌚ UTC+1/+2) 2011-12-16 05:52:40 PST

Note You need to log in before you can comment on or make changes to this bug.