Last Comment Bug 716069 - GC: missing barriers in NewObjectCache::newObjectFromHit
: GC: missing barriers in NewObjectCache::newObjectFromHit
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla13
Assigned To: Terrence Cole [:terrence]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-06 14:07 PST by Terrence Cole [:terrence]
Modified: 2012-02-04 02:35 PST (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
v0 (3.09 KB, patch)
2012-01-12 12:01 PST, Terrence Cole [:terrence]
no flags Details | Diff | Splinter Review
v1: a friendlier version (4.04 KB, patch)
2012-01-12 19:04 PST, Terrence Cole [:terrence]
wmccloskey: review+
Details | Diff | Splinter Review

Description Terrence Cole [:terrence] 2012-01-06 14:07:16 PST
We should replace these tiny memcpys with direct assignment so that we trigger the barriers automatically through the operator= set in the HeapPtr<>.
Comment 1 Terrence Cole [:terrence] 2012-01-12 12:01:51 PST
Created attachment 588142 [details] [diff] [review]
v0
Comment 2 Terrence Cole [:terrence] 2012-01-12 19:04:56 PST
Created attachment 588283 [details] [diff] [review]
v1: a friendlier version

I had forgotten that I haven't landed the patch to put JSGC_GENERATIONAL in tree yet, so I missed the need to friend JSObject and NewObjectCache.
Comment 3 Bill McCloskey (:billm) 2012-02-01 17:05:39 PST
Comment on attachment 588283 [details] [diff] [review]
v1: a friendlier version

Review of attachment 588283 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsobj.h
@@ +1677,5 @@
>  
>    private:
>      inline bool lookup(Class *clasp, gc::Cell *key, gc::AllocKind kind, EntryIndex *pentry);
>      inline void fill(EntryIndex entry, Class *clasp, gc::Cell *key, gc::AllocKind kind, JSObject *obj);
> +    static inline void copyCachedToObject(JSObject *tgt, JSObject *src);

Please use dst for the name. It's more standard.

::: js/src/jsobjinlines.h
@@ +1590,5 @@
>      return fill(entry, clasp, type, kind, obj);
>  }
>  
> +inline void
> +NewObjectCache::copyCachedToObject(JSObject *tgt, JSObject *src) {

Use dst here too. Also, the { brace goes on its own line.
Comment 4 Terrence Cole [:terrence] 2012-02-03 11:21:54 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/72c55496b6e9
Comment 5 Marco Bonardo [::mak] (Away 6-20 Aug) 2012-02-04 02:35:39 PST
https://hg.mozilla.org/mozilla-central/rev/72c55496b6e9

Note You need to log in before you can comment on or make changes to this bug.