GC: missing barriers in BaseShape::operator=

RESOLVED FIXED in mozilla12

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla12
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

5 years ago
When we copy shapes in adoptUnknown, barriers on getterObj and setterObj need to be triggered.
(Assignee)

Comment 1

5 years ago
Created attachment 587151 [details] [diff] [review]
v0: the general solution

This overrides BaseShape::operator= to manually trigger barriers on {g|s}etterObj.  They are not automatically barriered because they are behind a union.
Attachment #587151 - Flags: review?(wmccloskey)
Comment on attachment 587151 [details] [diff] [review]
v0: the general solution

Couldn't you just assign the fields individually, rather than using a memcpy? That would invoke most of the write barriers automatically.
(Assignee)

Comment 3

5 years ago
Created attachment 587182 [details] [diff] [review]
v1: Quite a bit uglier, but type safe.
Attachment #587151 - Attachment is obsolete: true
Attachment #587151 - Flags: review?(wmccloskey)
Attachment #587182 - Flags: review?(wmccloskey)
Attachment #587182 - Flags: review?(wmccloskey) → review+
(Assignee)

Comment 4

5 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/6a0de913a042
(Assignee)

Comment 5

5 years ago
Bill, is there a missing pre-barrier here?  I didn't add it because it wasn't there already, but it occurs to me that this gets called out of putProperty, where all sorts of weird stuff is going on.
https://hg.mozilla.org/mozilla-central/rev/6a0de913a042
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla12
You need to log in before you can comment on or make changes to this bug.