716176 - GC: missing barriers in BaseShape::operator=

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

When we copy shapes in adoptUnknown, barriers on getterObj and setterObj need to be triggered.

Comment 1

[Terrence Cole [:terrence]]

Attachment: v0: the general solution

This overrides BaseShape::operator= to manually trigger barriers on {g|s}etterObj.  They are not automatically barriered because they are behind a union.

Comment 2

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 587151 [details] [diff] [review]
v0: the general solution

Couldn't you just assign the fields individually, rather than using a memcpy? That would invoke most of the write barriers automatically.

Comment 3

[Terrence Cole [:terrence]]

Attachment: v1: Quite a bit uglier, but type safe.

Comment 4

[Terrence Cole [:terrence]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/6a0de913a042

Comment 5

[Terrence Cole [:terrence]]

Bill, is there a missing pre-barrier here?  I didn't add it because it wasn't there already, but it occurs to me that this gets called out of putProperty, where all sorts of weird stuff is going on.

Comment 6

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/6a0de913a042