Last Comment Bug 716176 - GC: missing barriers in BaseShape::operator=
: GC: missing barriers in BaseShape::operator=
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla12
Assigned To: Terrence Cole [:terrence]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-06 19:11 PST by Terrence Cole [:terrence]
Modified: 2012-01-10 01:58 PST (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
v0: the general solution (2.32 KB, patch)
2012-01-09 14:30 PST, Terrence Cole [:terrence]
no flags Details | Diff | Review
v1: Quite a bit uglier, but type safe. (2.53 KB, patch)
2012-01-09 15:59 PST, Terrence Cole [:terrence]
wmccloskey: review+
Details | Diff | Review

Description Terrence Cole [:terrence] 2012-01-06 19:11:42 PST
When we copy shapes in adoptUnknown, barriers on getterObj and setterObj need to be triggered.
Comment 1 Terrence Cole [:terrence] 2012-01-09 14:30:40 PST
Created attachment 587151 [details] [diff] [review]
v0: the general solution

This overrides BaseShape::operator= to manually trigger barriers on {g|s}etterObj.  They are not automatically barriered because they are behind a union.
Comment 2 Bill McCloskey (:billm) 2012-01-09 14:36:04 PST
Comment on attachment 587151 [details] [diff] [review]
v0: the general solution

Couldn't you just assign the fields individually, rather than using a memcpy? That would invoke most of the write barriers automatically.
Comment 3 Terrence Cole [:terrence] 2012-01-09 15:59:22 PST
Created attachment 587182 [details] [diff] [review]
v1: Quite a bit uglier, but type safe.
Comment 4 Terrence Cole [:terrence] 2012-01-09 16:10:44 PST
http://hg.mozilla.org/integration/mozilla-inbound/rev/6a0de913a042
Comment 5 Terrence Cole [:terrence] 2012-01-09 16:19:54 PST
Bill, is there a missing pre-barrier here?  I didn't add it because it wasn't there already, but it occurs to me that this gets called out of putProperty, where all sorts of weird stuff is going on.
Comment 6 Marco Bonardo [::mak] 2012-01-10 01:58:26 PST
https://hg.mozilla.org/mozilla-central/rev/6a0de913a042

Note You need to log in before you can comment on or make changes to this bug.