829372 - GC: Root analysis is clobbering non-pointer-sized roots

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: v0

Because we treat all Rooted as Rooted<void*> when doing an analysis, we need to not store the |bool scanned| flag after |T ptr|, even though it is smaller than T.

Comment 1

[Steve Fink [:sfink] [:s:]]

Comment on attachment 700774 [details] [diff] [review]
v0

Review of attachment 700774 [details] [diff] [review]:
-----------------------------------------------------------------

Very nice cleanup of the field initialization. I'm dumb for not doing that in the first place.

::: js/src/gc/Root.h
@@ +726,5 @@
>      Rooted<T> **stack, *prev;
>  #endif
> +
> +#if defined(JSGC_ROOT_ANALYSIS)
> +    /* Has the rooting analysis ever scanned this Rooted's stack location? */

Can you also mention that it must come before T in order for upcasts to Rooted<void*> to work?

Comment 2

[Terrence Cole [:terrence]]

Oh, good thought!

https://hg.mozilla.org/integration/mozilla-inbound/rev/fa88bbeed9b1

Comment 3

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/fa88bbeed9b1

Comment 4

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/fa88bbeed9b1

Comment 5

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/fa88bbeed9b1