841054 - GC: Exactly root ScriptFrameIter

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

From our exact rooting notes:
* Debugger.cpp uses ScriptFrameIter all over the place
 - inherits from StackIter, contains ion::InlineFrameIter, contains a pair of SnapshotIters which have an IonScript*
 - many uses of these are in hot code that can't GC during the iter's lifetime, and I'm not sure they all have convenient access to a cx
 - StackIter also contains a CallArgs, which contains a Value array (may not be live across GC?)

Comment 1

[Terrence Cole [:terrence]]

Attachment: v0

Nicolas r+ed this on IRC. 

If the static analysis is using a debug build, this could be the cause of the failures. Or there may be other stuff triggering it. I'll wait for a build tomorrow morning to find out.

Comment 2

[Nicholas Nethercote [inactive]]

The static analysis does use a debug build.

By my reckoning (see https://etherpad.mozilla.org/m5VbrA00YP for details) fixing StackIter will fix 33 of the remaining 97 hazards.

Comment 3

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9f1436e90783

Comment 4

[Nicholas Nethercote [inactive]]

> By my reckoning (see https://etherpad.mozilla.org/m5VbrA00YP for details)
> fixing StackIter will fix 33 of the remaining 97 hazards.

Holy crap, I was exactly right.  We're down to 64.  What do I win?

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9f1436e90783