Fix post barriers on the IonScript's fields

RESOLVED FIXED in mozilla23

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla23
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

5 years ago
Created attachment 746116 [details] [diff] [review]
v0

IonScripts normally live as long as their owner JSScript; however, they can occasionally get destroyed outside the context of a GC by FinishInvalidationOf. Because of this case, we cannot use the normal store buffer to guard them. Instead we use the generic buffer to mark the owner script, which will mark the IonScript's fields, if it is still alive.
Attachment #746116 - Flags: review?(dvander)
Attachment #746116 - Flags: review?(dvander) → review+
(Assignee)

Comment 1

5 years ago
Created attachment 747051 [details] [diff] [review]
vFinal: for checkin.
Attachment #746116 - Attachment is obsolete: true
Attachment #747051 - Flags: review+
(Assignee)

Updated

5 years ago
Whiteboard: [checkin-needed]
https://hg.mozilla.org/mozilla-central/rev/25bce82749bc
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
(Assignee)

Updated

5 years ago
Depends on: 880816
You need to log in before you can comment on or make changes to this bug.