Closed
Bug 869222
Opened 12 years ago
Closed 12 years ago
Fix post barriers on the IonScript's fields
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla23
People
(Reporter: terrence, Assigned: terrence)
References
Details
Attachments
(1 file, 1 obsolete file)
|
6.40 KB,
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
IonScripts normally live as long as their owner JSScript; however, they can occasionally get destroyed outside the context of a GC by FinishInvalidationOf. Because of this case, we cannot use the normal store buffer to guard them. Instead we use the generic buffer to mark the owner script, which will mark the IonScript's fields, if it is still alive.
Attachment #746116 -
Flags: review?(dvander)
|
||
Updated•12 years ago
|
Attachment #746116 -
Flags: review?(dvander) → review+
|
Assignee | |
Comment 1•12 years ago
|
||
Attachment #746116 -
Attachment is obsolete: true
Attachment #747051 -
Flags: review+
|
|
Assignee | |
Comment 2•12 years ago
|
||
Green try run: https://tbpl.mozilla.org/?tree=Try&rev=8ea3d8d7ce1d
|
|
Assignee | |
Updated•12 years ago
|
Whiteboard: [checkin-needed]
|
||
Comment 3•12 years ago
|
||
Whiteboard: [checkin-needed]
|
|
||
Comment 4•12 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in
before you can comment on or make changes to this bug.
Description
•