If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Clone self hosted objects directly into tenured

RESOLVED FIXED in mozilla24

Status

()

Core
JavaScript Engine
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla24
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

4 years ago
Created attachment 749659 [details] [diff] [review]
v0

I've been eying this object creation path suspiciously for the last week and wondering why it wasn't breaking any tests. When I pulled yesterday morning, js1_8_5/extensions/sps-generators.js and js1_8_5/extensions/typedarray.js started failing when objects allocated from here move. These don't fail with --no-ion and the call site of the allocation is indeed out of Ion, under GetIntrinsicValue.

I think these sites will mostly be long live, so just automatically tenuring is probably the right decision here.
Attachment #749659 - Flags: review?(tschneidereit)
Comment on attachment 749659 [details] [diff] [review]
v0

Review of attachment 749659 [details] [diff] [review]:
-----------------------------------------------------------------

Yup, these objects should all pretty much live as long as the global they're cloned into.
Attachment #749659 - Flags: review?(tschneidereit) → review+
Why was this causing test failures?
(Assignee)

Comment 3

4 years ago
Right, so after a bit of debugging and talking with Brian on IRC, we should expect (and do see) crashes from not having these be tenured. The reason is that jitcode is allowed to bake in singletons, shapes, intrinsics, templates, and constants. Since, self-hosted code currently always (and I think in general always) falls into the intrinsic case, we're baking these into jitcode.
(Assignee)

Comment 4

4 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/8482c97a433e

Comment 5

4 years ago
https://hg.mozilla.org/mozilla-central/rev/8482c97a433e
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.