886575 - Fix generational GC crash on octane-gbemu

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: v0

When we store a value into TypedArray::DATA_SLOT that is into the middle of a nursery thing, we also store a write barrier to update it at the next minor GC. If, however, we do fallback marking because the buffer overflows, we skip this barrier. For this reason, and for eventual heap compaction, we need to do the same relocation as a normal part of marking.

Comment 1

[Terrence Cole [:terrence]]

Attachment: v1: fixed after jit-test crashes

The prior version crashes on 2 jittests that use DataView, because DataView does not have a trace hook. This adds the trace hook.

Comment 2

[Steve Fink [:sfink] [:s:]]

Comment on attachment 766974 [details] [diff] [review]
v1: fixed after jit-test crashes

Review of attachment 766974 [details] [diff] [review]:
-----------------------------------------------------------------

This is fine if you file a followup bug to do the IsMarked() on NEXT_VIEW_SLOT.

Comment 3

[Terrence Cole [:terrence]]

I added the VIEW_SLOT weak marking in this patch.

https://hg.mozilla.org/integration/mozilla-inbound/rev/866dbb8830d1

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/866dbb8830d1