933382 - GenerationalGC: Fix the all-slots post barrier

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: fix_allslots_barrier-v0.diff

Hannes noticed that the AllSlots post barrier is broken: it skips the barrier if uintptr_t(obj) > nursery->end(). This probably accounts for some random GGC failures.

Comment 1

[Hannes Verschore [:h4writer]]

Comment on attachment 825435 [details] [diff] [review]
fix_allslots_barrier-v0.diff

Review of attachment 825435 [details] [diff] [review]:
-----------------------------------------------------------------

This is still wrong:

You told me this should be:
|if (!inNursery(obj)) { ool }|

That means:
>    Register objreg = ToRegister(lir->object());
>    masm.branchPtr(Assembler::Below, objreg, ImmWord(nursery.start()), ool->entry());                 
>    masm.branchPtr(Assembler::Below, objreg, ImmWord(nursery.heapEnd()), ool->rejoin());
> +  masm.jump(ool->entry());              
>    masm.bind(ool->rejoin());

or better:
>    Register objreg = ToRegister(lir->object());
>    masm.branchPtr(Assembler::Below, objreg, ImmWord(nursery.start()), ool->entry()); 
> -  masm.branchPtr(Assembler::Below, objreg, ImmWord(nursery.heapEnd()), ool->rejoin());                
> +  masm.branchPtr(Assembler::AboveOrEqual, objreg, ImmWord(nursery.heapEnd()), ool->entry());
>    masm.bind(ool->rejoin());

Comment 2

[Terrence Cole [:terrence]]

Attachment: fix_allslots_barrier-v1.diff

Yeah, that was pretty dumb. Lets use your second suggestion.

Comment 3

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3436653be106

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/3436653be106