940629 - Root StackShape across getChildPropertyOnDictionary calls

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Steve Fink [:sfink] [:s:]]

There are 2 places where an unrooted StackShape is live across a call to getChildPropertyOnDictionary. The analysis does not report these as hazards because the StackShape is passed in by reference. Presumably these are reported instead as taking an address of an unrooted variable; I haven't looked.

Comment 1

[Steve Fink [:sfink] [:s:]]

Attachment: Root StackShape across getChildPropertyOnDictionary calls

r? bhackett because StackShape is rooted-on-demand, and these look like pretty hot uses. I don't know whether this'll show up on awfy ggc.

Comment 2

[Brian Hackett [Laid off!]]

Comment on attachment 8334770 [details] [diff] [review]
Root StackShape across getChildPropertyOnDictionary calls

Review of attachment 8334770 [details] [diff] [review]:
-----------------------------------------------------------------

(In reply to Steve Fink [:sfink] from comment #0)
> Presumably these are
> reported instead as taking an address of an unrooted variable; I haven't
> looked.

Can you look, please?

Comment 3

[Steve Fink [:sfink] [:s:]]

Yes, they're there. Example:

Function 'js::Shape* JSObject::putProperty(js::ForkJoinSlice*, class JS::Handle<JSObject*>, class JS::Handle<jsid>, (uint8)(JSContext*,class JS::Handle<JSObject*>,class JS::Handle<jsid>,class JS::MutableHandle<JS::Value>)*, (uint8)(JSContext*,class JS::Handle<JSObject*>,class JS::Handle<jsid>,uint8,class JS::MutableHandle<JS::Value>)*, uint32, uint32, uint32, int32) [with js::ExecutionMode mode = (js::ExecutionMode)1u; typename js::ExecutionModeTraits<mode>::ExclusiveContextType = js::ForkJoinSlice*; JS::HandleObject = JS::Handle<JSObject*>; JS::HandleId = JS::Handle<jsid>; js::PropertyOp = bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>); js::StrictPropertyOp = bool (*)(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool, JS::MutableHandle<JS::Value>); uint32_t = unsigned int]' takes unsafe address of unrooted 'child' at js/src/vm/Shape.cpp:919

Comment 4

[Steve Fink [:sfink] [:s:]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/e9294ddf600c

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e9294ddf600c