952330 - Synchronize updates to global object slots

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

Some global object dynamically allocated reserved slots are read from off thread during IonBuilder (e.g. builtin class constructors), so the global object's slots need to be protected by the compilation lock.  Bug 785905 made a note of this but I forgot to actually add the synchronization code.

Comment 1

[Jan de Mooij [:jandem]]

Comment on attachment 8350391 [details] [diff] [review]
patch

Review of attachment 8350391 [details] [diff] [review]:
-----------------------------------------------------------------

Good find..

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/226af3342987

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Backed out in http://hg.mozilla.org/integration/mozilla-inbound/rev/4c45705d14c4 for apparently introducing ggc permaorange: https://tbpl.mozilla.org/php/getParsedLog.php?id=32292679&tree=Mozilla-Inbound

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Looks like the same error in rootanalysis: https://tbpl.mozilla.org/php/getParsedLog.php?id=32294137&tree=Mozilla-Inbound

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Relanded in http://hg.mozilla.org/integration/mozilla-inbound/rev/5a1833435382 because it was really bug 951213 that caused the bustage.

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/226af3342987