nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Backed out changeset 8038f0b90bbd (bug 1866518) for causing SM bustages on bug1866518-nursery-AB.js CLOSED TREE

Browse source
This commit is contained in:
Norisz Fay 2023-12-03 20:44:01 +02:00
parent 9eb1000917
commit 116a776274
2 changed files with 1 additions and 21 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

10
js/src/gc/Nursery.h
View file

@ -112,15 +112,7 @@ class Nursery {
MOZ_ALWAYS_INLINE bool isInside(gc::Cell* cellp) const = delete;
MOZ_ALWAYS_INLINE bool isInside(const void* p) const {
for (auto* chunk : chunks_) {
// The first sizeof(ChunkBase) bytes of the nursery is never used for
// data, which means that a pointer to the beginning of the nursery should
// be considered as a zero-length pointer to the end of the memory just
// before the chunk (as otherwise it would be ambiguous).
//
// It would be best to use chunk->start(), but that would require dragging
// a huge amount of stuff into *-inl.h files.
uintptr_t chunkStart = uintptr_t(chunk) + sizeof(gc::ChunkBase);
if (uintptr_t(p) - chunkStart <= gc::ChunkSize) {
if (uintptr_t(p) - uintptr_t(chunk) < gc::ChunkSize) {
return true;
}
}

12
js/src/jit-test/tests/typedarray/bug1866518-nursery-AB.js
View file

@ -1,12 +0,0 @@
// 9373 iterations were enough to trigger the crash, which requires
// allocating an empty ArrayBuffer in the last Cell of a Chunk that
// comes just before a NurseryChunk.
//
// 15000 iterations ran in 1 second on my machine.
evalInWorker(`
gczeal(14);
a = [];
for (let b = 0; b < 15000; b++)
a.push(new ArrayBuffer);
`);