nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1787351 - Don't remove the atoms zone from the zones list until after we've marked everything black r=sfink

Browse source 
Iterating cells in the atoms zone will try to evict the nursery (it's empty in
this case) and if the appropriate zeal mode is set we will then try to check
the heap. This causes an assertion failure because the the zones list is
unexpectedly empty.

Doing things in a different order prevents this issue from arising.

Differential Revision: https://phabricator.services.mozilla.com/D155689
This commit is contained in:
Jon Coppeard 2022-08-30 18:10:03 +00:00
parent 3189560325
commit c9be20df93
2 changed files with 6 additions and 5 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

10
js/src/gc/GC.cpp
View file

@ -943,13 +943,10 @@ bool GCRuntime::freezeSharedAtomsZone() {
MOZ_ASSERT(!atomsZone()->wasGCStarted());
MOZ_ASSERT(!atomsZone()->needsIncrementalBarrier());
sharedAtomsZone_ = atomsZone();
zones().clear();
sharedAtomsZone_->arenas.clearFreeLists();
atomsZone()->arenas.clearFreeLists();
for (auto kind : AllAllocKinds()) {
for (auto thing = sharedAtomsZone_->cellIterUnsafe<TenuredCell>(kind);
for (auto thing = atomsZone()->cellIterUnsafe<TenuredCell>(kind);
!thing.done(); thing.next()) {
TenuredCell* cell = thing.getCell();
MOZ_ASSERT((cell->is<JSString>() &&
@ -960,6 +957,9 @@ bool GCRuntime::freezeSharedAtomsZone() {
}
}
sharedAtomsZone_ = atomsZone();
zones().clear();
UniquePtr<Zone> zone = MakeUnique<Zone>(rt, Zone::AtomsZone);
if (!zone || !zone->init()) {
return false;

1
js/src/jit-test/tests/gc/bug-1787351.js Normal file
View file

@ -0,0 +1 @@
// |jit-test| --gc-zeal=15