166989 2017-01-12 14:54:56 -0800 We could probably remove the write barrier at the end Structure::flattenDictionaryStructure 2018-06-19 17:43:15 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED INVALID P2 Normal --- 166960 1 saam saam benjamin fpizlo ggaren gskachkov jfbastien keith_miller mark.lam msaboff oliver ticaiolima ysuzuki oldest_to_newest 1266305 0 saam 2017-01-12 14:54:56 -0800 After https://bugs.webkit.org/show_bug.cgi?id=166960, we'll have a way that rescans after races are detected. 1434657 1 saam 2018-06-19 17:39:23 -0700 I actually think this is necessary, imagine you're in the middle of flatten, and you have a butterfly that contains 3 valid properties, and a bunch of empty space, like this: {a, ..., b, ..., c, ...} and we want to end up with our property storage looking like this while in the middle of this loop: ``` // Copies in our values to their compacted locations. for (unsigned i = 0; i < propertyCount; i++) object->putDirect(vm, offsetForPropertyNumber(i, m_inlineCapacity), values[i]); ``` {..., a, ..., a, c} And imagine if we scanned the property storage at that point, we'd end not scanning for "b". Therefore, I think this barrier is indeed needed. 1434658 2 saam 2018-06-19 17:43:08 -0700 (In reply to Saam Barati from comment #1) > I actually think this is necessary, imagine you're in the middle of flatten, > and you have a butterfly that contains 3 valid properties, and a bunch of > empty space, like this: > {a, ..., b, ..., c, ...} > > and we want to end up with our property storage looking like this while in > the middle of this loop: > ``` > // Copies in our values to their compacted locations. > for (unsigned i = 0; i < propertyCount; i++) > object->putDirect(vm, offsetForPropertyNumber(i, > m_inlineCapacity), values[i]); > ``` > {..., a, ..., a, c} > > And imagine if we scanned the property storage at that point, we'd end not > scanning for "b". Therefore, I think this barrier is indeed needed. The reason we may not detect this as a race is like so: Imagine the collector did this: ReadStructureEarly ReadLastOffsetEarly ReadButterfly ReadStructureLate ReadLastOffsetLate then, the mutator does flattenDictionaryStructure mutator gets into the middle of the above loop collector scans property storage We won't detect a race here, but we need to rescan.