Objective-C API external object graphs don't handle generational collection properly

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark Hahnenberg]

If the set of Objective-C objects transitively reachable through an object changes, we need to update the set of opaque roots accordingly. If we don't, the next EdenCollection won't rescan the external object graph, which would lead us to consider a newly allocated JSManagedValue to be dead.

[Radar WebKit Bug Importer]

<rdar://problem/16612948>

[Mark Hahnenberg]

The fix is to record new pointers from old owners to new owned objects and to rescan those "remembered" owners with scanExternalObject graph during EdenCollections.

[Mark Hahnenberg]

Created attachment 229380 [details]
Patch

[Mark Hahnenberg]

Created attachment 229381 [details]
Patch

[Mark Hahnenberg]

Created attachment 229383 [details]
Patch

[Mark Hahnenberg]

Created attachment 229385 [details]
Patch

[Geoffrey Garen]

Comment on attachment 229385 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=229385&action=review

r=me

> Source/JavaScriptCore/API/JSVirtualMachine.mm:162
> +    [m_externalRememberedSet setObject:[NSNumber numberWithBool:true] forKey:object];

You might be able to use NSSet here with something similar to weakIDOptions.

> Source/JavaScriptCore/API/JSVirtualMachine.mm:293
> +        JSVirtualMachine *virtualMachine = [JSVMWrapperCache wrapperForJSContextGroupRef:toRef(&vm)];
> +        if (!virtualMachine)
> +            return;

Is it possible that the JSVirtualMachine will go away, by virtue of a zero retain count? If so, we'll forget all the external object graph stuff. Probably worth a follow-up bug.

[Mark Hahnenberg]

(In reply to comment #7)
> (From update of attachment 229385 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=229385&action=review
> 
> r=me
> 
> > Source/JavaScriptCore/API/JSVirtualMachine.mm:162
> > +    [m_externalRememberedSet setObject:[NSNumber numberWithBool:true] forKey:object];
> 
> You might be able to use NSSet here with something similar to weakIDOptions.
Looks like it's nontrivial to get NSSet to do weak references, so I guess I'll stick with NSMapTable for now.

> 
> > Source/JavaScriptCore/API/JSVirtualMachine.mm:293
> > +        JSVirtualMachine *virtualMachine = [JSVMWrapperCache wrapperForJSContextGroupRef:toRef(&vm)];
> > +        if (!virtualMachine)
> > +            return;
> 
> Is it possible that the JSVirtualMachine will go away, by virtue of a zero retain count? If so, we'll forget all the external object graph stuff. Probably worth a follow-up bug.
I filed bug 131691 for this.

[WebKit Commit Bot]

Comment on attachment 229385 [details]
Patch

Clearing flags on attachment: 229385

Committed r167326: <http://trac.webkit.org/changeset/167326>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.