Bug 134595

Summary: Stores to PropertyTable use the Structure as the owner
Product: WebKit Reporter: Mark Hahnenberg <mhahnenberg>
Component: JavaScriptCoreAssignee: Mark Hahnenberg <mhahnenberg>
Status: RESOLVED FIXED    
Severity: Normal CC: bunhere, cdumez, commit-queue, darin, fpizlo, ggaren, gyuyoung.kim, sergio
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Description Mark Hahnenberg 2014-07-03 09:03:51 PDT
Since PropertyTable is the object that does the marking of these references, it should be the owner.
Comment 1 Mark Hahnenberg 2014-07-03 10:20:26 PDT
Created attachment 234353 [details]
Patch
Comment 2 Darin Adler 2014-07-03 10:24:41 PDT
Comment on attachment 234353 [details]
Patch

More logical, simpler slightly faster code, but what other benefit is there to having the correct owner?
Comment 3 Mark Hahnenberg 2014-07-03 10:31:05 PDT
(In reply to comment #2)
> (From update of attachment 234353 [details])
> More logical, simpler slightly faster code, but what other benefit is there to having the correct owner?

It's a correctness issue for generational garbage collection. If the owner is the Structure instead of the PropertyTable, there's the possibility that the new value won't be visited during the next EdenCollection. Imagine the following situation:

Structure: old gen
PropertyTable: old gen
specificValue: young gen

In the current code, the Structure will be recorded in the remembered set as the object to visit during the next EdenCollection. When we visit it, the Structure will see that all of its children (including the PropertyTable) are already marked and return early. The specificValue in the PropertyTable will then not be marked, causing it to be prematurely collected.
Comment 4 Darin Adler 2014-07-03 10:40:25 PDT
(In reply to comment #3)
> It's a correctness issue for generational garbage collection.

Could you create a stress test that demonstrates the bug? Maybe not worth the effort.
Comment 5 Geoffrey Garen 2014-07-07 11:32:31 PDT
Typically (always?), a Structure is allocated after a specific value, so it may be impossible to trigger the scenario where the Structure is old and a specific value is new (in a test or in real life).
Comment 6 WebKit Commit Bot 2014-07-15 14:06:10 PDT
Comment on attachment 234353 [details]
Patch

Clearing flags on attachment: 234353

Committed r171115: <http://trac.webkit.org/changeset/171115>
Comment 7 WebKit Commit Bot 2014-07-15 14:06:17 PDT
All reviewed patches have been landed.  Closing bug.