Bug 134595 – Stores to PropertyTable use the Structure as the owner

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark Hahnenberg]

Since PropertyTable is the object that does the marking of these references, it should be the owner.

[Mark Hahnenberg]

Created attachment 234353 [details]
Patch

[Darin Adler]

Comment on attachment 234353 [details]
Patch

More logical, simpler slightly faster code, but what other benefit is there to having the correct owner?

[Mark Hahnenberg]

(In reply to comment #2)
> (From update of attachment 234353 [details])
> More logical, simpler slightly faster code, but what other benefit is there to having the correct owner?

It's a correctness issue for generational garbage collection. If the owner is the Structure instead of the PropertyTable, there's the possibility that the new value won't be visited during the next EdenCollection. Imagine the following situation:

Structure: old gen
PropertyTable: old gen
specificValue: young gen

In the current code, the Structure will be recorded in the remembered set as the object to visit during the next EdenCollection. When we visit it, the Structure will see that all of its children (including the PropertyTable) are already marked and return early. The specificValue in the PropertyTable will then not be marked, causing it to be prematurely collected.

[Darin Adler]

(In reply to comment #3)
> It's a correctness issue for generational garbage collection.

Could you create a stress test that demonstrates the bug? Maybe not worth the effort.

[Geoffrey Garen]

Typically (always?), a Structure is allocated after a specific value, so it may be impossible to trigger the scenario where the Structure is old and a specific value is new (in a test or in real life).

[WebKit Commit Bot]

Comment on attachment 234353 [details]
Patch

Clearing flags on attachment: 234353

Committed r171115: <http://trac.webkit.org/changeset/171115>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.