Bug 159537 – REGRESSION(184445): Need to insert a StoreBarrier when we don't know child's epoch

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

In StoreBarrierInsertionPhase::considerBarrier(Edge base, Edge child), there is the following comment and code:

        // Something we watch out for here is that the null epoch is a catch-all for objects
        // allocated before we did any epoch tracking. Two objects being in the null epoch
        // means that we don't know their epoch relationship.
        if (!!base->epoch() && base->epoch() >= child->epoch()) {
            if (verbose)
                dataLog("            Rejecting because of epoch ordering.\n");
            return;
        }
The test doesn't check that the child's epoch is null and therefore we won't insert a barrier for the case where we allocate the base object, but don't know when the child object was allocated.

<rdar://problem/23438751>

[Michael Saboff]

Created attachment 283101 [details]
Patch

[Michael Saboff]

Committed r202955: <http://trac.webkit.org/changeset/202955>