Bug 87180 – CopiedSpace::contains doesn't check for oversize blocks

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark Hahnenberg]

When doing a conservative scan we use CopiedSpace::contains to determine if a particular address points into the CopiedSpace. Currently contains() only checks if the address points to a block in to-space, which means that pointers to oversize blocks may not get scanned. 

We even have a BloomFilter for oversize blocks that I believe was originally intended to be used like the one for to-space.

[Mark Hahnenberg]

Created attachment 143413 [details]
Patch

[Geoffrey Garen]

Comment on attachment 143413 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=143413&action=review

r=me

> Source/JavaScriptCore/heap/CopiedSpaceInlineMethods.h:52
>  inline bool CopiedSpace::contains(void* ptr, CopiedBlock*& result)
>  {
>      CopiedBlock* block = blockFor(ptr);
> +    if (contains(block)) {
> +        result = block;
> +        return true;
> +    }
> +    block = oversizeBlockFor(ptr);
>      result = block;
> -    return !m_toSpaceFilter.ruleOut(reinterpret_cast<Bits>(block)) && m_toSpaceSet.contains(block);
> +    return contains(block);

You could simplify this code by giving oversized and normal blocks the same alignment -- then, one mask always gets you back to the block metadata. That's for another day, though.

[Mark Hahnenberg]

Committed r118093: <http://trac.webkit.org/changeset/118093>