Bug 125425 - Fold storage pointer for GC-allocated typed arrays
Summary: Fold storage pointer for GC-allocated typed arrays
Status: REOPENED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-12-08 12:04 PST by Filip Pizlo
Modified: 2016-08-23 15:15 PDT (History)
7 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-12-08 12:04:26 PST 
This probably won't be *too* profitable but I suspect that eventually it'll be needed.
Comment 1 Filip Pizlo 2016-08-23 13:43:12 PDT 

*** This bug has been marked as a duplicate of bug 161100 ***
Comment 2 Filip Pizlo 2016-08-23 15:15:22 PDT 
Nope, this is still a bug.

Even if the GC-allocated typed array doesn't move, we still can't constant-fold pointers to it because of neutering:

- To constant-fold, we need to install a watchpoint on the typed array's underlying buffer to make sure that we get notified if it gets neutered.
- To install a watchpoint, we need to request the buffer.
- To request the buffer, we need to move the backing store out of GC space.
- To move it out of GC space, we need to malloc a new backing store and copy the data over and repoint m_vector.
- Therefore, constant folding will fold to the *old* buffer.

Ouch!