Bug 134595 - Stores to PropertyTable use the Structure as the owner
Summary: Stores to PropertyTable use the Structure as the owner
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Hahnenberg
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-03 09:03 PDT by Mark Hahnenberg
Modified: 2014-07-15 14:06 PDT (History)
8 users (show)

See Also:


Attachments
Patch (19.37 KB, patch)
2014-07-03 10:20 PDT, Mark Hahnenberg
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Hahnenberg 2014-07-03 09:03:51 PDT
Since PropertyTable is the object that does the marking of these references, it should be the owner.
Comment 1 Mark Hahnenberg 2014-07-03 10:20:26 PDT
Created attachment 234353 [details]
Patch
Comment 2 Darin Adler 2014-07-03 10:24:41 PDT
Comment on attachment 234353 [details]
Patch

More logical, simpler slightly faster code, but what other benefit is there to having the correct owner?
Comment 3 Mark Hahnenberg 2014-07-03 10:31:05 PDT
(In reply to comment #2)
> (From update of attachment 234353 [details])
> More logical, simpler slightly faster code, but what other benefit is there to having the correct owner?

It's a correctness issue for generational garbage collection. If the owner is the Structure instead of the PropertyTable, there's the possibility that the new value won't be visited during the next EdenCollection. Imagine the following situation:

Structure: old gen
PropertyTable: old gen
specificValue: young gen

In the current code, the Structure will be recorded in the remembered set as the object to visit during the next EdenCollection. When we visit it, the Structure will see that all of its children (including the PropertyTable) are already marked and return early. The specificValue in the PropertyTable will then not be marked, causing it to be prematurely collected.
Comment 4 Darin Adler 2014-07-03 10:40:25 PDT
(In reply to comment #3)
> It's a correctness issue for generational garbage collection.

Could you create a stress test that demonstrates the bug? Maybe not worth the effort.
Comment 5 Geoffrey Garen 2014-07-07 11:32:31 PDT
Typically (always?), a Structure is allocated after a specific value, so it may be impossible to trigger the scenario where the Structure is old and a specific value is new (in a test or in real life).
Comment 6 WebKit Commit Bot 2014-07-15 14:06:10 PDT
Comment on attachment 234353 [details]
Patch

Clearing flags on attachment: 234353

Committed r171115: <http://trac.webkit.org/changeset/171115>
Comment 7 WebKit Commit Bot 2014-07-15 14:06:17 PDT
All reviewed patches have been landed.  Closing bug.