In StoreBarrierInsertionPhase::considerBarrier(Edge base, Edge child), there is the following comment and code: // Something we watch out for here is that the null epoch is a catch-all for objects // allocated before we did any epoch tracking. Two objects being in the null epoch // means that we don't know their epoch relationship. if (!!base->epoch() && base->epoch() >= child->epoch()) { if (verbose) dataLog(" Rejecting because of epoch ordering.\n"); return; } The test doesn't check that the child's epoch is null and therefore we won't insert a barrier for the case where we allocate the base object, but don't know when the child object was allocated. <rdar://problem/23438751>
Created attachment 283101 [details] Patch
Committed r202955: <http://trac.webkit.org/changeset/202955>