[Webkit-unassigned] [Bug 167208] New: The mutator needs to fire a barrier after memmoving stuff around in an object that the GC scans

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=167208

            Bug ID: 167208
           Summary: The mutator needs to fire a barrier after memmoving
                    stuff around in an object that the GC scans
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: fpizlo at apple.com

We didn't used to need these kinds of barriers, but now we do!

It used to be that if you moved a value from one place to another in the same object then there is no need for a barrier because the generational GC would have no need to know that the referent still continues to refer to the same referee.

But the concurrent GC might scan that object as the mutator moves pointers around in it. If the ordering is right, this could mean that the collector never sees some of those pointers. This can be fixed by adding a barrier.

This bug covers the most obvious cases I found.  There may be more and I'll continue to audit.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170119/3840ca45/attachment.html>