<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - CodeBlock's finalization of ValueProfiles should be in the finalizer"
href="https://bugs.webkit.org/show_bug.cgi?id=164282#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - CodeBlock's finalization of ValueProfiles should be in the finalizer"
href="https://bugs.webkit.org/show_bug.cgi?id=164282">bug 164282</a>
from <span class="vcard"><a class="email" href="mailto:fpizlo@apple.com" title="Filip Pizlo <fpizlo@apple.com>"> <span class="fn">Filip Pizlo</span></a>
</span></b>
<pre>Here's a sequence of events. I will mark events that happen with the world stopped with an *.
(0) GC is running, mutator has heap access
(1) op_enter in codeBlock
(2) writeBarrier(codeBlock)
(3) codeBlock.visitChildren
(4) valueProfile(codeBlock)
(5) codeBlock no longer on the stack
(6*) scan stack
(7*) end marking
(8*) run all unconditional finalizers, including codeBlock's.
In this world, the value profile update will not be handled by the GC because that's done in visitChildren and visitChildren will not run after the value profiling.
But we already have finalizers that can do this, and the ValueProfile work is finalization (it clears references to things) not marking (it never marks things).
So, to fix this bug, we just need to move the ValueProfile logic into the UnconditionalFinalizer.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>