Bug 162319

Summary: DFG::StoreBarrierInsertionPhase should assume that any epoch increment may make objects older
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, keith_miller, mark.lam, msaboff, saam
Priority: P2    
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Bug Depends on:    
Bug Blocks: 149432    
Attachments:
Description Flags
the patch saam: review+

Filip Pizlo
Reported 2016-09-20 14:24:40 PDT
If you just allocated an object, then it's true that the object must be white. But as soon as you do anything to it, it will become black. The insertion phase needs to be smart about this.
Attachments
the patch (5.61 KB, patch)
2016-09-20 15:46 PDT, Filip Pizlo 		saam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2016-09-20 15:46:32 PDT
Created attachment 289406 [details] the patch
Filip Pizlo
Comment 2 2016-09-20 15:59:47 PDT
Landed in http://trac.webkit.org/changeset/206183
Note You need to log in before you can comment on or make changes to this bug.