This is an automated email from the git hooks/post-receive script.
pierov pushed a commit to annotated tag FIREFOX_102_4_0esr_BUILD1 in repository tor-browser.
commit e2a1f537e93827145bedafe72a1bce282bef9d14 Author: Jon Coppeard jcoppeard@mozilla.com AuthorDate: Wed Sep 21 08:37:14 2022 +0000
Bug 1791363 - Process newly added marking work after performing delayed marking r=sfink a=RyanVM
Delayed marking may push more (normal, non-delayed) marking work. We need to do this before switch mark color from black to gray since we cannot add gray marking work while there is black marking work on the stack.
Differential Revision: https://phabricator.services.mozilla.com/D157733 --- js/src/gc/GCMarker.h | 2 +- js/src/gc/Marking.cpp | 28 +++++++++++++++++++--------- js/src/jit-test/tests/gc/bug-1791363.js | 11 +++++++++++ 3 files changed, 31 insertions(+), 10 deletions(-)
diff --git a/js/src/gc/GCMarker.h b/js/src/gc/GCMarker.h index 5465e8fc3df9..7c93b6330c13 100644 --- a/js/src/gc/GCMarker.h +++ b/js/src/gc/GCMarker.h @@ -439,7 +439,7 @@ class GCMarker final : public JSTracer {
inline void processMarkStackTop(SliceBudget& budget);
- void markDelayedChildren(gc::Arena* arena, gc::MarkColor color); + void markDelayedChildren(gc::Arena* arena); [[nodiscard]] bool markAllDelayedChildren(SliceBudget& budget, ShouldReportMarkTime reportTime); bool processDelayedMarkingList(gc::MarkColor color, SliceBudget& budget); diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp index f488746b18c5..ab2f79b4e7ed 100644 --- a/js/src/gc/Marking.cpp +++ b/js/src/gc/Marking.cpp @@ -2246,10 +2246,14 @@ inline bool MarkStack::push(const SlotsOrElementsRange& array) { }
inline const MarkStack::TaggedPtr& MarkStack::peekPtr() const { + MOZ_ASSERT(!isEmpty()); return stack()[topIndex_ - 1]; }
-inline MarkStack::Tag MarkStack::peekTag() const { return peekPtr().tag(); } +inline MarkStack::Tag MarkStack::peekTag() const { + MOZ_ASSERT(!isEmpty()); + return peekPtr().tag(); +}
inline MarkStack::TaggedPtr MarkStack::popPtr() { MOZ_ASSERT(!isEmpty()); @@ -2474,7 +2478,6 @@ void GCMarker::setMarkColor(gc::MarkColor newColor) { return; }
- MOZ_ASSERT(runtime()->gc.state() == State::Sweep); MOZ_ASSERT(!hasBlackEntries());
color = newColor; @@ -2625,11 +2628,10 @@ void GCMarker::delayMarkingChildren(Cell* cell) { } }
-void GCMarker::markDelayedChildren(Arena* arena, MarkColor color) { +void GCMarker::markDelayedChildren(Arena* arena) { JS::TraceKind kind = MapAllocToTraceKind(arena->getAllocKind()); MOZ_ASSERT_IF(color == MarkColor::Gray, TraceKindCanBeMarkedGray(kind));
- AutoSetMarkColor setColor(*this, color); for (ArenaCellIterUnderGC cell(arena); !cell.done(); cell.next()) { if (cell->isMarked(color)) { JS::TraceChildren(this, JS::GCCellPtr(cell, kind)); @@ -2651,16 +2653,24 @@ bool GCMarker::processDelayedMarkingList(MarkColor color, SliceBudget& budget) { // be set again if the arena is re-added. Iterate the list until no new arenas // were added.
+ AutoSetMarkColor setColor(*this, color); + do { delayedMarkingWorkAdded = false; for (Arena* arena = delayedMarkingList; arena; arena = arena->getNextDelayedMarking()) { - if (!arena->hasDelayedMarking(color)) { - continue; + if (arena->hasDelayedMarking(color)) { + arena->setHasDelayedMarking(color, false); + markDelayedChildren(arena); + budget.step(150); + if (budget.isOverBudget()) { + return false; + } } - arena->setHasDelayedMarking(color, false); - markDelayedChildren(arena, color); - budget.step(150); + } + while ((color == MarkColor::Black && hasBlackEntries()) || + (color == MarkColor::Gray && hasGrayEntries())) { + processMarkStackTop(budget); if (budget.isOverBudget()) { return false; } diff --git a/js/src/jit-test/tests/gc/bug-1791363.js b/js/src/jit-test/tests/gc/bug-1791363.js new file mode 100644 index 000000000000..46ac5bdd7873 --- /dev/null +++ b/js/src/jit-test/tests/gc/bug-1791363.js @@ -0,0 +1,11 @@ +gczeal(0); +if (!this.enqueueMark) { + quit(); +} + +enqueueMark('set-color-gray'); +enqueueMark(newGlobal()); +enqueueMark('set-color-black'); +enqueueMark(newGlobal()); +gcparam("markStackLimit", 1); +gc();