Fixes. Now compiles and links, still crashes at atoms zone similar previous nursery strings.

Fixes. Now compiles and links, still crashes at atoms zone similar previous nursery strings.
This commit is contained in:
win7-7 2026-01-15 06:50:04 +02:00 committed by wuggy
commit f50af06b74
6 changed files with 24 additions and 17 deletions

View file

@ -215,18 +215,6 @@ js::Allocate(ExclusiveContext* cx)
AllocKind kind = MapTypeToFinalizeKind<T>::kind;
size_t thingSize = sizeof(T);
// === ADD DETAILED DIAGNOSTIC OUTPUT HERE ===
size_t arenaSize = Arena::thingSize(kind);
fprintf(stderr, "\n=== GC Allocation Debug ===\n");
fprintf(stderr, "Type name: %s\n", typeid(T).name());
fprintf(stderr, "sizeof(T): %zu bytes\n", thingSize);
fprintf(stderr, "Arena::thingSize(kind): %zu bytes\n", arenaSize);
fprintf(stderr, "CellAlignBytes: %zu bytes\n", CellAlignBytes);
fprintf(stderr, "Match: %s\n", (thingSize == arenaSize) ? "YES" : "NO - MISMATCH!");
fprintf(stderr, "Size difference: %zd bytes\n", (size_t)thingSize - (size_t)arenaSize);
fprintf(stderr, "========================\n\n");
MOZ_ASSERT(thingSize == Arena::thingSize(kind));
if (cx->isJSContext()) {

View file

@ -147,6 +147,22 @@ struct MOZ_RAII AutoAssertNoNurseryAlloc
#endif
};
// Note that this class does not suppress buffer allocation/reallocation in the
// nursery, only Cells themselves.
class MOZ_RAII AutoSuppressNurseryCellAlloc
{
JSContext* cx_;
public:
explicit AutoSuppressNurseryCellAlloc(JSContext* cx) : cx_(cx) {
cx_->nurserySuppressions_++;
}
~AutoSuppressNurseryCellAlloc() {
cx_->nurserySuppressions_--;
}
};
/*
* There are a couple of classes here that serve mostly as "tokens" indicating
* that a condition holds. Some functions force the caller to possess such a

View file

@ -1774,7 +1774,9 @@ GCMarker::processMarkStackTop(SliceBudget& budget)
} else if (v.isBigInt()) {
traverseEdge(obj, v.toBigInt());
} else if (v.isPrivateGCThing()) {
traverseEdge(obj, v.toGCCellPtr());
// v.toGCCellPtr cannot be inlined, so construct one manually.
Cell* cell = v.toGCThing();
traverseEdge(obj, JS::GCCellPtr(cell, cell->getTraceKind()));
}
}
return;
@ -2713,6 +2715,7 @@ inline void
js::TenuringTracer::traceSlots(JS::Value* vp, uint32_t nslots)
{
traceSlots(vp, vp + nslots);
}
void
js::TenuringTracer::traceString(JSString* str)

View file

@ -840,9 +840,9 @@ js::Nursery::doCollection(JS::gcreason::Reason reason,
}
endProfile(ProfileKey::MarkDebugger);
maybeStartProfile(ProfileKey::SweepCaches);
startProfile(ProfileKey::SweepCaches);
rt->gc.purgeRuntimeForMinorGC();
maybeEndProfile(ProfileKey::SweepCaches);
endProfile(ProfileKey::SweepCaches);
// Most of the work is done here. This loop iterates over objects that have
// been moved to the major heap. If these objects have any outgoing pointers

View file

@ -540,7 +540,7 @@ CheckHeapTracer::onChild(const JS::GCCellPtr& thing)
else
zone = cell->asTenured().zone();
if (zone->group() && zone->group()->usedByHelperThread)
if (zone->group() && zone->group()->usedByHelperThread())
return;
}

View file

@ -4782,7 +4782,7 @@ NextIncomingCrossCompartmentPointer(JSObject* prev, bool unlink)
}
void
js::DelayCrossCompartmentGrayMarking(JSObject* src)
js::gc::DelayCrossCompartmentGrayMarking(JSObject* src)
{
MOZ_ASSERT(IsGrayListObject(src));