Changeset 251875 in webkit


Ignore:
Timestamp:
Oct 31, 2019, 1:50:56 PM (5 years ago)
Author:
sbarati@apple.com
Message:

Don't use memmove/memcpy/memset for memory that can be scanned concurrently
​https://bugs.webkit.org/show_bug.cgi?id=203228
<rdar://problem/56401852>

Reviewed by Robin Morisset.

JSTests:

  • stress/torn-js-value-concurrent-collector.js: Added.

(foo):

Source/JavaScriptCore:

We had code inside various places of the runtime which would call into system
memcpy/memmove/memset when updating a live butterfly. This means that the
concurrent collector could be scanning such butterflies while a memcpy/memmove/memset
was running. Those functions don't guarantee anything about the minimum
alignment of the stores they do. And implementations for them frequently have
byte copy loops for low byte copy counts. This lead to us seeing torn JSValues
inside the concurrent collector during Array.prototype.splice. This patch
introduces new functions for doing memcpy/memmove/memset for data structures
which may be concurrently scanned. The loops are written using inline assembly
for gcc compatible compilers on 64 bit platforms. The inline assembly
ensures we never write to memory using instructions that store fewer
than 8 bytes. On other platforms, we just use a volatile pointer to
ensure the compiler doesn't turn the loop into a function call or a
series of stores which may be smaller than 8 bytes.

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • heap/GCMemoryOperations.h: Added.

(JSC::gcSafeMemcpy):
(JSC::gcSafeMemmove):
(JSC::gcSafeZeroMemory):

  • heap/Heap.h:
  • runtime/ArrayConventions.cpp:

(JSC::clearArrayMemset):

  • runtime/ArrayPrototype.cpp:

(JSC::copyElements):

  • runtime/ButterflyInlines.h:

(JSC::Butterfly::tryCreate):
(JSC::Butterfly::createOrGrowPropertyStorage):
(JSC::Butterfly::growArrayRight):
(JSC::Butterfly::reallocArrayRightIfPossible):
(JSC::Butterfly::resizeArray):
(JSC::Butterfly::unshift):
(JSC::Butterfly::shift):

  • runtime/JSArray.cpp:

(JSC::JSArray::unshiftCountSlowCase):
(JSC::JSArray::appendMemcpy):
(JSC::JSArray::fastSlice):
(JSC::JSArray::shiftCountWithArrayStorage):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithArrayStorage):

  • runtime/JSObject.cpp:

(JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
(JSC::JSObject::convertFromCopyOnWrite):
(JSC::JSObject::shiftButterflyAfterFlattening):

  • runtime/JSObject.h:
  • runtime/RegExpMatchesArray.h:

(JSC::createRegExpMatchesArray):

  • runtime/Structure.cpp:

(JSC::Structure::flattenDictionaryStructure):

Location:
trunk
Files:
2 added
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r251826 r251875  
     12019-10-31  Saam Barati  <sbarati@apple.com>
     2
     3        Don't use memmove/memcpy/memset for memory that can be scanned concurrently
     4        https://bugs.webkit.org/show_bug.cgi?id=203228
     5        <rdar://problem/56401852>
     6
     7        Reviewed by Robin Morisset.
     8
     9        * stress/torn-js-value-concurrent-collector.js: Added.
     10        (foo):
     11
    1122019-10-30  Yusuke Suzuki  <ysuzuki@apple.com>
    213

  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r251691 r251875  
    578578    heap/GCIncomingRefCountedSet.h
    579579    heap/GCLogging.h
     580    heap/GCMemoryOperations.h
    580581    heap/GCRequest.h
    581582    heap/GCSegmentedArray.h

  • trunk/Source/JavaScriptCore/ChangeLog

    r251872 r251875  
     12019-10-31  Saam Barati  <sbarati@apple.com>
     2
     3        Don't use memmove/memcpy/memset for memory that can be scanned concurrently
     4        https://bugs.webkit.org/show_bug.cgi?id=203228
     5        <rdar://problem/56401852>
     6
     7        Reviewed by Robin Morisset.
     8
     9        We had code inside various places of the runtime which would call into system
     10        memcpy/memmove/memset when updating a live butterfly. This means that the
     11        concurrent collector could be scanning such butterflies while a memcpy/memmove/memset
     12        was running. Those functions don't guarantee anything about the minimum
     13        alignment of the stores they do. And implementations for them frequently have
     14        byte copy loops for low byte copy counts. This lead to us seeing torn JSValues
     15        inside the concurrent collector during Array.prototype.splice. This patch
     16        introduces new functions for doing memcpy/memmove/memset for data structures
     17        which may be concurrently scanned. The loops are written using inline assembly
     18        for gcc compatible compilers on 64 bit platforms. The inline assembly
     19        ensures we never write to memory using instructions that store fewer
     20        than 8 bytes. On other platforms, we just use a volatile pointer to
     21        ensure the compiler doesn't turn the loop into a function call or a
     22        series of stores which may be smaller than 8 bytes.
     23
     24        * CMakeLists.txt:
     25        * JavaScriptCore.xcodeproj/project.pbxproj:
     26        * heap/GCMemoryOperations.h: Added.
     27        (JSC::gcSafeMemcpy):
     28        (JSC::gcSafeMemmove):
     29        (JSC::gcSafeZeroMemory):
     30        * heap/Heap.h:
     31        * runtime/ArrayConventions.cpp:
     32        (JSC::clearArrayMemset):
     33        * runtime/ArrayPrototype.cpp:
     34        (JSC::copyElements):
     35        * runtime/ButterflyInlines.h:
     36        (JSC::Butterfly::tryCreate):
     37        (JSC::Butterfly::createOrGrowPropertyStorage):
     38        (JSC::Butterfly::growArrayRight):
     39        (JSC::Butterfly::reallocArrayRightIfPossible):
     40        (JSC::Butterfly::resizeArray):
     41        (JSC::Butterfly::unshift):
     42        (JSC::Butterfly::shift):
     43        * runtime/JSArray.cpp:
     44        (JSC::JSArray::unshiftCountSlowCase):
     45        (JSC::JSArray::appendMemcpy):
     46        (JSC::JSArray::fastSlice):
     47        (JSC::JSArray::shiftCountWithArrayStorage):
     48        (JSC::JSArray::shiftCountWithAnyIndexingType):
     49        (JSC::JSArray::unshiftCountWithArrayStorage):
     50        * runtime/JSObject.cpp:
     51        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
     52        (JSC::JSObject::convertFromCopyOnWrite):
     53        (JSC::JSObject::shiftButterflyAfterFlattening):
     54        * runtime/JSObject.h:
     55        * runtime/RegExpMatchesArray.h:
     56        (JSC::createRegExpMatchesArray):
     57        * runtime/Structure.cpp:
     58        (JSC::Structure::flattenDictionaryStructure):
     59
    1602019-10-31  Devin Rousso  <drousso@apple.com>
    261

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r251691 r251875  
    891891                521131F71F82BF14007CCEEE /* PolyProtoAccessChain.h in Headers */ = {isa = PBXBuildFile; fileRef = 521131F61F82BF11007CCEEE /* PolyProtoAccessChain.h */; settings = {ATTRIBUTES = (Private, ); }; };
    892892                521322461ECBCE8200F65615 /* WebAssemblyFunctionBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 521322441ECBCE8200F65615 /* WebAssemblyFunctionBase.h */; };
     893                522927D5235FD0B9005CB169 /* GCMemoryOperations.h in Headers */ = {isa = PBXBuildFile; fileRef = 5272987B235FC8BA005C982C /* GCMemoryOperations.h */; settings = {ATTRIBUTES = (Private, ); }; };
    893894                523FD88E225566C9003B3DCC /* WebAssemblyFunctionHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 523FD88C225566C3003B3DCC /* WebAssemblyFunctionHeapCellType.h */; };
    894895                524E9D7322092B5200A6BEEE /* AirAllocateRegistersAndStackAndGenerateCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 524E9D7222092B4600A6BEEE /* AirAllocateRegistersAndStackAndGenerateCode.h */; };
    … …  
    35363537                526AC4B41E977C5D003500E1 /* WasmCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmCodeBlock.cpp; sourceTree = "<group>"; };
    35373538                526AC4B51E977C5D003500E1 /* WasmCodeBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmCodeBlock.h; sourceTree = "<group>"; };
     3539                5272987B235FC8BA005C982C /* GCMemoryOperations.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GCMemoryOperations.h; sourceTree = "<group>"; };
    35383540                527773DD1AAF83AC00BDE7E8 /* RuntimeType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RuntimeType.cpp; sourceTree = "<group>"; };
    35393541                527CE35222555FDD00C6F382 /* JSToWasmICCallee.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = JSToWasmICCallee.cpp; path = js/JSToWasmICCallee.cpp; sourceTree = "<group>"; };
    … …  
    61356137                                2ADFA26218EF3540004F9FCC /* GCLogging.cpp */,
    61366138                                2AABCDE618EF294200002096 /* GCLogging.h */,
     6139                                5272987B235FC8BA005C982C /* GCMemoryOperations.h */,
    61376140                                0F97152E1EB28BE900A1645D /* GCRequest.cpp */,
    61386141                                0F97152F1EB28BE900A1645D /* GCRequest.h */,
    … …  
    88998902                                3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers */,
    89008903                                0F5BF1711F23A5A10029D91D /* B3EnsureLoopPreHeaders.h in Headers */,
     8904                                522927D5235FD0B9005CB169 /* GCMemoryOperations.h in Headers */,
    89018905                                5318045C22EAAC4B004A7342 /* B3ExtractValue.h in Headers */,
    89028906                                0F6971EA1D92F42400BA02A5 /* B3FenceValue.h in Headers */,

  • trunk/Source/JavaScriptCore/heap/Heap.h

    r250005 r251875  
    2929#include "GCConductor.h"
    3030#include "GCIncomingRefCountedSet.h"
     31#include "GCMemoryOperations.h"
    3132#include "GCRequest.h"
    3233#include "HandleSet.h"

  • trunk/Source/JavaScriptCore/runtime/ArrayConventions.cpp

    r236450 r251875  
    3434void clearArrayMemset(WriteBarrier<Unknown>* base, unsigned count)
    3535{
    36 #if CPU(X86_64) && COMPILER(GCC_COMPATIBLE)
    37     uint64_t zero = 0;
    38     asm volatile (
    39         "rep stosq\n\t"
    40         : "+D"(base), "+c"(count)
    41         : "a"(zero)
    42         : "memory"
    43         );
    44 #else // not CPU(X86_64)
    45     memset(base, 0, count * sizeof(WriteBarrier<Unknown>));
    46 #endif // generic CPU
     36    gcSafeZeroMemory(base, count * sizeof(WriteBarrier<Unknown>));
    4737}
    4838

  • trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

    r251456 r251875  
    14881488
    14891489template<typename T>
    1490 ALWAYS_INLINE void copyElements(T* buffer, unsigned offset, void* source, unsigned sourceSize, IndexingType sourceType)
     1490ALWAYS_INLINE void copyElements(T* buffer, unsigned offset, T* source, unsigned sourceSize, IndexingType sourceType)
    14911491{
    14921492    if (sourceType != ArrayWithUndecided) {
    1493         memcpy(buffer + offset, source, sizeof(JSValue) * sourceSize);
     1493        gcSafeMemcpy(buffer + offset, source, sizeof(JSValue) * sourceSize);
    14941494        return;
    14951495    }

  • trunk/Source/JavaScriptCore/runtime/ButterflyInlines.h

    r251584 r251875  
    105105    if (hasIndexingHeader)
    106106        *result->indexingHeader() = indexingHeader;
    107     memset(result->propertyStorage() - propertyCapacity, 0, propertyCapacity * sizeof(EncodedJSValue));
     107    gcSafeZeroMemory(result->propertyStorage() - propertyCapacity, propertyCapacity * sizeof(EncodedJSValue));
    108108    return result;
    109109}
    … …  
    140140    bool hasIndexingHeader = structure->hasIndexingHeader(intendedOwner);
    141141    Butterfly* result = createUninitialized(vm, intendedOwner, preCapacity, newPropertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);
    142     memcpy(
     142    gcSafeMemcpy(
    143143        result->propertyStorage() - oldPropertyCapacity,
    144144        oldButterfly->propertyStorage() - oldPropertyCapacity,
    145145        totalSize(0, oldPropertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes));
    146     memset(
     146    gcSafeZeroMemory(
    147147        result->propertyStorage() - newPropertyCapacity,
    148         0,
    149148        (newPropertyCapacity - oldPropertyCapacity) * sizeof(EncodedJSValue));
    150149    return result;
    … …  
    180179        return nullptr;
    181180    // FIXME: This probably shouldn't be a memcpy.
    182     memcpy(newBase, theBase, oldSize);
     181    gcSafeMemcpy(static_cast<JSValue*>(newBase), static_cast<JSValue*>(theBase), oldSize);
    183182    return fromBase(newBase, 0, propertyCapacity);
    184183}
    … …  
    222221    if (!newBase)
    223222        return nullptr;
    224     memcpy(newBase, theBase, oldSize);
     223    gcSafeMemcpy(static_cast<JSValue*>(newBase), static_cast<JSValue*>(theBase), oldSize);
    225224    return fromBase(newBase, 0, propertyCapacity);
    226225}
    … …  
    239238        totalSize(0, propertyCapacity, oldHasIndexingHeader, oldIndexingPayloadSizeInBytes),
    240239        totalSize(0, propertyCapacity, newHasIndexingHeader, newIndexingPayloadSizeInBytes));
    241     memcpy(to, from, size);
     240    gcSafeMemcpy(static_cast<JSValue*>(to), static_cast<JSValue*>(from), size);
    242241    return result;
    243242}
    … …  
    266265    // we rely on the compiler to recognize the ordering of the pointer arguments (since
    267266    // propertyCapacity is variable and could cause wrap-around as far as the compiler knows).
    268     memmove(
     267    gcSafeMemmove(
    269268        propertyStorage() - numberOfSlots - propertyCapacity,
    270269        propertyStorage() - propertyCapacity,
    … …  
    278277    unsigned propertyCapacity = structure->outOfLineCapacity();
    279278    // FIXME: See comment in unshift(), above.
    280     memmove(
     279    gcSafeMemmove(
    281280        propertyStorage() - propertyCapacity + numberOfSlots,
    282281        propertyStorage() - propertyCapacity,

  • trunk/Source/JavaScriptCore/runtime/JSArray.cpp

    r251456 r251875  
    422422    if (addToFront) {
    423423        ASSERT(count + usedVectorLength <= newVectorLength);
    424         memmove(newButterfly->arrayStorage()->m_vector + count, storage->m_vector, sizeof(JSValue) * usedVectorLength);
    425         memmove(newButterfly->propertyStorage() - propertySize, butterfly->propertyStorage() - propertySize, sizeof(JSValue) * propertySize + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
     424        gcSafeMemmove(newButterfly->arrayStorage()->m_vector + count, storage->m_vector, sizeof(JSValue) * usedVectorLength);
     425        gcSafeMemmove(newButterfly->propertyStorage() - propertySize, butterfly->propertyStorage() - propertySize, sizeof(JSValue) * propertySize + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
    426426
    427427        // We don't need to zero the pre-capacity for the concurrent GC because it is not available to use as property storage.
    428         memset(newButterfly->base(0, propertyCapacity), 0, (propertyCapacity - propertySize) * sizeof(JSValue));
     428        gcSafeZeroMemory(static_cast<JSValue*>(newButterfly->base(0, propertyCapacity)), (propertyCapacity - propertySize) * sizeof(JSValue));
    429429
    430430        if (allocatedNewStorage) {
    … …  
    435435        }
    436436    } else if ((newAllocBase != butterfly->base(structure)) || (preCapacity != storage->m_indexBias)) {
    437         memmove(newButterfly->propertyStorage() - propertyCapacity, butterfly->propertyStorage() - propertyCapacity, sizeof(JSValue) * propertyCapacity + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
    438         memmove(newButterfly->arrayStorage()->m_vector, storage->m_vector, sizeof(JSValue) * usedVectorLength);
     437        gcSafeMemmove(newButterfly->propertyStorage() - propertyCapacity, butterfly->propertyStorage() - propertyCapacity, sizeof(JSValue) * propertyCapacity + sizeof(IndexingHeader) + ArrayStorage::sizeFor(0));
     438        gcSafeMemmove(newButterfly->arrayStorage()->m_vector, storage->m_vector, sizeof(JSValue) * usedVectorLength);
    439439       
    440440        for (unsigned i = requiredVectorLength; i < newVectorLength; i++)
    … …  
    570570        }
    571571    } else if (type == ArrayWithDouble)
    572         memcpy(butterfly()->contiguousDouble().data() + startIndex, otherArray->butterfly()->contiguousDouble().data(), sizeof(JSValue) * otherLength);
     572        gcSafeMemcpy(butterfly()->contiguousDouble().data() + startIndex, otherArray->butterfly()->contiguousDouble().data(), sizeof(JSValue) * otherLength);
    573573    else {
    574         memcpy(butterfly()->contiguous().data() + startIndex, otherArray->butterfly()->contiguous().data(), sizeof(JSValue) * otherLength);
     574        gcSafeMemcpy(butterfly()->contiguous().data() + startIndex, otherArray->butterfly()->contiguous().data(), sizeof(JSValue) * otherLength);
    575575        vm.heap.writeBarrier(this);
    576576    }
    … …  
    790790        auto& resultButterfly = *resultArray->butterfly();
    791791        if (arrayType == ArrayWithDouble)
    792             memcpy(resultButterfly.contiguousDouble().data(), butterfly()->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
     792            gcSafeMemcpy(resultButterfly.contiguousDouble().data(), butterfly()->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
    793793        else
    794             memcpy(resultButterfly.contiguous().data(), butterfly()->contiguous().data() + startIndex, sizeof(JSValue) * count);
     794            gcSafeMemcpy(resultButterfly.contiguous().data(), butterfly()->contiguous().data() + startIndex, sizeof(JSValue) * count);
    795795
    796796        ASSERT(resultButterfly.publicLength() == count);
    … …  
    850850        if (numElementsBeforeShiftRegion) {
    851851            RELEASE_ASSERT(count + startIndex <= vectorLength);
    852             memmove(storage->m_vector + count,
     852            gcSafeMemmove(storage->m_vector + count,
    853853                storage->m_vector,
    854854                sizeof(JSValue) * startIndex);
    … …  
    868868        // The number of elements before the shift region is greater than or equal to the number
    869869        // of elements after the shift region, so we move the elements after the shift region to the left.
    870         memmove(storage->m_vector + startIndex,
     870        gcSafeMemmove(storage->m_vector + startIndex,
    871871            storage->m_vector + firstIndexAfterShiftRegion,
    872872            sizeof(JSValue) * numElementsAfterShiftRegion);
    … …  
    928928            }
    929929        } else {
    930             memmove(butterfly->contiguous().data() + startIndex,
     930            gcSafeMemmove(butterfly->contiguous().data() + startIndex,
    931931                butterfly->contiguous().data() + startIndex + count,
    932932                sizeof(JSValue) * (end - startIndex));
    … …  
    970970            }
    971971        } else {
    972             memmove(butterfly->contiguousDouble().data() + startIndex,
     972            gcSafeMemmove(butterfly->contiguousDouble().data() + startIndex,
    973973                butterfly->contiguousDouble().data() + startIndex + count,
    974974                sizeof(JSValue) * (end - startIndex));
    … …  
    10341034    if (startIndex) {
    10351035        if (moveFront)
    1036             memmove(vector, vector + count, startIndex * sizeof(JSValue));
     1036            gcSafeMemmove(vector, vector + count, startIndex * sizeof(JSValue));
    10371037        else if (length - startIndex)
    1038             memmove(vector + startIndex + count, vector + startIndex, (length - startIndex) * sizeof(JSValue));
     1038            gcSafeMemmove(vector + startIndex + count, vector + startIndex, (length - startIndex) * sizeof(JSValue));
    10391039    }
    10401040

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r251425 r251875  
    12111211    Butterfly* newButterfly = Butterfly::createUninitialized(vm, this, 0, propertyCapacity, true, ArrayStorage::sizeFor(neededLength));
    12121212   
    1213     memcpy(
    1214         newButterfly->base(0, propertyCapacity),
    1215         m_butterfly->base(0, propertyCapacity),
     1213    gcSafeMemcpy(
     1214        static_cast<JSValue*>(newButterfly->base(0, propertyCapacity)),
     1215        static_cast<JSValue*>(m_butterfly->base(0, propertyCapacity)),
    12161216        propertyCapacity * sizeof(EncodedJSValue));
    12171217
    … …  
    15041504    Butterfly* newButterfly = Butterfly::createUninitialized(vm, this, 0, propertyCapacity, hasIndexingHeader, newVectorLength * sizeof(JSValue));
    15051505
    1506     memcpy(newButterfly->propertyStorage(), oldButterfly->propertyStorage(), oldButterfly->vectorLength() * sizeof(JSValue) + sizeof(IndexingHeader));
     1506    gcSafeMemcpy(newButterfly->propertyStorage(), oldButterfly->propertyStorage(), oldButterfly->vectorLength() * sizeof(JSValue) + sizeof(IndexingHeader));
    15071507
    15081508    WTF::storeStoreFence();
    … …  
    37833783    void* newBase = newButterfly->base(0, outOfLineCapacityAfter);
    37843784
    3785     memcpy(newBase, currentBase, Butterfly::totalSize(0, outOfLineCapacityAfter, hasIndexingHeader, indexingPayloadSizeInBytes));
     3785    gcSafeMemcpy(static_cast<JSValue*>(newBase), static_cast<JSValue*>(currentBase), Butterfly::totalSize(0, outOfLineCapacityAfter, hasIndexingHeader, indexingPayloadSizeInBytes));
    37863786   
    37873787    setButterfly(vm, newButterfly);

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r251584 r251875  
    11811181        : JSObject(vm, structure, butterfly)
    11821182    {
    1183         memset(inlineStorageUnsafe(), 0, structure->inlineCapacity() * sizeof(EncodedJSValue));
     1183        gcSafeZeroMemory(inlineStorageUnsafe(), structure->inlineCapacity() * sizeof(EncodedJSValue));
    11841184    }
    11851185};

  • trunk/Source/JavaScriptCore/runtime/RegExpMatchesArray.h

    r251425 r251875  
    9999        auto capacity = matchStructure->outOfLineCapacity();
    100100        auto size = matchStructure->outOfLineSize();
    101         memset(array->butterfly()->base(0, capacity), 0, (capacity - size) * sizeof(JSValue));
     101        gcSafeZeroMemory(static_cast<JSValue*>(array->butterfly()->base(0, capacity)), (capacity - size) * sizeof(JSValue));
    102102    };
    103103

  • trunk/Source/JavaScriptCore/runtime/Structure.cpp

    r250540 r251875  
    778778        // We need to zero our unused property space; otherwise the GC might see a
    779779        // stale pointer when we add properties in the future.
    780         memset(
     780        gcSafeZeroMemory(
    781781            object->inlineStorageUnsafe() + inlineSize(),
    782             0,
    783782            (inlineCapacity() - inlineSize()) * sizeof(EncodedJSValue));
    784783
    … …  
    787786        void* base = butterfly->base(preCapacity, beforeOutOfLineCapacity);
    788787        void* startOfPropertyStorageSlots = reinterpret_cast<EncodedJSValue*>(base) + preCapacity;
    789         memset(startOfPropertyStorageSlots, 0, (beforeOutOfLineCapacity - outOfLineSize()) * sizeof(EncodedJSValue));
     788        gcSafeZeroMemory(static_cast<JSValue*>(startOfPropertyStorageSlots), (beforeOutOfLineCapacity - outOfLineSize()) * sizeof(EncodedJSValue));
    790789        checkOffsetConsistency();
    791790    }
Note: See TracChangeset for help on using the changeset viewer.