Skip to content
  • Ömer Sinan Ağacan's avatar
    Fix compacting GC bug when chaining tagged and non-tagged fields together · 815ee4bc
    Ömer Sinan Ağacan authored
    Currently compacting GC has the invariant that in a chain all fields are tagged
    the same. However this does not really hold: root pointers are not tagged, so
    when we thread a root we initialize a chain without a tag. When the pointed
    objects is evaluated and we have more pointers to it from the heap, we then add
    *tagged* fields to the chain (because pointers to it from the heap are tagged),
    ending up chaining fields with different tags (pointers from roots are NOT
    tagged, pointers from heap are). This breaks the invariant and as a result
    compacting GC turns tagged pointers into non-tagged.
    
    This later causes problem in the generated code where we do reads assuming that
    the pointer is aligned, e.g.
    
        0x7(%rax) -- assumes that pointer is tagged 1
    
    which causes misaligned reads. This caused #17088.
    
    We fix this using the "pointer tagging for large families" patch (#14373,
    !1742):
    
    - With the pointer tagging patch the GC can know what the tagged pointer to a
      CONSTR should be (previously we'd need to know the family size -- large
      families are always tagged 1, small families are tagged depending on the
      constructor).
    
    - Since we now know what the tags should be we no longer need to store the
      pointer tag in the info table pointers when forming chains in the compacting
      GC.
    
    As a result we no longer need to tag pointers in chains with 1/2 depending on
    whether the field points to an info table pointer, or to another field: an info
    table pointer is always tagged 0, everything else in the chain is tagged 1. The
    lost tags in pointers can be retrieved by looking at the info table.
    
    Finally, instead of using tag 1 for fields and tag 0 for info table pointers, we
    use two different tags for fields:
    
    - 1 for fields that have untagged pointers
    - 2 for fields that have tagged pointers
    
    When unchaining we then look at the pointer to a field, and depending on its tag
    we either leave a tagged pointer or an untagged pointer in the field.
    
    This allows chaining untagged and tagged fields together in compacting GC.
    
    Fixes #17088
    815ee4bc