Bug 1259490 - Update the DtoA cache after compacting GC; r=jandem
authorTerrence Cole <terrence@mozilla.com>
Mon, 28 Mar 2016 10:07:36 -0700
changeset 290744 595ba913eb8375a11365d6053301c9b56adc8fbe
parent 290743 a257e0e77f2b17af8147e108eadcbc17964ccf82
child 290745 38c252c372a91d63aedc032bff46a7bd7dbde283
push id19656
push usergwagner@mozilla.com
push dateMon, 04 Apr 2016 13:43:23 +0000
treeherderb2g-inbound@e99061fde28a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1259490
milestone48.0a1
Bug 1259490 - Update the DtoA cache after compacting GC; r=jandem
js/src/jit-test/tests/gc/bug-1259490.js
js/src/jscompartment.cpp
js/src/jscompartment.h
js/src/jsgc.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1259490.js
@@ -0,0 +1,4 @@
+gczeal(8);
+for (var k = 0; k < 99; ++k) {
+    uneval(-(0 ** (Object | 0 * Object)))
+}
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -815,16 +815,17 @@ JSCompartment::fixupCrossCompartmentWrap
 }
 
 void
 JSCompartment::fixupAfterMovingGC()
 {
     fixupGlobal();
     fixupInitialShapeTable();
     objectGroups.fixupTablesAfterMovingGC();
+    dtoaCache.purge();
 
 #ifdef DEBUG
     // Assert that none of the JSScript pointers, which are used as key of the
     // scriptCountsMap HashMap are moved. We do not mark these keys because we
     // need weak references. We do not use a WeakMap because these entries would
     // be collected before the JSScript::finalize calls which is used to
     // summarized the content of the code coverage.
     if (scriptCountsMap) {
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -58,16 +58,20 @@ class DtoaCache {
         return this->s && base == this->base && d == this->d ? this->s : nullptr;
     }
 
     void cache(int base, double d, JSFlatString* s) {
         this->base = base;
         this->d = d;
         this->s = s;
     }
+
+#ifdef JSGC_HASH_TABLE_CHECKS
+    void checkCacheAfterMovingGC() { MOZ_ASSERT(!s || !IsForwarded(s)); }
+#endif
 };
 
 struct CrossCompartmentKey
 {
     enum Kind {
         ObjectWrapper,
         StringWrapper,
         DebuggerScript,
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -7369,16 +7369,17 @@ js::gc::CheckHashTablesAfterMovingGC(JSR
         for (ZoneCellIter i(zone, AllocKind::BASE_SHAPE); !i.done(); i.next()) {
             BaseShape* baseShape = i.get<BaseShape>();
             if (baseShape->hasTable())
                 baseShape->table().checkAfterMovingGC();
         }
     }
     for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
         c->objectGroups.checkTablesAfterMovingGC();
+        c->dtoaCache.checkCacheAfterMovingGC();
         c->checkInitialShapesTableAfterMovingGC();
         c->checkWrapperMapAfterMovingGC();
         c->checkBaseShapeTableAfterMovingGC();
         if (c->debugScopes)
             c->debugScopes->checkHashTablesAfterMovingGC(rt);
     }
 }
 #endif