Bug 1215337 - Cache slotSpan(), r=terrence
☠☠ backed out by 1266f78145c4 ☠ ☠
authorSteve Fink <sfink@mozilla.com>
Thu, 15 Oct 2015 15:45:51 -0700
changeset 268056 f41fd6c7d52289a64fdbb8710b08af24cdcf0c61
parent 268055 1998b272540e088f06ed3258258ae70cecf13106
child 268057 7b8dd562685d5244459d85f4e93308d0bfcfce01
push id66695
push usersfink@mozilla.com
push dateFri, 16 Oct 2015 18:43:11 +0000
treeherdermozilla-inbound@f41fd6c7d522 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs1215337
milestone44.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1215337 - Cache slotSpan(), r=terrence
js/src/jsobj.cpp
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -3708,21 +3708,25 @@ JSObject::traceChildren(JSTracer* trc)
         NativeObject* nobj = &as<NativeObject>();
 
         TraceEdge(trc, &nobj->shape_, "shape");
 
         {
             GetObjectSlotNameFunctor func(nobj);
             JS::AutoTracingDetails ctx(trc, func);
             JS::AutoTracingIndex index(trc);
-            for (uint32_t i = 0; i < nobj->slotSpan(); ++i) {
+            // Tracing can mutate the target but cannot change the slot count,
+            // but the compiler has no way of knowing this.
+            const uint32_t nslots = nobj->slotSpan();
+            for (uint32_t i = 0; i < nslots; ++i) {
                 TraceManuallyBarrieredEdge(trc, nobj->getSlotRef(i).unsafeUnbarrieredForTracing(),
                                            "object slot");
                 ++index;
             }
+            MOZ_ASSERT(nslots == nobj->slotSpan());
         }
 
         do {
             if (nobj->denseElementsAreCopyOnWrite()) {
                 HeapPtrNativeObject& owner = nobj->getElementsHeader()->ownerObject();
                 if (owner != nobj) {
                     TraceEdge(trc, &owner, "objectElementsOwner");
                     break;