Bug 1461178 - Clear properties list when marking an object group as having unknown properties. r=jonco
authorJan de Mooij <jdemooij@mozilla.com>
Sun, 20 May 2018 21:04:00 +0200
changeset 419057 513231568d6ee537bafe7576681f36c5dc7b6cf7
parent 419056 43d89657aedf5c236d6d7f220f4d487379e6842b
child 419058 000309d44abb81084276c9fa977c57aee7126053
child 419071 baaa6b51de434025db3f38e6fc27b706169b607f
push id34024
push useraiakab@mozilla.com
push dateSun, 20 May 2018 21:58:11 +0000
treeherdermozilla-central@000309d44abb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjonco
bugs1461178
milestone62.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1461178 - Clear properties list when marking an object group as having unknown properties. r=jonco
js/src/vm/TypeInference.cpp
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -2976,16 +2976,18 @@ ObjectGroup::markUnknown(const AutoSweep
     for (unsigned i = 0; i < count; i++) {
         Property* prop = getProperty(sweep, i);
         if (prop) {
             prop->types.addType(sweep, cx, TypeSet::UnknownType());
             prop->types.setNonDataProperty(sweep, cx);
         }
     }
 
+    clearProperties(sweep);
+
     if (ObjectGroup* unboxedGroup = maybeOriginalUnboxedGroup())
         MarkObjectGroupUnknownProperties(cx, unboxedGroup);
     if (maybeUnboxedLayout(sweep) && maybeUnboxedLayout(sweep)->nativeGroup())
         MarkObjectGroupUnknownProperties(cx, maybeUnboxedLayout(sweep)->nativeGroup());
     if (ObjectGroup* unboxedGroup = maybeOriginalUnboxedGroup())
         MarkObjectGroupUnknownProperties(cx, unboxedGroup);
 }
 
@@ -4354,16 +4356,21 @@ ConstraintTypeSet::sweep(const AutoSweep
                   MemCheckKind::MakeUndefined);
         constraint = next;
     }
 }
 
 inline void
 ObjectGroup::clearProperties(const AutoSweepObjectGroup& sweep)
 {
+    // We're about to remove edges from the group to property ids. Incremental
+    // GC should know about these edges.
+    if (zone()->needsIncrementalBarrier())
+        traceChildren(zone()->barrierTracer());
+
     setBasePropertyCount(sweep, 0);
     propertySet = nullptr;
 }
 
 static void
 EnsureHasAutoClearTypeInferenceStateOnOOM(AutoClearTypeInferenceStateOnOOM*& oom, Zone* zone,
                                           Maybe<AutoClearTypeInferenceStateOnOOM>& fallback)
 {