Bug 1181908 part 1. Fix support for JSOP_OBJECT in scripts parsed on background threads by clearing the unboxedLayouts list on the background thread parsing compartment when merging the parse result to the target compartment. r=jandem
authorBrian Hackett <bhackett1024@gmail.com>
Fri, 28 Aug 2015 17:03:48 -0400
changeset 259898 8cd6dd07c27a6dbcfa20f15e7e77a854eb39f1e6
parent 259897 6de8ebf59df0150f939552417452a9b5d0ffbb92
child 259899 2d89bf9f70ee66f82a482c28070ae2d8b8bacdcb
push id29296
push userryanvm@gmail.com
push dateSun, 30 Aug 2015 19:45:10 +0000
treeherdermozilla-central@2ad5077d86ba [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1181908
milestone43.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1181908 part 1. Fix support for JSOP_OBJECT in scripts parsed on background threads by clearing the unboxedLayouts list on the background thread parsing compartment when merging the parse result to the target compartment. r=jandem
js/src/jsgc.cpp
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -6650,16 +6650,22 @@ gc::MergeCompartments(JSCompartment* sou
         MOZ_ASSERT(base->compartment() == source);
         base->compartment_ = target;
     }
 
     for (ZoneCellIter iter(source->zone(), AllocKind::OBJECT_GROUP); !iter.done(); iter.next()) {
         ObjectGroup* group = iter.get<ObjectGroup>();
         group->setGeneration(target->zone()->types.generation);
         group->compartment_ = target;
+
+        // Remove any unboxed layouts from the list in the off thread
+        // compartment. These do not need to be reinserted in the target
+        // compartment's list, as the list is not required to be complete.
+        if (UnboxedLayout* layout = group->maybeUnboxedLayoutDontCheckGeneration())
+            layout->detachFromCompartment();
     }
 
     // Fixup zone pointers in source's zone to refer to target's zone.
 
     for (auto thingKind : AllAllocKinds()) {
         for (ArenaIter aiter(source->zone(), thingKind); !aiter.done(); aiter.next()) {
             ArenaHeader* aheader = aiter.get();
             aheader->zone = target->zone();