Trace IonCode objects before invalidating them (bug 756781, r=billm).
authorDavid Anderson <danderson@mozilla.com>
Mon, 21 May 2012 16:43:30 -0700
changeset 109824 454dcc349cbb8e5dcc7143e16e7eb340beb2e3ce
parent 109823 80e4ab0d24bc64ceaa7693ab5def36faffde7a40
child 109825 d80602d38aa85a3f03c97807f85867db9db4b445
push id2248
push userakeybl@mozilla.com
push dateMon, 08 Oct 2012 19:23:44 +0000
treeherdermozilla-aurora@118a3b748323 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbillm
bugs756781
milestone15.0a1
Trace IonCode objects before invalidating them (bug 756781, r=billm).
js/src/ion/Ion.cpp
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -1111,16 +1111,24 @@ InvalidateActivation(FreeOp *fop, uint8 
         IonScript *ionScript = script->ion;
         ionScript->incref();
         IonSpew(IonSpew_Invalidate, "   ionScript %p ref %u", (void *) ionScript,
                 unsigned(ionScript->refcount()));
 
         const SafepointIndex *si = ionScript->getSafepointIndex(it.returnAddressToFp());
         IonCode *ionCode = ionScript->method();
 
+        JSCompartment *compartment = script->compartment();
+        if (compartment->needsBarrier()) {
+            // We're about to remove edges from the JSScript to gcthings
+            // embedded in the IonCode. Perform one final trace of the
+            // IonCode for the incremental GC, as it must know about
+            // those edges.
+            ionCode->trace(compartment->barrierTracer());
+        }
         ionCode->setInvalidated();
 
         // Write the delta (from the return address offset to the
         // IonScript pointer embedded into the invalidation epilogue)
         // where the safepointed call instruction used to be. We rely on
         // the call sequence causing the safepoint being >= the size of
         // a uint32, which is checked during safepoint index
         // construction.