Bug 1264920: IonMonkey - DoTypeUpdateFallback is not allowed to gc, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Wed, 20 Apr 2016 06:40:16 -0400
changeset 317800 7c1f8d3d4f69add3995d27d4c70c92d286aa54b9
parent 317799 be2f6cb7251c22cec13209cc2314789e7ae0d0ea
child 317801 5d72b110307dc616e5d16cba45d2702e738c2ab4
push id9480
push userjlund@mozilla.com
push dateMon, 25 Apr 2016 17:12:58 +0000
treeherdermozilla-aurora@0d6a91c76a9e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1264920
milestone48.0a1
Bug 1264920: IonMonkey - DoTypeUpdateFallback is not allowed to gc, r=jandem
js/src/jit/BaselineIC.cpp
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -262,16 +262,19 @@ ICWarmUpCounter_Fallback::Compiler::gene
 
 //
 // TypeUpdate_Fallback
 //
 static bool
 DoTypeUpdateFallback(JSContext* cx, BaselineFrame* frame, ICUpdatedStub* stub, HandleValue objval,
                      HandleValue value)
 {
+    // This can get called from optimized stubs. Therefore it is not allowed to gc.
+    JS::AutoCheckCannotGC nogc;
+
     FallbackICSpew(cx, stub->getChainFallback(), "TypeUpdate(%s)",
                    ICStub::KindString(stub->kind()));
 
     RootedScript script(cx, frame->script());
     RootedObject obj(cx, &objval.toObject());
     RootedId id(cx);
 
     switch(stub->kind()) {