Bug 811587 - Limit scheduledForDestruction assert to brain transplants (r=luke)
authorBill McCloskey <wmccloskey@mozilla.com>
Mon, 17 Dec 2012 11:27:48 -0800
changeset 125406 6457767f52779fdb841582d2d68a0efdcd0021f7
parent 125405 249e7db380b0e4a2da0df37aa34844c364fd42ee
child 125407 88dbe374066502e824c1840f0de3353734317a34
push id2151
push userlsblakk@mozilla.com
push dateTue, 19 Feb 2013 18:06:57 +0000
treeherdermozilla-beta@4952e88741ec [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 811587 - Limit scheduledForDestruction assert to brain transplants (r=luke)
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -102,21 +102,23 @@ static void MarkChildren(JSTracer *trc, 
 template<typename T>
 static inline void
 CheckMarkedThing(JSTracer *trc, T *thing)
     JS_ASSERT(thing->compartment()->rt == trc->runtime);
-    JS_ASSERT_IF(IS_GC_MARKING_TRACER(trc), !thing->compartment()->scheduledForDestruction);
     JS_ASSERT(trc->debugPrinter || trc->debugPrintArg);
     DebugOnly<JSRuntime *> rt = trc->runtime;
+    JS_ASSERT_IF(IS_GC_MARKING_TRACER(trc) && rt->gcManipulatingDeadCompartments,
+                 !thing->compartment()->scheduledForDestruction);
 #ifdef DEBUG
     JS_ASSERT_IF(thing->compartment()->requireGCTracer(), IS_GC_MARKING_TRACER(trc));
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2639,16 +2639,18 @@ BeginMarkPhase(JSRuntime *rt)
      * collected in this GC. A compartment is considered dead if its maybeAlive
      * flag is false. The maybeAlive flag is set if:
      *   (1) the compartment has incoming cross-compartment edges, or
      *   (2) an object in the compartment was marked during root marking, either
      *       as a black root or a gray root.
      * If the maybeAlive is false, then we set the scheduledForDestruction flag.
      * At any time later in the GC, if we try to mark an object whose
      * compartment is scheduled for destruction, we will assert.
+     * NOTE: Due to bug 811587, we only assert if gcManipulatingDeadCompartments
+     * is true (e.g., if we're doing a brain transplant).
      * The purpose of this check is to ensure that a compartment that we would
      * normally destroy is not resurrected by a read barrier or an
      * allocation. This might happen during a function like JS_TransplantObject,
      * which iterates over all compartments, live or dead, and operates on their
      * objects. See bug 803376 for details on this problem. To avoid the
      * problem, we are very careful to avoid allocation and read barriers during
      * JS_TransplantObject and the like. The code here ensures that we don't