Bug 913715 - Do not inline nursery allocated getter functions; r=bhackett
authorTerrence Cole <terrence@mozilla.com>
Tue, 01 Oct 2013 15:27:51 -0700
changeset 163563 7f6d42c8c7d29c397f1eefbb74531b3883f0c1ed
parent 163562 f90b5cb4c293595fc9775511107215e433712e7f
child 163564 160f313bccab5b6afbc8b957f302568657abc97f
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs913715
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 913715 - Do not inline nursery allocated getter functions; r=bhackett
js/src/jit-test/tests/gc/bug-913715.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-913715.js
@@ -0,0 +1,31 @@
+try {
+    (function() {
+        Object.defineProperty(this, "x", {
+            get: function() {
+                Object.defineProperty(this, "y", {
+                    configurable: true,
+                    get: function() {
+                        return Proxy(this.y)
+                    }
+                });
+                x;
+            }
+        })
+    })()
+    x
+} catch (e) {}
+try {
+    x
+} catch (e) {}
+try {
+    x
+} catch (e) {}
+try {
+    y
+} catch (e) {}
+try {
+    y
+} catch (e) {}
+try {
+    y
+} catch (e) {}
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -8398,16 +8398,21 @@ IonBuilder::getPropTryCommonGetter(bool 
 
     types::TemporaryTypeSet *objTypes = current->peek(-1)->resultTypeSet();
 
     if (!testCommonPropFunc(cx, objTypes, id, &commonGetter, true, &isDOM, &guard))
         return false;
     if (!commonGetter)
         return true;
 
+#ifdef JSGC_GENERATIONAL
+    if (GetIonContext()->runtime->gcNursery.isInside(commonGetter))
+        return true;
+#endif
+
     MDefinition *obj = current->pop();
 
     if (isDOM && TestShouldDOMCall(cx, objTypes, commonGetter, JSJitInfo::Getter)) {
         const JSJitInfo *jitinfo = commonGetter->jitInfo();
         MGetDOMProperty *get = MGetDOMProperty::New(jitinfo, obj, guard);
         current->add(get);
         current->push(get);