Backed out changeset 67b51087d673 (bug 1399866) for assertion failures on GC.cpp . CLOSED TREE
authorNarcis Beleuzu <nbeleuzu@mozilla.com>
Tue, 15 Oct 2019 21:19:25 +0300
changeset 559055 e3dc5cfd4d368d281ff8938f5a232f0bf92fe6b6
parent 559054 71c60cd8404b80b9805249f03077e24bf75fb575
child 559056 f24ddb55b48bf6815a83b1e8ee4dc33b87b8411e
push id12173
push useraiakab@mozilla.com
push dateWed, 16 Oct 2019 15:08:16 +0000
treeherdermozilla-beta@5d743fd9d6bd [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1399866
milestone71.0a1
backs out67b51087d67363bfa41e2661fc57dda7bd882d2f
first release with
nightly linux32
e3dc5cfd4d36 / 71.0a1 / 20191015213743 / files
nightly linux64
e3dc5cfd4d36 / 71.0a1 / 20191015213743 / files
nightly mac
e3dc5cfd4d36 / 71.0a1 / 20191015213743 / files
nightly win32
e3dc5cfd4d36 / 71.0a1 / 20191015213743 / files
nightly win64
e3dc5cfd4d36 / 71.0a1 / 20191015213743 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset 67b51087d673 (bug 1399866) for assertion failures on GC.cpp . CLOSED TREE
js/src/gc/GC.cpp
js/src/vm/ObjectGroup.cpp
js/src/vm/ObjectGroup.h
--- a/js/src/gc/GC.cpp
+++ b/js/src/gc/GC.cpp
@@ -7785,17 +7785,16 @@ void GCRuntime::mergeRealms(Realm* sourc
   // be in the source zone
   releaseHeldRelocatedArenas();
 
   // Fixup realm pointers in source to refer to target, and make sure
   // type information generations are in sync.
 
   GlobalObject* global = target->maybeGlobal();
   MOZ_ASSERT(global);
-  AssertTargetIsNotGray(global);
 
   for (auto group = source->zone()->cellIterUnsafe<ObjectGroup>();
        !group.done(); group.next()) {
     // Replace placeholder object prototypes with the correct prototype in
     // the target realm.
     TaggedProto proto(group->proto());
     if (proto.isObject()) {
       JSObject* obj = proto.toObject();
--- a/js/src/vm/ObjectGroup.cpp
+++ b/js/src/vm/ObjectGroup.cpp
@@ -39,23 +39,16 @@ using namespace js;
 
 ObjectGroup::ObjectGroup(const JSClass* clasp, TaggedProto proto,
                          JS::Realm* realm, ObjectGroupFlags initialFlags)
     : clasp_(clasp), proto_(proto), realm_(realm), flags_(initialFlags) {
   /* Windows may not appear on prototype chains. */
   MOZ_ASSERT_IF(proto.isObject(), !IsWindow(proto.toObject()));
   MOZ_ASSERT(JS::StringIsASCII(clasp->name));
 
-#ifdef DEBUG
-  GlobalObject* global = realm->unsafeUnbarrieredMaybeGlobal();
-  if (global) {
-    AssertTargetIsNotGray(global);
-  }
-#endif
-
   setGeneration(zone()->types.generation);
 }
 
 void ObjectGroup::finalize(JSFreeOp* fop) {
   if (auto newScript = newScriptDontCheckGeneration()) {
     newScript->clear();
     fop->delete_(this, newScript, newScript->gcMallocBytes(),
                  MemoryUse::ObjectGroupAddendum);
--- a/js/src/vm/ObjectGroup.h
+++ b/js/src/vm/ObjectGroup.h
@@ -85,23 +85,24 @@ enum NewObjectKind {
 
 /* Type information about an object accessed by a script. */
 class ObjectGroup : public gc::TenuredCell {
  public:
   class Property;
 
  private:
   /* Class shared by objects in this group. */
-  const JSClass* const clasp_;  // set by constructor
+  const JSClass* clasp_;  // set by constructor
 
   /* Prototype shared by objects in this group. */
   GCPtr<TaggedProto> proto_;  // set by constructor
 
   /* Realm shared by objects in this group. */
-  JS::Realm* realm_;  // set by constructor
+  JS::Realm* realm_;
+  ;  // set by constructor
 
   /* Flags for this group. */
   ObjectGroupFlags flags_;  // set by constructor
 
   // If non-null, holds additional information about this object, whose
   // format is indicated by the object's addendum kind.
   void* addendum_ = nullptr;