Bug 1394505 - Avoid triggering zone assertion when cancelling code generation for IonBuilders owned by a different runtime r=jandem
authorJon Coppeard <jcoppeard@mozilla.com>
Mon, 04 Sep 2017 10:09:32 +0100
changeset 428324 f45bc632fdc82e041986fab9ba95c835aaedd208
parent 428323 57b37489a2e314fb2a52bef0af81cd05efa565d7
child 428325 0669574f5d86ad63b9545c7abdb020705a93d154
push id7761
push userjlund@mozilla.com
push dateFri, 15 Sep 2017 00:19:52 +0000
treeherdermozilla-beta@c38455951db4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1394505
milestone57.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1394505 - Avoid triggering zone assertion when cancelling code generation for IonBuilders owned by a different runtime r=jandem
js/src/jit-test/tests/ion/bug1394505.js
js/src/vm/HelperThreads.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1394505.js
@@ -0,0 +1,13 @@
+if (helperThreadCount() === 0)
+    quit();
+if (!('oomTest' in this))
+    quit();
+
+for (let j = 0; j < 50; j++) {
+    if (j === 1)
+        oomTest(function() {});
+    evalInWorker(`
+        for (let i = 0; i < 30; i++)
+            relazifyFunctions();
+    `);
+}
--- a/js/src/vm/HelperThreads.cpp
+++ b/js/src/vm/HelperThreads.cpp
@@ -301,17 +301,17 @@ CancelOffThreadIonCompileLocked(const Co
             HelperThreadState().wait(lock, GlobalHelperThreadState::CONSUMER);
     } while (cancelled);
 
     /* Cancel code generation for any completed entries. */
     GlobalHelperThreadState::IonBuilderVector& finished = HelperThreadState().ionFinishedList(lock);
     for (size_t i = 0; i < finished.length(); i++) {
         jit::IonBuilder* builder = finished[i];
         if (IonBuilderMatches(selector, builder)) {
-            builder->script()->zone()->group()->numFinishedBuilders--;
+            builder->script()->zoneFromAnyThread()->group()->numFinishedBuilders--;
             jit::FinishOffThreadBuilder(nullptr, builder, lock);
             HelperThreadState().remove(finished, &i);
         }
     }
 
     /* Cancel lazy linking for pending builders (attached to the ionScript). */
     if (discardLazyLinkList) {
         MOZ_ASSERT(!selector.is<AllCompilations>());