764163 - IonMonkey/JM: getNewObject() should check needZealousGC() at runtime.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

getNewObject() in both JITs contains the following compile-time check:

>#ifdef JS_GC_ZEAL
>    if (cx->runtime->needZealousGC()) {
>        jump(fail);
>        return;
>    }
>#endif

As exists, the code assumes that when the next GC occurs, the executable code would be GC'd, then later regenerated. Since IM/JM code is now preserved on GC, needZealousGC() should actually be checked every time we attempt to perform an inline allocation.

Affects both IM and JM, but only in debug mode.

Comment 1

[Eric Faust [:efaust]]

We simply check cx->runtime->gcZeal_ instead of calling needZealousGC() to prevent call and rearrangement overhead.

https://hg.mozilla.org/projects/ionmonkey/rev/b4fd23971959

JM was not patched.

Comment 2

[Robert Longson [:longsonr]]

Check is misspelled as Cehck in the comment in https://hg.mozilla.org/projects/ionmonkey/rev/b4fd23971959