868037 - GC: Fix more rooting analysis false positives

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jon Coppeard (:jonco)]

Attachment: Proposed changes

Here's a patch to the analysis for the following:

 - js::WeakMap::markIteratively() is called during marking and hence cannot GC
 - CustomAutoRooter derived classes not previously counted as AutoRooters

I'm still trying to figure out the best way to get it to not generate a hazard for the AutoRooted StackShape in js::Shape::replaceLastProperty().

Comment 1

[Steve Fink [:sfink] [:s:]]

Comment on attachment 744670 [details] [diff] [review]
Proposed changes

Review of attachment 744670 [details] [diff] [review]:
-----------------------------------------------------------------

Seems fine to me. Note that I plan to land a fix to the GetWeakmapKeyDelegate (+ add some comments) whenever the tree is open next. We can race to see who has to rebase.

::: js/src/devtools/rootAnalysis/annotations.js
@@ +27,5 @@
>      // hook called during script finalization which cannot GC.
>      if (/CallDestroyScriptHook/.test(caller))
>          return true;
>  
> +    // template method called during marking and hence cannot GC

It'd be nice to come up with something more general for ignoring stuff only called during marking, perhaps based on the AutoSuppressGC stuff, but this is fine.

Comment 2

[Jon Coppeard (:jonco)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8a16d529df16

Comment 3

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/8a16d529df16