Closed Bug 869222 Opened 6 years ago Closed 6 years ago
Fix post barriers on the Ion
IonScripts normally live as long as their owner JSScript; however, they can occasionally get destroyed outside the context of a GC by FinishInvalidationOf. Because of this case, we cannot use the normal store buffer to guard them. Instead we use the generic buffer to mark the owner script, which will mark the IonScript's fields, if it is still alive.
Attachment #746116 - Flags: review?(dvander)
Attachment #746116 - Flags: review?(dvander) → review+
Green try run: https://tbpl.mozilla.org/?tree=Try&rev=8ea3d8d7ce1d
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.