Created attachment 746116 [details] [diff] [review] v0 IonScripts normally live as long as their owner JSScript; however, they can occasionally get destroyed outside the context of a GC by FinishInvalidationOf. Because of this case, we cannot use the normal store buffer to guard them. Instead we use the generic buffer to mark the owner script, which will mark the IonScript's fields, if it is still alive.
Attachment #746116 - Flags: review?(dvander)
Attachment #746116 - Flags: review?(dvander) → review+
Created attachment 747051 [details] [diff] [review] vFinal: for checkin.
Green try run: https://tbpl.mozilla.org/?tree=Try&rev=8ea3d8d7ce1d
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
You need to log in before you can comment on or make changes to this bug.