Bug 1278832 - Make sure heap check zeal mode traces the heap outside of a GC r=terrence

js/src/gc/GCInternals.h

@@ -124,7 +124,7 @@ struct MOZ_RAII AutoStopVerifyingBarriers
 
 #ifdef JSGC_HASH_TABLE_CHECKS
 void CheckHashTablesAfterMovingGC(JSRuntime* rt);
-void CheckHeapAfterMovingGC(JSRuntime* rt, AutoLockForExclusiveAccess& lock);
+void CheckHeapAfterMovingGC(JSRuntime* rt);
 #endif
 
 struct MovingTracer : JS::CallbackTracer

js/src/gc/Nursery.cpp

@@ -500,13 +500,6 @@ js::Nursery::collect(JSRuntime* rt, JS::gcreason::Reason reason, ObjectGroupList
 #endif
     TIME_END(checkHashTables);
 
-    TIME_START(checkHeap);
-#ifdef JS_GC_ZEAL
-    if (rt->hasZealMode(ZealMode::CheckHeapOnMovingGC))
-        CheckHeapAfterMovingGC(rt, session.lock);
-#endif
-    TIME_END(checkHeap);
-
     // Resize the nursery.
     TIME_START(resize);
     double promotionRate = mover.tenuredSize / double(allocationEnd() - start());
@@ -557,7 +550,6 @@ js::Nursery::collect(JSRuntime* rt, JS::gcreason::Reason reason, ObjectGroupList
             {"mcWCll", TIME_TOTAL(traceWholeCells)},
             {"mkGnrc", TIME_TOTAL(traceGenericEntries)},
             {"ckTbls", TIME_TOTAL(checkHashTables)},
-            {"ckHeap", TIME_TOTAL(checkHeap)},
             {"mkRntm", TIME_TOTAL(markRuntime)},
             {"mkDbgr", TIME_TOTAL(markDebugger)},
             {"clrNOC", TIME_TOTAL(clearNewObjectCache)},

js/src/gc/Verifier.cpp

@@ -526,11 +526,11 @@ CheckHeapTracer::check(AutoLockForExclusiveAccess& lock)
 }
 
 void
-js::gc::CheckHeapAfterMovingGC(JSRuntime* rt, AutoLockForExclusiveAccess& lock)
+js::gc::CheckHeapAfterMovingGC(JSRuntime* rt)
 {
-    MOZ_ASSERT(rt->isHeapCollecting());
+    AutoTraceSession session(rt, JS::HeapState::Tracing);
     CheckHeapTracer tracer(rt);
-    if (!tracer.init() || !tracer.check(lock))
+    if (!tracer.init() || !tracer.check(session.lock))
         fprintf(stderr, "OOM checking heap\n");
 }
 

js/src/jit-test/tests/gc/bug-1278832.js

@@ -0,0 +1,12 @@
+function assertThrowsInstanceOf() {}
+gczeal(15)
+try {
+    gczeal(10, 2)
+} catch (Atomics) {}
+for (define of[__defineSetter__]) {
+    let nonCallable = [{}]
+    for (let value of nonCallable) assertThrowsInstanceOf(TypeError)
+    key = {
+        [Symbol]() {}
+    }
+}

js/src/jsgc.cpp

@@ -5537,10 +5537,6 @@ GCRuntime::compactPhase(JS::gcreason::Reason reason, SliceBudget& sliceBudget,
 #ifdef DEBUG
     CheckHashTablesAfterMovingGC(rt);
 #endif
-#ifdef JS_GC_ZEAL
-    if (rt->hasZealMode(ZealMode::CheckHeapOnMovingGC))
-        CheckHeapAfterMovingGC(rt, lock);
-#endif
 
     return zonesToMaybeCompact.isEmpty() ? Finished : NotFinished;
 }
@@ -6309,6 +6305,13 @@ GCRuntime::collect(bool nonincrementalByAPI, SliceBudget budget, JS::gcreason::R
     } while (repeat);
 
     agc.setCycleCount(cycleCount);
+
+#ifdef JS_GC_ZEAL
+    if (shouldCompact() && rt->hasZealMode(ZealMode::CheckHeapOnMovingGC)) {
+        gcstats::AutoPhase ap(rt->gc.stats, gcstats::PHASE_TRACE_HEAP);
+        CheckHeapAfterMovingGC(rt);
+    }
+#endif
 }
 
 js::AutoEnqueuePendingParseTasksAfterGC::~AutoEnqueuePendingParseTasksAfterGC()
@@ -6517,6 +6520,11 @@ GCRuntime::minorGCImpl(JS::gcreason::Reason reason, Nursery::ObjectGroupList* pr
 
     blocksToFreeAfterMinorGC.freeAll();
 
+#ifdef JS_GC_ZEAL
+    if (rt->hasZealMode(ZealMode::CheckHeapOnMovingGC))
+        CheckHeapAfterMovingGC(rt);
+#endif
+
     AutoLockGC lock(rt);
     for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
         maybeAllocTriggerZoneGC(zone, lock);

js/src/vm/TypeInference.cpp

@@ -4065,12 +4065,7 @@ AssertGCStateForSweep(Zone* zone)
 
     // IsAboutToBeFinalized doesn't work right on tenured objects when called
     // during a minor collection.
-    //
-    // We allow this when tracing the heap for CheckHeapOnMovingGC since that
-    // happens afterwards and is not part of minor collection.
-    DebugOnly<JSRuntime*> rt(zone->runtimeFromMainThread());
-    MOZ_ASSERT_IF(!rt->hasZealMode(ZealMode::CheckHeapOnMovingGC),
-                  !rt->isHeapMinorCollecting());
+    MOZ_ASSERT(!zone->runtimeFromMainThread()->isHeapMinorCollecting());
 }
 
 void