Back out 2 changesets (bug 1215336, bug 1215337) in hopes it will appease the angry gods, who will then stop hurling !phaseStartTimes[phase] assertion failures at our heads

CLOSED TREE

Backed out changeset f41fd6c7d522 (bug 1215337)
Backed out changeset 1998b272540e (bug 1215336)

js/src/gc/Marking.cpp

@@ -2475,11 +2475,18 @@ struct UnmarkGrayTracer : public JS::CallbackTracer
      * We set weakMapAction to DoNotTraceWeakMaps because the cycle collector
      * will fix up any color mismatches involving weakmaps when it runs.
      */
-    explicit UnmarkGrayTracer(JSRuntime *rt, bool tracingShape = false)
-      : JS::CallbackTracer(rt, DoNotTraceWeakMaps)
-      , tracingShape(tracingShape)
-      , previousShape(nullptr)
-      , unmarkedAny(false)
+    explicit UnmarkGrayTracer(JSRuntime* rt)
+      : JS::CallbackTracer(rt, DoNotTraceWeakMaps),
+        tracingShape(false),
+        previousShape(nullptr),
+        unmarkedAny(false)
+    {}
+
+    UnmarkGrayTracer(JSTracer* trc, bool tracingShape)
+      : JS::CallbackTracer(trc->runtime(), DoNotTraceWeakMaps),
+        tracingShape(tracingShape),
+        previousShape(nullptr),
+        unmarkedAny(false)
     {}
 
     void onChild(const JS::GCCellPtr& thing) override;
@@ -2565,7 +2572,7 @@ UnmarkGrayTracer::onChild(const JS::GCCellPtr& thing)
     // The parent will later trace |tenured|. This is done to avoid increasing
     // the stack depth during shape tracing. It is safe to do because a shape
     // can only have one child that is a shape.
-    UnmarkGrayTracer childTracer(runtime(), thing.kind() == JS::TraceKind::Shape);
+    UnmarkGrayTracer childTracer(this, thing.kind() == JS::TraceKind::Shape);
 
     if (thing.kind() != JS::TraceKind::Shape) {
         TraceChildren(&childTracer, &tenured, thing.kind());
@@ -2610,8 +2617,6 @@ TypedUnmarkGrayCellRecursively(T* t)
     }
 
     UnmarkGrayTracer trc(rt);
-    gcstats::AutoPhase outerPhase(rt->gc.stats, gcstats::PHASE_BARRIER);
-    gcstats::AutoPhase innerPhase(rt->gc.stats, gcstats::PHASE_UNMARK_GRAY);
     t->traceChildren(&trc);
 
     return unmarkedArg || trc.unmarkedAny;

js/src/gc/Statistics.cpp

@@ -173,8 +173,6 @@ static const PhaseInfo phases[] = {
         /* PHASE_MARK_ROOTS */
     { PHASE_TRACE_HEAP, "Trace Heap", PHASE_NO_PARENT, 47 },
         /* PHASE_MARK_ROOTS */
-    { PHASE_BARRIER, "Barriers", PHASE_NO_PARENT, 55 },
-        { PHASE_UNMARK_GRAY, "Unmark gray", PHASE_BARRIER, 56 },
     { PHASE_MARK_ROOTS, "Mark Roots", PHASE_MULTI_PARENTS, 48 },
         { PHASE_BUFFER_GRAY_ROOTS, "Buffer Gray Roots", PHASE_MARK_ROOTS, 49 },
         { PHASE_MARK_CCWS, "Mark Cross Compartment Wrappers", PHASE_MARK_ROOTS, 50 },
@@ -182,11 +180,7 @@ static const PhaseInfo phases[] = {
         { PHASE_MARK_RUNTIME_DATA, "Mark Runtime-wide Data", PHASE_MARK_ROOTS, 52 },
         { PHASE_MARK_EMBEDDING, "Mark Embedding", PHASE_MARK_ROOTS, 53 },
         { PHASE_MARK_COMPARTMENTS, "Mark Compartments", PHASE_MARK_ROOTS, 54 },
-    { PHASE_LIMIT, nullptr, PHASE_NO_PARENT, 57 }
-
-    // Current number of telemetryBuckets is 57. If you insert new phases
-    // somewhere, start at that number and count up. Do not change any existing
-    // numbers.
+    { PHASE_LIMIT, nullptr, PHASE_NO_PARENT, 55 }
 };
 
 static ExtraPhaseInfo phaseExtra[PHASE_LIMIT] = { { 0, 0 } };

js/src/gc/Statistics.h

@@ -74,8 +74,6 @@ enum Phase : uint8_t {
     PHASE_MINOR_GC,
     PHASE_EVICT_NURSERY,
     PHASE_TRACE_HEAP,
-    PHASE_BARRIER,
-    PHASE_UNMARK_GRAY,
     PHASE_MARK_ROOTS,
     PHASE_BUFFER_GRAY_ROOTS,
     PHASE_MARK_CCWS,

js/src/jsobj.cpp

@@ -3719,15 +3719,11 @@ JSObject::traceChildren(JSTracer* trc)
             GetObjectSlotNameFunctor func(nobj);
             JS::AutoTracingDetails ctx(trc, func);
             JS::AutoTracingIndex index(trc);
-            // Tracing can mutate the target but cannot change the slot count,
-            // but the compiler has no way of knowing this.
-            const uint32_t nslots = nobj->slotSpan();
-            for (uint32_t i = 0; i < nslots; ++i) {
+            for (uint32_t i = 0; i < nobj->slotSpan(); ++i) {
                 TraceManuallyBarrieredEdge(trc, nobj->getSlotRef(i).unsafeUnbarrieredForTracing(),
                                            "object slot");
                 ++index;
             }
-            MOZ_ASSERT(nslots == nobj->slotSpan());
         }
 
         do {