Bug 1852893: Note purged stubs in inlining root r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D188660

js/src/jit-test/tests/cacheir/bug1852893-1.js

@@ -0,0 +1,27 @@
+// |jit-test| --fast-warmup; --no-threads; --blinterp-eager
+
+function foo(o) {
+  return foo_inner(o);
+}
+
+function foo_inner(o) {
+  return o.x;
+}
+with ({}) {}
+
+for (var i = 0; i < 13; i++) {
+  foo({x:1, ["y" + (i % 5)]: 2});
+}
+
+for (var i = 0; i < 17; i++) {
+  foo({x: 1, ["y" + (i % 8)]: 2});
+}
+
+eval("for (var i = 0; i < 10; i++) foo({y: 1, x:2})")
+
+// Purge a stub inside a trial-inlined script.
+gc();
+
+for (var i = 0; i < 50; i++) {
+  foo({x: 1, ["y" + (i % 3)]: 2});
+}

js/src/jit/JitScript.cpp

@@ -203,7 +203,9 @@ void JitScript::traceWeak(JSTracer* trc) {
   }
 
   if (hasInliningRoot()) {
-    inliningRoot()->traceWeak(trc);
+    if (!inliningRoot()->traceWeak(trc)) {
+      notePurgedStubs();
+    }
   }
 
   if (hasIonScript()) {

js/src/jit/TrialInlining.cpp

@@ -913,10 +913,14 @@ void InliningRoot::trace(JSTracer* trc) {
   }
 }
 
-void InliningRoot::traceWeak(JSTracer* trc) {
+bool InliningRoot::traceWeak(JSTracer* trc) {
+  bool allSurvived = true;
   for (auto& inlinedScript : inlinedScripts_) {
-    inlinedScript->traceWeak(trc);
+    if (!inlinedScript->traceWeak(trc)) {
+      allSurvived = false;
+    }
   }
+  return allSurvived;
 }
 
 void InliningRoot::purgeOptimizedStubs(Zone* zone) {

js/src/jit/TrialInlining.h

@@ -83,7 +83,7 @@ class InliningRoot {
   JitScriptICStubSpace* jitScriptStubSpace() { return &jitScriptStubSpace_; }
 
   void trace(JSTracer* trc);
-  void traceWeak(JSTracer* trc);
+  bool traceWeak(JSTracer* trc);
 
   bool addInlinedScript(js::UniquePtr<ICScript> icScript);