Bug 1465695 - Don't release helper thread lock while cancelling off-thread parses r=jandem

js/src/jit-test/tests/parser/bug-1465695.js

@@ -0,0 +1,4 @@
+if (helperThreadCount() === 0)
+    quit();
+for (let x = 0; x < 99; ++x)
+    evalInWorker("newGlobal().offThreadCompileScript(\"{}\");");

js/src/vm/HelperThreads.cpp

@@ -643,8 +643,8 @@ js::CancelOffThreadParses(JSRuntime* rt)
             next = task->getNext();
             if (task->runtimeMatches(rt)) {
                 found = true;
-                AutoUnlockHelperThreadState unlock(lock);
-                HelperThreadState().cancelParseTask(rt, task->kind, task);
+                task->remove();
+                HelperThreadState().destroyParseTask(rt, task);
             }
             task = next;
         }
@@ -1642,7 +1642,6 @@ GlobalHelperThreadState::removeFinishedParseTask(ParseTaskKind kind, JS::OffThre
     MOZ_ASSERT(found);
 #endif
 
-
     task->remove();
     return task;
 }
@@ -1823,8 +1822,15 @@ void
 GlobalHelperThreadState::cancelParseTask(JSRuntime* rt, ParseTaskKind kind,
                                          JS::OffThreadToken* token)
 {
-    ScopedJSDeletePtr<ParseTask> parseTask(removeFinishedParseTask(kind, token));
+    destroyParseTask(rt, removeFinishedParseTask(kind, token));
+}
+
+void
+GlobalHelperThreadState::destroyParseTask(JSRuntime* rt, ParseTask* parseTask)
+{
+    MOZ_ASSERT(!parseTask->isInList());
     LeaveParseTaskZone(rt, parseTask);
+    js_delete(parseTask);
 }
 
 void

js/src/vm/HelperThreads.h

@@ -304,6 +304,7 @@ class GlobalHelperThreadState
     bool finishParseTask(JSContext* cx, ParseTaskKind kind, JS::OffThreadToken* token, MutableHandle<ScriptVector> scripts);
 
     void cancelParseTask(JSRuntime* rt, ParseTaskKind kind, JS::OffThreadToken* token);
+    void destroyParseTask(JSRuntime* rt, ParseTask* parseTask);
 
     void mergeParseTaskRealm(JSContext* cx, ParseTask* parseTask, JS::Realm* dest);