[INFER] Trace IDs and objects which inference depends on, bug 613221.

js/src/jsanalyze.h

@@ -382,6 +382,8 @@ class Script
     inline JSValueType knownArgumentTypeTag(JSContext *cx, JSScript *script, unsigned arg);
     inline JSValueType knownLocalTypeTag(JSContext *cx, JSScript *script, unsigned local);
 
+    void trace(JSTracer *trc);
+
 #endif /* JS_TYPE_INFERENCE */
 
 };

js/src/jsapi.cpp

@@ -5103,6 +5103,12 @@ JS_EvaluateUCScriptForPrincipals(JSContext *cx, JSObject *obj,
     }
     ok = Execute(cx, obj, script, NULL, 0, Valueify(rval));
     LAST_FRAME_CHECKS(cx, ok);
+
+#ifdef JS_TYPE_INFERENCE
+    // Don't destroy the script yet :FIXME: bug 613221
+    return ok;
+#endif
+
     js_DestroyScript(cx, script);
     return ok;
 }

js/src/jscntxt.cpp

@@ -518,11 +518,9 @@ JSThreadData::allocMathCache(JSContext *cx)
 void
 JSThreadData::finish()
 {
-#ifndef JS_TYPE_INFERENCE /* :FIXME: GC disabled during type inference */
 #ifdef DEBUG
     for (size_t i = 0; i != JS_ARRAY_LENGTH(scriptsToGC); ++i)
         JS_ASSERT(!scriptsToGC[i]);
-#endif
 #endif
 
     if (dtoaState)

js/src/jsgc.cpp

@@ -1732,6 +1732,25 @@ MarkRuntime(JSTracer *trc)
         }
     }
 #endif
+
+#ifdef JS_TYPE_INFERENCE
+    /* Mark all scripts which have analysis information. :FIXME: bug 613221 */
+    JSCompartment **read = rt->compartments.begin();
+    JSCompartment **end = rt->compartments.end();
+    while (read < end) {
+        JSCompartment *compartment = (*read++);
+        if (compartment->marked) {
+            for (JSCList *cursor = compartment->scripts.next;
+                 cursor != &compartment->scripts;
+                 cursor = cursor->next) {
+                JSScript *script = reinterpret_cast<JSScript *>(cursor);
+                if (script->analysis)
+                    js_TraceScript(trc, script);
+            }
+            compartment->types.trace(trc);
+        }
+    }
+#endif
 }
 
 void
@@ -1761,6 +1780,12 @@ js_DestroyScriptsToGC(JSContext *cx, JSThreadData *data)
         while ((script = *listp) != NULL) {
             *listp = script->u.nextToGC;
             script->u.nextToGC = NULL;
+
+#ifdef JS_TYPE_INFERENCE
+            // :FIXME: bug 613221
+            continue;
+#endif
+
             js_DestroyScript(cx, script);
         }
     }
@@ -2533,14 +2558,6 @@ GCUntilDone(JSContext *cx, JSGCInvocationKind gckind  GCTIMER_PARAM)
 void
 js_GC(JSContext *cx, JSGCInvocationKind gckind)
 {
-#ifdef JS_TYPE_INFERENCE
-    /*
-     * GC is disabled if type inference is active, as type objects do not currently
-     * root the atoms they refer to.
-     */
-    return;
-#endif
-
     JSRuntime *rt = cx->runtime;
 
     /*

js/src/jsinfer.cpp

@@ -43,6 +43,7 @@
 #include "jsbool.h"
 #include "jsdate.h"
 #include "jsexn.h"
+#include "jsgc.h"
 #include "jsinfer.h"
 #include "jsmath.h"
 #include "jsnum.h"
@@ -3477,3 +3478,59 @@ Script::print(JSContext *cx)
 }
 
 } } /* namespace js::analyze */
+
+/////////////////////////////////////////////////////////////////////
+// Tracing
+/////////////////////////////////////////////////////////////////////
+
+namespace js {
+
+static inline void
+TraceVariableSet(JSTracer *trc, const types::VariableSet &vars)
+{
+    types::Variable *var = vars.variables;
+    while (var) {
+        if (!JSID_IS_VOID(var->id))
+            gc::MarkString(trc, JSID_TO_STRING(var->id), "type_property");
+        var = var->next;
+    }
+}
+
+static inline void
+TraceObjectList(JSTracer *trc, types::TypeObject *objects)
+{
+    types::TypeObject *object = objects;
+    while (object) {
+        gc::MarkString(trc, JSID_TO_STRING(object->name), "type_object_name");
+        TraceVariableSet(trc, object->propertySet);
+        object = object->next;
+    }
+}
+
+void
+analyze::Script::trace(JSTracer *trc)
+{
+    if (fun) {
+        JS_SET_TRACING_NAME(trc, "type_script");
+        gc::Mark(trc, fun);
+    }
+
+    TraceObjectList(trc, objects);
+    TraceVariableSet(trc, localTypes);
+
+    unsigned nameCount = script->nfixed + argCount();
+    for (unsigned i = 0; i < nameCount; i++) {
+        if (localNames[i]) {
+            JSAtom *atom = JS_LOCAL_NAME_TO_ATOM(localNames[i]);
+            gc::MarkString(trc, ATOM_TO_STRING(atom), "type_script_local");
+        }
+    }
+}
+
+void
+types::TypeCompartment::trace(JSTracer *trc)
+{
+    TraceObjectList(trc, objects);
+}
+
+} /* namespace js */

js/src/jsinfer.h

@@ -816,6 +816,8 @@ struct TypeCompartment
 
     /* Monitor future effects on a bytecode. */
     void monitorBytecode(JSContext *cx, analyze::Bytecode *code);
+
+    void trace(JSTracer *trc);
 };
 
 } /* namespace types */

js/src/jsscript.cpp

@@ -1442,6 +1442,11 @@ js_TraceScript(JSTracer *trc, JSScript *script)
 
     if (IS_GC_MARKING_TRACER(trc) && script->filename)
         js_MarkScriptFilename(script->filename);
+
+#ifdef JS_TYPE_INFERENCE
+    if (script->analysis)
+        script->analysis->trace(trc);
+#endif
 }
 
 JSBool