From 535ee047bf9de2b5a47accbfc0da3def6305762e Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Mon, 23 Mar 2015 17:06:45 +0000
Subject: [PATCH] Bug 1141563 - Don't update Shapes in parallel after
 compacting GC r=terrence

---
 js/src/jsgc.cpp | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 7237a4836e42..c848876eb4eb 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2312,6 +2312,8 @@ struct ArenasToUpdate
 bool ArenasToUpdate::shouldProcessKind(AllocKind kind)
 {
     MOZ_ASSERT(kind < AllocKind::LIMIT);
+
+    // GC things that do not contain JSObject pointers don't need updating.
     if (kind == AllocKind::FAT_INLINE_STRING ||
         kind == AllocKind::STRING ||
         kind == AllocKind::EXTERNAL_STRING ||
@@ -2320,10 +2322,19 @@ bool ArenasToUpdate::shouldProcessKind(AllocKind kind)
         return false;
     }
 
-    if (js::gc::IsBackgroundFinalized(kind))
+    // We try to update as many GC things in parallel as we can, but there are
+    // kinds for which this might not be safe:
+    //  - we assume JSObjects that are foreground finalized are not safe to
+    //    update in parallel
+    //  - updating a shape touches child shapes in fixupShapeTreeAfterMovingGC()
+    if (js::gc::IsBackgroundFinalized(kind) &&
+        kind != AllocKind::SHAPE &&
+        kind != AllocKind::ACCESSOR_SHAPE)
+    {
         return (kinds & BACKGROUND) != 0;
-    else
+    } else {
         return (kinds & FOREGROUND) != 0;
+    }
 }
 
 ArenasToUpdate::ArenasToUpdate(Zone *zone, KindsToUpdate kinds)