Bug 797435 - Add rooting of IC stub IonCodes to OOL exit frames. (r=dvander)

js/src/ion/IonFrames.cpp

@@ -550,13 +550,15 @@ MarkIonExitFrame(JSTracer *trc, const IonFrameIterator &frame)
 
     if (frame.isOOLNativeGetter()) {
         IonOOLNativeGetterExitFrameLayout *oolgetter = frame.exitFrame()->oolNativeGetterExit();
+        gc::MarkIonCodeRoot(trc, oolgetter->stubCode(), "ion-ool-getter-code");
         gc::MarkValueRoot(trc, oolgetter->vp(), "ion-ool-getter-callee");
-        gc::MarkValueRoot(trc, oolgetter->vp() + 1, "ion-ool-getter-this");
+        gc::MarkValueRoot(trc, oolgetter->thisp(), "ion-ool-getter-this");
         return;
     }
  
     if (frame.isOOLPropertyOp()) {
         IonOOLPropertyOpExitFrameLayout *oolgetter = frame.exitFrame()->oolPropertyOpExit();
+        gc::MarkIonCodeRoot(trc, oolgetter->stubCode(), "ion-ool-property-op-code");
         gc::MarkValueRoot(trc, oolgetter->vp(), "ion-ool-property-op-vp");
         gc::MarkIdRoot(trc, oolgetter->id(), "ion-ool-property-op-id");
         gc::MarkObjectRoot(trc, oolgetter->obj(), "ion-ool-property-op-obj");

js/src/ion/arm/IonFrames-arm.h

@@ -270,6 +270,9 @@ class IonOOLNativeGetterExitFrameLayout
     uint32_t loThis_;
     uint32_t hiThis_;
 
+    // pointer to root the stub's IonCode
+    IonCode *stubCode_;
+
   public:
     static inline size_t Size() {
         return sizeof(IonOOLNativeGetterExitFrameLayout);
@@ -278,9 +281,16 @@ class IonOOLNativeGetterExitFrameLayout
     static size_t offsetOfResult() {
         return offsetof(IonOOLNativeGetterExitFrameLayout, loCalleeResult_);
     }
+
+    inline IonCode **stubCode() {
+        return &stubCode_;
+    }
     inline Value *vp() {
         return reinterpret_cast<Value*>(&loCalleeResult_);
     }
+    inline Value *thisp() {
+        return reinterpret_cast<Value*>(&loThis_);
+    }
     inline uintptr_t argc() const {
         return 0;
     }
@@ -302,6 +312,9 @@ class IonOOLPropertyOpExitFrameLayout
     uint32_t vp0_;
     uint32_t vp1_;
 
+    // pointer to root the stub's IonCode
+    IonCode *stubCode_;
+
   public:
     static inline size_t Size() {
         return sizeof(IonOOLPropertyOpExitFrameLayout);
@@ -310,6 +323,10 @@ class IonOOLPropertyOpExitFrameLayout
     static size_t offsetOfResult() {
         return offsetof(IonOOLPropertyOpExitFrameLayout, vp0_);
     }
+
+    inline IonCode **stubCode() {
+        return &stubCode_;
+    }
     inline Value *vp() {
         return reinterpret_cast<Value*>(&vp0_);
     }

js/src/ion/shared/IonFrames-x86-shared.h

@@ -251,8 +251,11 @@ class IonOOLNativeGetterExitFrameLayout
     uint32_t hiCalleeResult_;
 
     // The frame includes the object argument.
-    uint32_t loThisResult_;
-    uint32_t hiThisResult_;
+    uint32_t loThis_;
+    uint32_t hiThis_;
+
+    // pointer to root the stub's IonCode
+    IonCode *stubCode_;
 
   public:
     static inline size_t Size() {
@@ -263,9 +266,16 @@ class IonOOLNativeGetterExitFrameLayout
         return offsetof(IonOOLNativeGetterExitFrameLayout, loCalleeResult_);
     }
 
+    inline IonCode **stubCode() {
+        return &stubCode_;
+    }
     inline Value *vp() {
         return reinterpret_cast<Value*>(&loCalleeResult_);
     }
+    inline Value *thisp() {
+        return reinterpret_cast<Value*>(&loThis_);
+    }
+
     inline uintptr_t argc() const {
         return 0;
     }
@@ -288,6 +298,9 @@ class IonOOLPropertyOpExitFrameLayout
     uint32_t vp0_;
     uint32_t vp1_;
 
+    // pointer to root the stub's IonCode
+    IonCode *stubCode_;
+
   public:
     static inline size_t Size() {
         return sizeof(IonOOLPropertyOpExitFrameLayout);
@@ -297,6 +310,9 @@ class IonOOLPropertyOpExitFrameLayout
         return offsetof(IonOOLPropertyOpExitFrameLayout, vp0_);
     }
 
+    inline IonCode **stubCode() {
+        return &stubCode_;
+    }
     inline Value *vp() {
         return reinterpret_cast<Value*>(&vp0_);
     }