Bug 948162 - Update DependentAddPtr's ptr on GC r=terrence

js/src/jit-test/tests/baseline/bug857580.js

@@ -1,8 +1,4 @@
-
-if (getBuildConfiguration()['generational-gc'])
-    quit();
-
-gczeal(2);
+gczeal(2,10);
 var g = newGlobal();
 var dbg = new Debugger(g);
 dbg.onNewScript = function(script) {

js/src/jshashutil.h

@@ -26,17 +26,16 @@ struct DependentAddPtr
     DependentAddPtr(const ExclusiveContext *cx, const T &table, const Lookup &lookup)
       : addPtr(table.lookupForAdd(lookup))
 #ifdef JSGC_GENERATIONAL
-      , cx(cx)
       , originalGcNumber(cx->zone()->gcNumber())
 #endif
         {}
 
     template <class KeyInput, class ValueInput>
-    bool add(T &table, const KeyInput &key, const ValueInput &value) {
+    bool add(const ExclusiveContext *cx, T &table, const KeyInput &key, const ValueInput &value) {
 #ifdef JSGC_GENERATIONAL
         bool gcHappened = originalGcNumber != cx->zone()->gcNumber();
         if (gcHappened)
-            return table.putNew(key, value);
+            addPtr = table.lookupForAdd(key);
 #endif
         return table.relookupOrAdd(addPtr, key, value);
     }
@@ -52,7 +51,6 @@ struct DependentAddPtr
   private:
     AddPtr addPtr ;
 #ifdef JSGC_GENERATIONAL
-    const ExclusiveContext *cx;
     const uint64_t originalGcNumber;
 #endif
 

js/src/jsinfer.cpp

@@ -2367,7 +2367,7 @@ TypeCompartment::setTypeToHomogenousArray(ExclusiveContext *cx,
             objType->addPropertyType(cx, JSID_VOID, elementType);
 
         key.proto = objProto;
-        if (!p.add(*arrayTypeTable, key, objType)) {
+        if (!p.add(cx, *arrayTypeTable, key, objType)) {
             cx->compartment()->types.setPendingNukeTypes(cx);
             return;
         }

js/src/vm/Debugger.cpp

@@ -683,7 +683,7 @@ Debugger::wrapEnvironment(JSContext *cx, Handle<Env*> env, MutableHandleValue rv
             return false;
         envobj->setPrivateGCThing(env);
         envobj->setReservedSlot(JSSLOT_DEBUGENV_OWNER, ObjectValue(*object));
-        if (!p.add(environments, env, envobj)) {
+        if (!p.add(cx, environments, env, envobj)) {
             js_ReportOutOfMemory(cx);
             return false;
         }
@@ -726,7 +726,7 @@ Debugger::wrapDebuggeeValue(JSContext *cx, MutableHandleValue vp)
             dobj->setPrivateGCThing(obj);
             dobj->setReservedSlot(JSSLOT_DEBUGOBJECT_OWNER, ObjectValue(*object));
 
-            if (!p.add(objects, obj, dobj)) {
+            if (!p.add(cx, objects, obj, dobj)) {
                 js_ReportOutOfMemory(cx);
                 return false;
             }
@@ -2812,7 +2812,7 @@ Debugger::wrapScript(JSContext *cx, HandleScript script)
         if (!scriptobj)
             return nullptr;
 
-        if (!p.add(scripts, script, scriptobj)) {
+        if (!p.add(cx, scripts, script, scriptobj)) {
             js_ReportOutOfMemory(cx);
             return nullptr;
         }
@@ -3705,7 +3705,7 @@ Debugger::wrapSource(JSContext *cx, HandleScriptSource source)
         if (!sourceobj)
             return nullptr;
 
-        if (!p.add(sources, source, sourceobj)) {
+        if (!p.add(cx, sources, source, sourceobj)) {
             js_ReportOutOfMemory(cx);
             return nullptr;
         }

js/src/vm/Debugger.h

@@ -75,23 +75,11 @@ class DebuggerWeakMap : private WeakMap<Key, Value, DefaultHasher<Key> >
         return Base::init(len) && zoneCounts.init();
     }
 
-    template<typename KeyInput, typename ValueInput>
-    bool putNew(const KeyInput &k, const ValueInput &v) {
-        JS_ASSERT(v->compartment() == Base::compartment);
-        JS_ASSERT(!k->compartment()->options_.invisibleToDebugger());
-        if (!incZoneCount(k->zone()))
-            return false;
-        bool ok = Base::putNew(k, v);
-        if (!ok)
-            decZoneCount(k->zone());
-        return ok;
-    }
-
     template<typename KeyInput, typename ValueInput>
     bool relookupOrAdd(AddPtr &p, const KeyInput &k, const ValueInput &v) {
         JS_ASSERT(v->compartment() == Base::compartment);
         JS_ASSERT(!k->compartment()->options_.invisibleToDebugger());
-        JS_ASSERT(!p.found());
+        JS_ASSERT(!Base::has(k));
         if (!incZoneCount(k->zone()))
             return false;
         bool ok = Base::relookupOrAdd(p, k, v);

js/src/vm/SelfHosting.cpp

@@ -908,7 +908,7 @@ CloneObject(JSContext *cx, HandleObject srcObj, CloneMemory &clonedObjects)
     }
     if (!clone)
         return nullptr;
-    if (!p.add(clonedObjects, srcObj, clone))
+    if (!p.add(cx, clonedObjects, srcObj, clone))
         return nullptr;
     if (!CloneProperties(cx, srcObj, clone, clonedObjects)) {
         clonedObjects.remove(srcObj);

js/src/vm/Shape.cpp

@@ -1483,7 +1483,7 @@ BaseShape::getUnowned(ExclusiveContext *cx, const StackBaseShape &base)
 
     UnownedBaseShape *nbase = static_cast<UnownedBaseShape *>(nbase_);
 
-    if (!p.add(table, &base, nbase))
+    if (!p.add(cx, table, &base, nbase))
         return nullptr;
 
     return nbase;
@@ -1619,7 +1619,7 @@ EmptyShape::getInitialShape(ExclusiveContext *cx, const Class *clasp, TaggedProt
     new (shape) EmptyShape(nbase, nfixed);
 
     Lookup lookup(clasp, protoRoot, parentRoot, metadataRoot, nfixed, objectFlags);
-    if (!p.add(table, lookup, InitialShapeEntry(shape, protoRoot)))
+    if (!p.add(cx, table, lookup, InitialShapeEntry(shape, protoRoot)))
         return nullptr;
 
     return shape;