merge

js/src/jsgc.cpp

@@ -3177,12 +3177,7 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
   }
 #endif
 
-    /*
-     * Clear property cache weak references and disable the cache so nothing
-     * can fill it during GC (this is paranoia, since scripts should not run
-     * during GC).
-     */
-    js_DisablePropertyCache(cx);
+    /* Clear property cache weak references. */
     js_FlushPropertyCache(cx);
 
 #ifdef JS_THREADSAFE
@@ -3204,7 +3199,6 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
             continue;
         memset(acx->thread->gcFreeLists, 0, sizeof acx->thread->gcFreeLists);
         GSN_CACHE_CLEAR(&acx->thread->gsnCache);
-        js_DisablePropertyCache(acx);
         js_FlushPropertyCache(acx);
     }
 #else
@@ -3477,14 +3471,19 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
         goto restart;
     }
 
-    if (!(rt->shapeGen & SHAPE_OVERFLOW_BIT)) {
-        js_EnablePropertyCache(cx);
+    if (rt->shapeGen & SHAPE_OVERFLOW_BIT) {
+        /*
+         * FIXME bug 440834: The shape id space has overflowed. Currently we
+         * cope badly with this. Every call to js_GenerateShape does GC, and
+         * we never re-enable the property cache.
+         */
+        js_DisablePropertyCache(cx);
 #ifdef JS_THREADSAFE
         iter = NULL;
         while ((acx = js_ContextIterator(rt, JS_FALSE, &iter)) != NULL) {
             if (!acx->thread || acx->thread == cx->thread)
                 continue;
-            js_EnablePropertyCache(acx);
+            js_DisablePropertyCache(acx);
         }
 #endif
     }

js/src/jsinterp.cpp

@@ -118,6 +118,7 @@ js_FillPropertyCache(JSContext *cx, JSObject *obj, jsuword kshape,
     JSAtom *atom;
     JSPropCacheEntry *entry;
 
+    JS_ASSERT(!cx->runtime->gcRunning);
     cache = &JS_PROPERTY_CACHE(cx);
     pc = cx->fp->regs->pc;
     if (cache->disabled) {