Mark reserved doubles during GC as long we are not shutting down (515440, r=jorendorff).

js/src/jscntxt.cpp

@@ -116,7 +116,6 @@ PurgeThreadData(JSContext *cx, JSThreadData *data)
 
 # ifdef JS_TRACER
     JSTraceMonitor *tm = &data->traceMonitor;
-    tm->reservedDoublePoolPtr = tm->reservedDoublePool;
 
     /*
      * If we are about to regenerate shapes, we have to flush the JIT cache,
@@ -126,12 +125,14 @@ PurgeThreadData(JSContext *cx, JSThreadData *data)
         tm->needFlush = JS_TRUE;
 
     /*
-     * We want to keep tm->reservedObjects after the GC. So, unless we are
+     * We want to keep reserved doubles and objects after the GC. So, unless we
-     * shutting down, we don't purge them here and rather mark them during
+     * are shutting down, we don't purge them here and rather mark them during
      * the GC, see MarkReservedObjects in jsgc.cpp.
      */
-    if (cx->runtime->state == JSRTS_LANDING)
+    if (cx->runtime->state == JSRTS_LANDING) {
+        tm->reservedDoublePoolPtr = tm->reservedDoublePool;
         tm->reservedObjects = NULL;
+    }
 # endif
 
     /* Destroy eval'ed scripts. */

js/src/jsgc.cpp

@@ -3048,9 +3048,23 @@ js_TraceContext(JSTracer *trc, JSContext *acx)
 #ifdef JS_TRACER
 
 static void
-MarkReservedObjects(JSTraceMonitor *tm)
+MarkReservedGCThings(JSTraceMonitor *tm)
 {
-    /* Keep the reserved objects. */
+    /* Keep reserved doubles. */
+    for (jsval *ptr = tm->reservedDoublePool; ptr < tm->reservedDoublePoolPtr; ++ptr) {
+        jsdouble* dp = JSVAL_TO_DOUBLE(*ptr);
+        JS_ASSERT(js_GetGCThingTraceKind(dp) == JSTRACE_DOUBLE);
+
+        JSGCArenaInfo *a = THING_TO_ARENA(dp);
+        JS_ASSERT(!a->list);
+        if (!a->u.hasMarkedDoubles) {
+            ClearDoubleArenaFlags(a);
+            a->u.hasMarkedDoubles = JS_TRUE;
+        }
+        jsuint index = DOUBLE_THING_TO_INDEX(dp);
+        JS_SET_BIT(DOUBLE_ARENA_BITMAP(a), index);
+    }
+    /* Keep reserved objects. */
     for (JSObject *obj = tm->reservedObjects; obj; obj = JSVAL_TO_OBJECT(obj->fslots[0])) {
         JS_ASSERT(js_GetGCThingTraceKind(obj) == JSTRACE_OBJECT);
 
@@ -3062,12 +3076,12 @@ MarkReservedObjects(JSTraceMonitor *tm)
 
 #ifdef JS_THREADSAFE
 static JSDHashOperator
-reserved_objects_marker(JSDHashTable *table, JSDHashEntryHdr *hdr,
+reserved_gcthings_marker(JSDHashTable *table, JSDHashEntryHdr *hdr,
                          uint32, void *)
 {
     JSThread *thread = ((JSThreadsHashEntry *) hdr)->thread;
 
-    MarkReservedObjects(&thread->data.traceMonitor);
+    MarkReservedGCThings(&thread->data.traceMonitor);
     return JS_DHASH_NEXT;
 }
 #endif
@@ -3101,12 +3115,12 @@ js_TraceRuntime(JSTracer *trc, JSBool allAtoms)
             JS_CALL_OBJECT_TRACER(trc, rt->builtinFunctions[i], "builtin function");
     }
 
-    /* Mark the reserved objects unless we are shutting down. */
+    /* Mark reserved gcthings unless we are shutting down. */
     if (IS_GC_MARKING_TRACER(trc) && rt->state != JSRTS_LANDING) {
 #ifdef JS_THREADSAFE
-        JS_DHashTableEnumerate(&rt->threads, reserved_objects_marker, NULL);
+        JS_DHashTableEnumerate(&rt->threads, reserved_gcthings_marker, NULL);
 #else
-        MarkReservedObjects(&rt->threadData.traceMonitor);
+        MarkReservedGCThings(&rt->threadData.traceMonitor);
 #endif
     }