Bug 966575 part 4.5 -- Pretenure type descriptors and things they can reach r=sfink

js/src/builtin/SIMD.cpp

@@ -204,7 +204,7 @@ CreateX4Class(JSContext *cx, Handle<GlobalObject*> global)
     // Create type constructor itself and initialize its reserved slots.
 
     Rooted<X4TypeDescr*> x4(cx);
-    x4 = NewObjectWithProto<X4TypeDescr>(cx, funcProto, global);
+    x4 = NewObjectWithProto<X4TypeDescr>(cx, funcProto, global, TenuredObject);
     if (!x4 || !InitializeCommonTypeDescriptorProperties(cx, x4, typeReprObj))
         return nullptr;
     x4->initReservedSlot(JS_DESCR_SLOT_TYPE_REPR, ObjectValue(*typeReprObj));

js/src/builtin/TypeRepresentation.cpp

@@ -396,7 +396,7 @@ TypeRepresentation::addToTableOrFree(JSContext *cx,
     // remove ourselves from the table ourselves and report an error.
     RootedObject ownerObject(cx);
     ownerObject = NewObjectWithGivenProto(cx, &class_, objectProto,
-                                          cx->global());
+                                          cx->global(), TenuredObject);
     if (!ownerObject) {
         comp->typeReprs.remove(this);
         js_free(this);

js/src/builtin/TypedObject.cpp

@@ -526,7 +526,8 @@ ArrayMetaTypeDescr::create(JSContext *cx,
 {
     JS_ASSERT(TypeRepresentation::isOwnerObject(*arrayTypeReprObj));
 
-    Rooted<T*> obj(cx, NewObjectWithProto<T>(cx, arrayTypePrototype, nullptr));
+    Rooted<T*> obj(cx, NewObjectWithProto<T>(cx, arrayTypePrototype, nullptr,
+                                             TenuredObject));
     if (!obj)
         return nullptr;
     obj->initReservedSlot(JS_DESCR_SLOT_TYPE_REPR,
@@ -811,10 +812,10 @@ StructMetaTypeDescr::layout(JSContext *cx,
     // fieldNames : [ string ]
     // fieldOffsets : { string: integer, ... }
     // fieldTypes : { string: Type, ... }
-    RootedObject fieldOffsets(
-        cx, NewObjectWithProto<JSObject>(cx, nullptr, nullptr));
-    RootedObject fieldTypes(
-        cx, NewObjectWithProto<JSObject>(cx, nullptr, nullptr));
+    RootedObject fieldOffsets(cx);
+    fieldOffsets = NewObjectWithProto<JSObject>(cx, nullptr, nullptr, TenuredObject);
+    RootedObject fieldTypes(cx);
+    fieldTypes = NewObjectWithProto<JSObject>(cx, nullptr, nullptr, TenuredObject);
     for (size_t i = 0; i < typeRepr->fieldCount(); i++) {
         const StructField &field = typeRepr->field(i);
         RootedId fieldId(cx, NameToId(field.propertyName));
@@ -858,7 +859,8 @@ StructMetaTypeDescr::create(JSContext *cx,
         return nullptr;
 
     Rooted<StructTypeDescr*> descr(cx);
-    descr = NewObjectWithProto<StructTypeDescr>(cx, structTypePrototype, nullptr);
+    descr = NewObjectWithProto<StructTypeDescr>(cx, structTypePrototype, nullptr,
+                                                TenuredObject);
     if (!descr)
         return nullptr;
 
@@ -969,7 +971,8 @@ DefineSimpleTypeDescr(JSContext *cx,
     RootedObject funcProto(cx, global->getOrCreateFunctionPrototype(cx));
     JS_ASSERT(funcProto);
 
-    Rooted<T*> numFun(cx, NewObjectWithProto<T>(cx, funcProto, global));
+    Rooted<T*> numFun(cx, NewObjectWithProto<T>(cx, funcProto, global,
+                                                TenuredObject));
     if (!numFun)
         return false;
 

js/src/jsinfer.cpp

@@ -4639,6 +4639,10 @@ TypeObject::addTypedObjectAddendum(JSContext *cx, Handle<TypeDescr*> descr)
     if (!cx->typeInferenceEnabled())
         return true;
 
+    // Type descriptors are always pre-tenured. This is both because
+    // we expect them to live a long time and so that they can be
+    // safely accessed during ion compilation.
+    JS_ASSERT(!IsInsideNursery(cx->runtime(), descr));
     JS_ASSERT(descr);
 
     if (flags() & OBJECT_FLAG_ADDENDUM_CLEARED)