Bug 466747 - Flush fragments for a JSScript when it is destroyed, r=gal.

js/src/jsscript.cpp

@@ -60,6 +60,7 @@
 #include "jsparse.h"
 #include "jsscope.h"
 #include "jsscript.h"
+#include "jstracer.h"
 #if JS_HAS_XDR
 #include "jsxdrapi.h"
 #endif
@@ -1607,6 +1608,9 @@ js_DestroyScript(JSContext *cx, JSScript *script)
             JS_ASSERT(script->owner == cx->thread);
 #endif
             js_FlushPropertyCacheForScript(cx, script);
+#ifdef JS_TRACER
+            js_FlushScriptFragments(cx, script);
+#endif
         }
     }
 

js/src/jstracer.cpp

@@ -4588,6 +4588,20 @@ js_FlushJITOracle(JSContext* cx)
     oracle.clear();
 }
 
+extern JS_REQUIRES_STACK void
+js_FlushScriptFragments(JSContext* cx, JSScript* script)
+{
+    if (!TRACING_ENABLED(cx))
+        return;
+    debug_only_v(printf("Flushing fragments for script %p.\n", script);)
+    JSTraceMonitor* tm = &JS_TRACE_MONITOR(cx);
+    for (size_t i = 0; i < FRAGMENT_TABLE_SIZE; ++i) {
+        VMFragment *f = tm->vmfragments[i];
+        if (f && JS_UPTRDIFF(f->ip, script->code) < script->length)
+            tm->vmfragments[i] = NULL;
+    }
+}
+
 extern JS_REQUIRES_STACK void
 js_FlushJITCache(JSContext* cx)
 {

js/src/jstracer.h

@@ -601,6 +601,9 @@ js_InitJIT(JSTraceMonitor *tm);
 extern void
 js_FinishJIT(JSTraceMonitor *tm);
 
+extern void
+js_FlushScriptFragments(JSContext* cx, JSScript* script);
+
 extern void
 js_FlushJITCache(JSContext* cx);