Bug 662132: Better coordination of GC and ICs, r=dvander

js/src/methodjit/PolyIC.cpp

@@ -146,10 +146,12 @@ class PICStubCompiler : public BaseCompiler
     JSScript *script;
     ic::PICInfo &pic;
     void *stub;
+    uint32 gcNumber;
 
   public:
     PICStubCompiler(const char *type, VMFrame &f, JSScript *script, ic::PICInfo &pic, void *stub)
-      : BaseCompiler(f.cx), type(type), f(f), script(script), pic(pic), stub(stub)
+      : BaseCompiler(f.cx), type(type), f(f), script(script), pic(pic), stub(stub),
+        gcNumber(f.cx->runtime->gcNumber)
     { }
 
     bool isCallOp() const {
@@ -175,6 +177,10 @@ class PICStubCompiler : public BaseCompiler
         return pic.disable(cx, reason, stub);
     }
 
+    bool hadGC() {
+        return gcNumber != f.cx->runtime->gcNumber;
+    }
+
   protected:
     void spew(const char *event, const char *op) {
 #ifdef JS_METHODJIT_SPEW
@@ -273,6 +279,9 @@ class SetPropCompiler : public PICStubCompiler
 
     LookupStatus generateStub(uint32 initialShape, const Shape *shape, bool adding, bool inlineSlot)
     {
+        if (hadGC())
+            return Lookup_Uncacheable;
+
         /* Exits to the slow path. */
         Vector<Jump, 8> slowExits(cx);
         Vector<Jump, 8> otherGuards(cx);
@@ -896,6 +905,8 @@ class GetPropCompiler : public PICStubCompiler
             return status;
         if (getprop.obj != getprop.holder)
             return disable("proto walk on String.prototype");
+        if (hadGC())
+            return Lookup_Uncacheable;
 
         Assembler masm;
 
@@ -1149,6 +1160,8 @@ class GetPropCompiler : public PICStubCompiler
         LookupStatus status = getprop.lookupAndTest();
         if (status != Lookup_Cacheable)
             return status;
+        if (hadGC())
+            return Lookup_Uncacheable;
 
         if (obj == getprop.holder && !pic.inlinePathPatched)
             return patchInline(getprop.holder, getprop.shape);