diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp index 5d8fcfc7a12..cde23d5f1d8 100644 --- a/js/src/jit/IonCaches.cpp +++ b/js/src/jit/IonCaches.cpp @@ -1844,8 +1844,6 @@ bool GetPropertyParIC::update(ForkJoinContext *cx, size_t cacheIndex, HandleObject obj, MutableHandleValue vp) { - AutoFlushCache afc("GetPropertyParCache", cx->runtime()->jitRuntime()); - IonScript *ion = GetTopIonJSScript(cx)->parallelIonScript(); GetPropertyParIC &cache = ion->getCache(cacheIndex).toGetPropertyPar(); @@ -1864,6 +1862,9 @@ GetPropertyParIC::update(ForkJoinContext *cx, size_t cacheIndex, // new jitcode uses a global ExecutableAllocator tied to the runtime. LockedJSContext ncx(cx); + // The flusher needs to be under lock. + AutoFlushCache afc("GetPropertyParCache", cx->runtime()->jitRuntime()); + if (cache.canAttachStub()) { bool alreadyStubbed; if (!cache.hasOrAddStubbedShape(ncx, obj->lastProperty(), &alreadyStubbed)) @@ -2842,8 +2843,6 @@ SetPropertyParIC::update(ForkJoinContext *cx, size_t cacheIndex, HandleObject ob { JS_ASSERT(cx->isThreadLocal(obj)); - AutoFlushCache afc("SetPropertyParCache", cx->runtime()->jitRuntime()); - IonScript *ion = GetTopIonJSScript(cx)->parallelIonScript(); SetPropertyParIC &cache = ion->getCache(cacheIndex).toSetPropertyPar(); @@ -2860,7 +2859,9 @@ SetPropertyParIC::update(ForkJoinContext *cx, size_t cacheIndex, HandleObject ob bool attachedStub = false; { + // See note about locking context in GetPropertyParIC::update. LockedJSContext ncx(cx); + AutoFlushCache afc("SetPropertyParCache", cx->runtime()->jitRuntime()); if (cache.canAttachStub()) { bool alreadyStubbed; @@ -3940,8 +3941,6 @@ bool GetElementParIC::update(ForkJoinContext *cx, size_t cacheIndex, HandleObject obj, HandleValue idval, MutableHandleValue vp) { - AutoFlushCache afc("GetElementParCache", cx->runtime()->jitRuntime()); - IonScript *ion = GetTopIonJSScript(cx)->parallelIonScript(); GetElementParIC &cache = ion->getCache(cacheIndex).toGetElementPar(); @@ -3955,7 +3954,9 @@ GetElementParIC::update(ForkJoinContext *cx, size_t cacheIndex, HandleObject obj return true; { + // See note about locking context in GetPropertyParIC::update. LockedJSContext ncx(cx); + AutoFlushCache afc("GetElementParCache", cx->runtime()->jitRuntime()); if (cache.canAttachStub()) { bool alreadyStubbed;