Bug 886850 - Clean up write barriers for ion/baseline scripts, r=jandem.

js/src/jit/BaselineJIT.cpp

@@ -400,6 +400,16 @@ BaselineScript::trace(JSTracer *trc)
     }
 }
 
+/* static */
+void
+BaselineScript::writeBarrierPre(Zone *zone, BaselineScript *script)
+{
+#ifdef JSGC_INCREMENTAL
+    if (zone->needsBarrier())
+        script->trace(zone->barrierTracer());
+#endif
+}
+
 void
 BaselineScript::Trace(JSTracer *trc, BaselineScript *script)
 {
@@ -843,8 +853,9 @@ ion::FinishDiscardBaselineScript(FreeOp *fop, JSScript *script)
         return;
     }
 
-    BaselineScript::Destroy(fop, script->baselineScript());
+    BaselineScript *baseline = script->baselineScript();
     script->setBaselineScript(NULL);
+    BaselineScript::Destroy(fop, baseline);
 }
 
 void

js/src/jit/BaselineJIT.h

@@ -255,6 +255,8 @@ struct BaselineScript
     static size_t offsetOfFlags() {
         return offsetof(BaselineScript, flags_);
     }
+
+    static void writeBarrierPre(Zone *zone, BaselineScript *script);
 };
 
 inline bool

js/src/jit/CodeGenerator.cpp

@@ -29,6 +29,7 @@
 #include "vm/ForkJoin.h"
 
 #include "jsboolinlines.h"
+#include "jsscriptinlines.h"
 
 #include "jit/shared/CodeGenerator-shared-inl.h"
 #include "vm/Interpreter-inl.h"

js/src/jit/Ion.cpp

@@ -52,6 +52,7 @@
 #include "jscompartmentinlines.h"
 #include "jsgcinlines.h"
 #include "jsinferinlines.h"
+#include "jsscriptinlines.h"
 
 #include "vm/Shape-inl.h"
 
@@ -713,6 +714,15 @@ IonScript::trace(JSTracer *trc)
         gc::MarkScriptUnbarriered(trc, &callTargetList()[i], "callTarget");
 }
 
+/* static */ void
+IonScript::writeBarrierPre(Zone *zone, IonScript *ionScript)
+{
+#ifdef JSGC_INCREMENTAL
+    if (zone->needsBarrier())
+        ionScript->trace(zone->barrierTracer());
+#endif
+}
+
 void
 IonScript::copySnapshots(const SnapshotWriter *writer)
 {
@@ -2190,18 +2200,9 @@ ion::Invalidate(types::TypeCompartment &types, FreeOp *fop,
         JSScript *script = co.script;
         IonScript *ionScript = GetIonScript(script, executionMode);
 
-        Zone *zone = script->zone();
-        if (zone->needsBarrier()) {
-            // We're about to remove edges from the JSScript to gcthings
-            // embedded in the IonScript. Perform one final trace of the
-            // IonScript for the incremental GC, as it must know about
-            // those edges.
-            IonScript::Trace(zone->barrierTracer(), ionScript);
-        }
-
+        SetIonScript(script, executionMode, NULL);
         ionScript->detachDependentAsmJSModules(fop);
         ionScript->decref(fop);
-        SetIonScript(script, executionMode, NULL);
         co.invalidate();
 
         // Wait for the scripts to get warm again before doing another
@@ -2259,6 +2260,13 @@ ion::Invalidate(JSContext *cx, JSScript *script, bool resetUses)
 static void
 FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool parallel)
 {
+    // In all cases, NULL out script->ion or script->parallelIon to avoid
+    // re-entry.
+    if (parallel)
+        script->setParallelIonScript(NULL);
+    else
+        script->setIonScript(NULL);
+
     // If this script has Ion code on the stack, invalidation() will return
     // true. In this case we have to wait until destroying it.
     if (!ionScript->invalidated()) {
@@ -2267,13 +2275,6 @@ FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool p
 
         ion::IonScript::Destroy(fop, ionScript);
     }
-
-    // In all cases, NULL out script->ion or script->parallelIon to avoid
-    // re-entry.
-    if (parallel)
-        script->setParallelIonScript(NULL);
-    else
-        script->setIonScript(NULL);
 }
 
 void

js/src/jit/IonCode.h

@@ -537,6 +537,8 @@ struct IonScript
     void resetOsrPcMismatchCounter() {
         osrPcMismatchCounter_ = 0;
     }
+
+    static void writeBarrierPre(Zone *zone, IonScript *ionScript);
 };
 
 // Execution information for a basic block which may persist after the

js/src/jsscript.h

@@ -700,10 +700,7 @@ class JSScript : public js::gc::Cell
     js::ion::IonScript *const *addressOfIonScript() const {
         return &ion;
     }
-    void setIonScript(js::ion::IonScript *ionScript) {
-        ion = ionScript;
-        updateBaselineOrIonRaw();
-    }
+    inline void setIonScript(js::ion::IonScript *ionScript);
 
     bool hasBaselineScript() const {
         return baseline && baseline != BASELINE_DISABLED_SCRIPT;
@@ -715,10 +712,7 @@ class JSScript : public js::gc::Cell
         JS_ASSERT(hasBaselineScript());
         return baseline;
     }
-    void setBaselineScript(js::ion::BaselineScript *baselineScript) {
-        baseline = baselineScript;
-        updateBaselineOrIonRaw();
-    }
+    inline void setBaselineScript(js::ion::BaselineScript *baselineScript);
 
     void updateBaselineOrIonRaw();
 
@@ -741,9 +735,7 @@ class JSScript : public js::gc::Cell
     js::ion::IonScript *maybeParallelIonScript() const {
         return parallelIon;
     }
-    void setParallelIonScript(js::ion::IonScript *ionScript) {
-        parallelIon = ionScript;
-    }
+    inline void setParallelIonScript(js::ion::IonScript *ionScript);
 
     static size_t offsetOfBaselineScript() {
         return offsetof(JSScript, baseline);

js/src/jsscriptinlines.h

@@ -10,6 +10,7 @@
 #include "jsscript.h"
 
 #include "jit/AsmJSLink.h"
+#include "jit/BaselineJIT.h"
 #include "vm/ScopeObject.h"
 
 #include "jscompartmentinlines.h"
@@ -154,4 +155,29 @@ JSScript::setOriginalFunctionObject(JSObject *fun) {
     enclosingScopeOrOriginalFunction_ = fun;
 }
 
+inline void
+JSScript::setIonScript(js::ion::IonScript *ionScript) {
+    if (hasIonScript())
+        js::ion::IonScript::writeBarrierPre(tenuredZone(), ion);
+    ion = ionScript;
+    updateBaselineOrIonRaw();
+}
+
+inline void
+JSScript::setParallelIonScript(js::ion::IonScript *ionScript) {
+    if (hasParallelIonScript())
+        js::ion::IonScript::writeBarrierPre(tenuredZone(), parallelIon);
+    parallelIon = ionScript;
+}
+
+inline void
+JSScript::setBaselineScript(js::ion::BaselineScript *baselineScript) {
+#ifdef JS_ION
+    if (hasBaselineScript())
+        js::ion::BaselineScript::writeBarrierPre(tenuredZone(), baseline);
+#endif
+    baseline = baselineScript;
+    updateBaselineOrIonRaw();
+}
+
 #endif /* jsscriptinlines_h */