diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp index bf3c2f74984..bcaf9ecbf98 100644 --- a/js/src/gc/Nursery.cpp +++ b/js/src/gc/Nursery.cpp @@ -492,6 +492,7 @@ js::Nursery::collect(JSRuntime *rt, JS::gcreason::Reason reason) comp->markAllInitialShapeTableEntries(&trc); } markStoreBuffer(&trc); + rt->newObjectCache.clearNurseryObjects(rt); /* * Most of the work is done here. This loop iterates over objects that have diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h index 918e7716340..2f5acb50937 100644 --- a/js/src/jscntxt.h +++ b/js/src/jscntxt.h @@ -338,6 +338,9 @@ class NewObjectCache NewObjectCache() { mozilla::PodZero(this); } void purge() { mozilla::PodZero(this); } + /* Remove any cached items keyed on moved objects. */ + inline void clearNurseryObjects(JSRuntime *rt); + /* * Get the entry index for the given lookup, return whether there was a hit * on an existing entry. diff --git a/js/src/jscntxtinlines.h b/js/src/jscntxtinlines.h index 6384cade797..1d15a4c5a6b 100644 --- a/js/src/jscntxtinlines.h +++ b/js/src/jscntxtinlines.h @@ -29,6 +29,15 @@ NewObjectCache::staticAsserts() JS_STATIC_ASSERT(gc::FINALIZE_OBJECT_LAST == gc::FINALIZE_OBJECT16_BACKGROUND); } +inline void +NewObjectCache::clearNurseryObjects(JSRuntime *rt) +{ + for (unsigned i = 0; i < mozilla::ArrayLength(entries); ++i) { + if (IsInsideNursery(rt, entries[i].key)) + mozilla::PodZero(&entries[i]); + } +} + inline bool NewObjectCache::lookup(Class *clasp, gc::Cell *key, gc::AllocKind kind, EntryIndex *pentry) {