From c1a8f61f0eb1bbd9d19d8bce77a52817bbbd9ff5 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Wed, 16 May 2012 13:56:42 -0700
Subject: [PATCH] Bug 754150 - Add write barrier on JITChunk (r=bhackett)

---
 js/src/jit-test/tests/basic/bug754150.js | 40 ++++++++++++++++++++++++
 js/src/methodjit/MethodJIT.cpp           | 11 ++++++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 js/src/jit-test/tests/basic/bug754150.js

diff --git a/js/src/jit-test/tests/basic/bug754150.js b/js/src/jit-test/tests/basic/bug754150.js
new file mode 100644
index 00000000000..9301ccc250f
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug754150.js
@@ -0,0 +1,40 @@
+// |jit-test| error: TypeError;
+function printStatus (msg) {}
+function toPrinted(value) {
+  value = value.replace(/\\n/g, 'NL')
+}
+function reportCompare (expected, actual, description) {
+    printStatus ("Expected value '" + toPrinted(expected) +  "' matched actual value '" + toPrinted(actual) + "'");
+}
+var UBound = 0;
+var statusitems = [];
+var actual = '';
+var actualvalues = [];
+var expect= '';
+var expectedvalues = [];
+testThis('x()');
+testThis('"abc"()');
+testThis('x()');
+testThis('Date(12345)()');
+testThis('x()');
+testThis('1()');
+testThis('x()');
+testThis('void(0)()');
+testThis('x()');
+testThis('[1,2,3,4,5](1)');
+gczeal(4);
+testThis('x(1)');
+checkThis('(function (y) {return y+1;})("abc")');
+checkThis('f("abc")');
+function testThis(sInvalidSyntax) {
+  expectedvalues[UBound] = expect;
+  actualvalues[UBound] = actual;
+  UBound++;
+}
+function checkThis(sValidSyntax) {
+  for (var i=0; i<UBound; i++)
+    reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);
+}
+var actualvalues = [];
+for (var i=0; i<UBound; i++)
+  reportCompare(expectedvalues[i], actualvalues[i], statusitems[i]);
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index 6833accf915..1637abb5dc9 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1302,6 +1302,13 @@ JITScript::destroyChunk(FreeOp *fop, unsigned chunkIndex, bool resetUses)
     ChunkDescriptor &desc = chunkDescriptor(chunkIndex);
 
     if (desc.chunk) {
+        /*
+         * Write barrier: Before we destroy the chunk, trace through the objects
+         * it holds.
+         */
+        if (script->compartment()->needsBarrier())
+            desc.chunk->trace(script->compartment()->barrierTracer());
+
         Probes::discardMJITCode(fop, this, desc.chunk, desc.chunk->code.m_code.executableAddress());
         fop->delete_(desc.chunk);
         desc.chunk = NULL;
@@ -1532,8 +1539,10 @@ void
 JITChunk::trace(JSTracer *trc)
 {
     JSObject **rootedTemplates_ = rootedTemplates();
-    for (size_t i = 0; i < nRootedTemplates; i++)
+    for (size_t i = 0; i < nRootedTemplates; i++) {
+        /* We use a manual write barrier in destroyChunk. */
         MarkObjectUnbarriered(trc, &rootedTemplates_[i], "jitchunk_template");
+    }
 }
 
 void