Bug 524743 - Shape regeneration still does not touch most empty scopes. r=brendan.

--HG--
extra : rebase_source : 13a7f72bef38f2bfb8615a907c0cb47e31f55e1d

js/src/jscntxt.h

@@ -487,7 +487,7 @@ struct JSRuntime {
      *
      * FIXME Once scopes are GC'd (bug 505004), this will be obsolete.
      */
-    uint8              gcRegenShapesScopeFlag;
+    uint8               gcRegenShapesScopeFlag;
 
 #ifdef JS_GC_ZEAL
     jsrefcount          gcZeal;

js/src/jsgc.cpp

@@ -3124,7 +3124,11 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
      * Same for the protoHazardShape proxy-shape standing in for all object
      * prototypes having readonly or setter properties.
      */
-    if (rt->shapeGen & SHAPE_OVERFLOW_BIT) {
+    if (rt->shapeGen & SHAPE_OVERFLOW_BIT
+#ifdef JS_GC_ZEAL
+        || rt->gcZeal >= 1
+#endif
+        ) {
         rt->gcRegenShapes = true;
         rt->gcRegenShapesScopeFlag ^= JSScope::SHAPE_REGEN;
         rt->shapeGen = 0;

js/src/jsscope.cpp

@@ -1064,10 +1064,11 @@ JSScope::add(JSContext *cx, jsid id,
     JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, this));
     CHECK_ANCESTOR_LINE(this, true);
 
+    JS_ASSERT(!JSVAL_IS_NULL(id));
     JS_ASSERT_IF(attrs & JSPROP_GETTER, getter);
     JS_ASSERT_IF(attrs & JSPROP_SETTER, setter);
-
-    JS_ASSERT(!JSVAL_IS_NULL(id));
+    JS_ASSERT_IF(!cx->runtime->gcRegenShapes,
+                 hasRegenFlag(cx->runtime->gcRegenShapesScopeFlag));
 
     /*
      * You can't add properties to a sealed scope.  But note well that you can

js/src/jsscopeinlines.h

@@ -117,7 +117,7 @@ JSScope::trace(JSTracer *trc)
     JSContext *cx = trc->context;
     JSScopeProperty *sprop = lastProp;
     uint8 regenFlag = cx->runtime->gcRegenShapesScopeFlag;
-    if (IS_GC_MARKING_TRACER(trc) && cx->runtime->gcRegenShapes && hasRegenFlag(regenFlag)) {
+    if (IS_GC_MARKING_TRACER(trc) && cx->runtime->gcRegenShapes && !hasRegenFlag(regenFlag)) {
         /*
          * Either this scope has its own shape, which must be regenerated, or
          * it must have the same shape as lastProp.
@@ -140,7 +140,7 @@ JSScope::trace(JSTracer *trc)
 
         /* Also regenerate the shapes of empty scopes, in case they are not shared. */
         for (JSScope *empty = emptyScope;
-             empty && empty->hasRegenFlag(regenFlag);
+             empty && !empty->hasRegenFlag(regenFlag);
              empty = empty->emptyScope) {
             empty->shape = js_RegenerateShapeForGC(cx);
             empty->flags ^= JSScope::SHAPE_REGEN;

js/src/tests/js1_8_1/regress/jstests.list

@@ -80,3 +80,4 @@ script regress-507053.js
 script regress-507295.js
 script regress-507424.js
 script regress-515885.js
+script regress-524743.js

js/src/tests/js1_8_1/regress/regress-524743.js

@@ -0,0 +1,14 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+if (typeof gczeal != 'undefined')
+    gczeal(2);
+if (typeof gc != 'undefined') {
+    for (var i = 0; i < 10; i++) {
+        var obj = {};
+        for (var j = 0; j < 5; j++) {
+            obj[Math.floor(Math.random() * 5)] = 0;
+            gc();
+        }
+    }
+}
+reportCompare("no assertion failure", "no assertion failure", "bug 524743");