Bug 1124563 - Fixup base shape table after moving GC r=terrence

js/src/jit-test/tests/gc/bug-1124563.js

@@ -0,0 +1,4 @@
+try {
+    gc(0, 'shrinking')({x: 0})
+} catch (e) {}
+eval("({x: 0, x: 0})[{x: 0}]")

js/src/jsapi-tests/testGCNursery.cpp

@@ -60,6 +60,12 @@ static const js::Class NurseryClass = {
 
 BEGIN_TEST(testGCNurseryFinalizer)
 {
+#ifdef JS_GC_ZEAL
+    // Running extra GCs during this test will make us get incorrect
+    // finalization counts.
+    AutoLeaveZeal nozeal(cx);
+#endif /* JS_GC_ZEAL */
+
     JS::RootedObject obj(cx);
 
     obj = JS_NewObject(cx, Jsvalify(&TenuredClass), JS::NullPtr(), JS::NullPtr());

js/src/jscompartment.cpp

@@ -655,6 +655,7 @@ void JSCompartment::fixupAfterMovingGC()
     fixupNewTypeObjectTable(newTypeObjects);
     fixupNewTypeObjectTable(lazyTypeObjects);
     fixupInitialShapeTable();
+    fixupBaseShapeTable();
 }
 
 void

js/src/jscompartment.h

@@ -402,6 +402,7 @@ struct JSCompartment
     void fixupNewTypeObjectTable(js::types::NewTypeObjectTable &table);
     void fixupAfterMovingGC();
     void fixupGlobal();
+    void fixupBaseShapeTable();
 
     bool hasObjectMetadataCallback() const { return objectMetadataCallback; }
     void setObjectMetadataCallback(js::ObjectMetadataCallback callback);

js/src/vm/Shape.cpp

@@ -1361,19 +1361,53 @@ BaseShape::assertConsistency()
 #endif
 }
 
+bool
+BaseShape::fixupBaseShapeTableEntry()
+{
+    bool updated = false;
+    if (parent && IsForwarded(parent.get())) {
+        parent = Forwarded(parent.get());
+        updated = true;
+    }
+    if (metadata && IsForwarded(metadata.get())) {
+        metadata = Forwarded(metadata.get());
+        updated = true;
+    }
+    return updated;
+}
+
+void
+JSCompartment::fixupBaseShapeTable()
+{
+    if (!baseShapes.initialized())
+        return;
+
+    for (BaseShapeSet::Enum e(baseShapes); !e.empty(); e.popFront()) {
+        UnownedBaseShape *base = e.front().unbarrieredGet();
+        if (base->fixupBaseShapeTableEntry()) {
+            StackBaseShape sbase(base);
+            ReadBarriered<UnownedBaseShape *> b(base);
+            e.rekeyFront(&sbase, b);
+        }
+    }
+}
+
 void
 JSCompartment::sweepBaseShapeTable()
 {
-    if (baseShapes.initialized()) {
-        for (BaseShapeSet::Enum e(baseShapes); !e.empty(); e.popFront()) {
-            UnownedBaseShape *base = e.front().unbarrieredGet();
-            if (IsBaseShapeAboutToBeFinalizedFromAnyThread(&base)) {
-                e.removeFront();
-            } else if (base != e.front().unbarrieredGet()) {
-                StackBaseShape sbase(base);
-                ReadBarriered<UnownedBaseShape *> b(base);
-                e.rekeyFront(&sbase, b);
-            }
+    if (!baseShapes.initialized())
+        return;
+
+    for (BaseShapeSet::Enum e(baseShapes); !e.empty(); e.popFront()) {
+        UnownedBaseShape *base = e.front().unbarrieredGet();
+        MOZ_ASSERT_IF(base->getObjectParent(), !IsForwarded(base->getObjectParent()));
+        MOZ_ASSERT_IF(base->getObjectMetadata(), !IsForwarded(base->getObjectMetadata()));
+        if (IsBaseShapeAboutToBeFinalizedFromAnyThread(&base)) {
+            e.removeFront();
+        } else if (base != e.front().unbarrieredGet()) {
+            StackBaseShape sbase(base);
+            ReadBarriered<UnownedBaseShape *> b(base);
+            e.rekeyFront(&sbase, b);
         }
     }
 }

js/src/vm/Shape.h

@@ -533,6 +533,7 @@ class BaseShape : public gc::TenuredCell
     }
 
     void fixupAfterMovingGC();
+    bool fixupBaseShapeTableEntry();
 
   private:
     static void staticAsserts() {