Improve dead compartment collection js/src/gc

js/src/gc/GCRuntime.h

@@ -900,7 +900,8 @@ class GCRuntime
 
     void requestMajorGC(JS::gcreason::Reason reason);
     SliceBudget defaultBudget(JS::gcreason::Reason reason, int64_t millis);
-    void budgetIncrementalGC(SliceBudget& budget, AutoLockForExclusiveAccess& lock);
+    void budgetIncrementalGC(JS::gcreason::Reason reason, SliceBudget& budget,
+							 AutoLockForExclusiveAccess& lock);
     void resetIncrementalGC(AbortReason reason, AutoLockForExclusiveAccess& lock);
 
     // Assert if the system state is such that we should never
@@ -915,6 +916,7 @@ class GCRuntime
     void collect(bool nonincrementalByAPI, SliceBudget budget, JS::gcreason::Reason reason) JS_HAZ_GC_CALL;
     MOZ_MUST_USE bool gcCycle(bool nonincrementalByAPI, SliceBudget& budget,
                               JS::gcreason::Reason reason);
+	bool shouldRepeatForDeadZone(JS::gcreason::Reason reason);
     void incrementalCollectSlice(SliceBudget& budget, JS::gcreason::Reason reason,
                                  AutoLockForExclusiveAccess& lock);
 

js/src/gc/RootMarking.cpp

@@ -478,6 +478,7 @@ js::gc::GCRuntime::bufferGrayRoots()
     for (GCZonesIter zone(rt); !zone.done(); zone.next())
         MOZ_ASSERT(zone->gcGrayRoots.empty());
 
+	gcstats::AutoPhase ap(stats, gcstats::PHASE_BUFFER_GRAY_ROOTS);
 
     BufferGrayRootsTracer grayBufferer(rt);
     if (JSTraceDataOp op = grayRootTracer.op)
@@ -540,4 +541,3 @@ GCRuntime::resetBufferedGrayRoots() const
     for (GCZonesIter zone(rt); !zone.done(); zone.next())
         zone->gcGrayRoots.clearAndFree();
 }
-

js/src/gc/Zone.cpp

@@ -370,6 +370,21 @@ Zone::fixupAfterMovingGC()
     fixupInitialShapeTable();
 }
 
+bool
+Zone::addTypeDescrObject(JSContext* cx, HandleObject obj)
+{
+	// Type descriptor objects are always tenured so we don't need post barriers
+	// on the set.
+	MOZ_ASSERT(!IsInsideNursery(obj));
+	
+	if (!typeDescrObjects.put(obj)) {
+		ReportOutOfMemory(cx);
+		return false;
+	}
+	
+	return true;
+}
+	
 ZoneList::ZoneList()
   : head(nullptr), tail(nullptr)
 {}

js/src/gc/Zone.h

@@ -349,11 +349,18 @@ struct Zone : public JS::shadow::Zone,
     // Keep track of all TypeDescr and related objects in this compartment.
     // This is used by the GC to trace them all first when compacting, since the
     // TypedObject trace hook may access these objects.
-    using TypeDescrObjectSet = js::GCHashSet<js::HeapPtr<JSObject*>,
+	
-                                             js::MovableCellHasher<js::HeapPtr<JSObject*>>,
+	 //
+	 // There are no barriers here - the set contains only tenured objects so no
+	 // post-barrier is required, and these are weak references so no pre-barrier
+	 // is required.
+    using TypeDescrObjectSet = js::GCHashSet<JSObject*,
+                                             js::MovableCellHasher<JSObject*>,
                                              js::SystemAllocPolicy>;
     JS::WeakCache<TypeDescrObjectSet> typeDescrObjects;
 	
+	bool addTypeDescrObject(JSContext* cx, HandleObject obj);
+
 
     // Malloc counter to measure memory pressure for GC scheduling. It runs from
     // gcMaxMallocBytes down to zero. This counter should be used only when it's