Bug 1620213 - Check malloc thresholds more often r=sfink

We currently account for this memory but we don't always trigger a GC based on it.

Differential Revision: https://phabricator.services.mozilla.com/D66637

--HG--
extra : moz-landing-system : lando

js/src/gc/ZoneAllocator.h

@@ -73,13 +73,14 @@ class ZoneAllocator : public JS::shadow::Zone,
   void addCellMemory(js::gc::Cell* cell, size_t nbytes, js::MemoryUse use) {
     MOZ_ASSERT(cell);
     MOZ_ASSERT(nbytes);
-    mallocHeapSize.addBytes(nbytes);
 
-    // We don't currently check GC triggers here.
+    mallocHeapSize.addBytes(nbytes);
 
 #ifdef DEBUG
     mallocTracker.trackGCMemory(cell, nbytes, use);
 #endif
+
+    maybeMallocTriggerZoneGC();
   }
 
   void removeCellMemory(js::gc::Cell* cell, size_t nbytes, js::MemoryUse use,
@@ -180,8 +181,8 @@ class ZoneAllocator : public JS::shadow::Zone,
   // the current GC.
   MainThreadData<size_t> gcDelayBytes;
 
-  // Amount of malloc data owned by GC things in this zone, including external
-  // allocations supplied by JS::AddAssociatedMemory.
+  // Amount of malloc data owned by tenured GC things in this zone, including
+  // external allocations supplied by JS::AddAssociatedMemory.
   gc::HeapSize mallocHeapSize;
 
   // Threshold used to trigger GC based on malloc allocations.

js/src/jit-test/tests/gc/bug-1620213.js

@@ -0,0 +1,3 @@
+for (var i = 0; i < 32768; i++) {
+  new ArrayBuffer(1024*1024);
+}

js/src/jsapi.cpp

@@ -1265,6 +1265,7 @@ JS_PUBLIC_API void JS::AddAssociatedMemory(JSObject* obj, size_t nbytes,
   }
 
   Zone* zone = obj->zone();
+  MOZ_ASSERT(!IsInsideNursery(obj));
   zone->addCellMemory(obj, nbytes, js::MemoryUse(use));
   zone->maybeMallocTriggerZoneGC();
 }