Bug 875661 - Part 3: Add asserts to thread unsafe getters. (r=billm)

js/src/gc/Heap.h

@@ -28,6 +28,9 @@ struct JSRuntime;
 
 namespace js {
 
+// Defined in vm/ForkJoin.cpp
+extern bool InSequentialOrExclusiveParallelSection();
+
 class FreeOp;
 
 namespace gc {
@@ -87,6 +90,7 @@ static const size_t MAX_BACKGROUND_FINALIZE_KINDS = FINALIZE_LIMIT - FINALIZE_OB
  */
 struct Cell
 {
+  public:
     inline ArenaHeader *arenaHeader() const;
     inline AllocKind tenuredGetAllocKind() const;
     MOZ_ALWAYS_INLINE bool isMarked(uint32_t color = BLACK) const;
@@ -953,6 +957,7 @@ Cell::arenaHeader() const
 inline JSRuntime *
 Cell::runtime() const
 {
+    JS_ASSERT(InSequentialOrExclusiveParallelSection());
     return chunk()->info.runtime;
 }
 
@@ -990,6 +995,7 @@ Cell::unmark(uint32_t color) const
 Zone *
 Cell::tenuredZone() const
 {
+    JS_ASSERT(InSequentialOrExclusiveParallelSection());
     JS_ASSERT(isTenured());
     return arenaHeader()->zone;
 }

js/src/ion/ParallelFunctions.cpp

@@ -45,7 +45,7 @@ bool
 ion::ParWriteGuard(ForkJoinSlice *slice, JSObject *object)
 {
     JS_ASSERT(ForkJoinSlice::Current() == slice);
-    return !IsInsideNursery(object->runtime(), object) &&
+    return !IsInsideNursery(slice->runtime(), object) &&
            slice->allocator()->arenas.containsArena(slice->runtime(), object->arenaHeader());
 }
 

js/src/jscntxt.h

@@ -1562,7 +1562,12 @@ struct ThreadSafeContext : js::ContextFriendFields,
     static size_t offsetOfAllocator() { return offsetof(ThreadSafeContext, allocator_); }
 
     inline Allocator *const allocator();
-    inline AllowGC allowGC();
+
+    /* GC support. */
+    inline AllowGC allowGC() const;
+
+    template <typename T>
+    inline bool isInsideCurrentZone(T thing) const;
 
     void *onOutOfMemory(void *p, size_t nbytes) {
         return runtime_->onOutOfMemory(p, nbytes, isJSContext() ? asJSContext() : NULL);

js/src/jscntxtinlines.h

@@ -575,6 +575,13 @@ JSContext::setCompartment(JSCompartment *comp)
     allocator_ = zone_ ? &zone_->allocator : NULL;
 }
 
+template <typename T>
+inline bool
+js::ThreadSafeContext::isInsideCurrentZone(T thing) const
+{
+    return thing->isInsideZone(zone_);
+}
+
 #ifdef JSGC_GENERATIONAL
 inline bool
 js::ThreadSafeContext::hasNursery() const
@@ -598,9 +605,18 @@ js::ThreadSafeContext::allocator()
 }
 
 inline js::AllowGC
-js::ThreadSafeContext::allowGC()
+js::ThreadSafeContext::allowGC() const
 {
-    return isJSContext() ? CanGC : NoGC;
+    switch (contextKind_) {
+      case Context_JS:
+        return CanGC;
+      case Context_ForkJoin:
+        return NoGC;
+      default:
+        /* Silence warnings. */
+        JS_NOT_REACHED("Bad context kind");
+        return NoGC;
+    }
 }
 
 #endif /* jscntxtinlines_h */

js/src/vm/ForkJoin.cpp

@@ -120,6 +120,12 @@ ParallelBailoutRecord::addTrace(JSScript *script,
     JS_NOT_REACHED("Not THREADSAFE build");
 }
 
+bool
+js::InSequentialOrExclusiveParallelSection()
+{
+    return true;
+}
+
 bool
 js::ParallelTestsShouldPass(JSContext *cx)
 {
@@ -1651,7 +1657,8 @@ ForkJoinSlice::ForkJoinSlice(PerThreadData *perThreadData,
     sliceId(sliceId),
     numSlices(numSlices),
     bailoutRecord(bailoutRecord),
-    shared(shared)
+    shared(shared),
+    acquiredContext_(false)
 {
     /*
      * Unsafely set the zone. This is used to track malloc counters and to
@@ -1676,15 +1683,26 @@ ForkJoinSlice::runtime()
 JSContext *
 ForkJoinSlice::acquireContext()
 {
-    return shared->acquireContext();
+    JSContext *cx = shared->acquireContext();
+    JS_ASSERT(!acquiredContext_);
+    acquiredContext_ = true;
+    return cx;
 }
 
 void
 ForkJoinSlice::releaseContext()
 {
+    JS_ASSERT(acquiredContext_);
+    acquiredContext_ = false;
     return shared->releaseContext();
 }
 
+bool
+ForkJoinSlice::hasAcquiredContext() const
+{
+    return acquiredContext_;
+}
+
 bool
 ForkJoinSlice::check()
 {
@@ -2126,6 +2144,12 @@ parallel::SpewBailoutIR(uint32_t bblockId, uint32_t lirId,
 
 #endif // DEBUG
 
+bool
+js::InSequentialOrExclusiveParallelSection()
+{
+    return !InParallelSection() || ForkJoinSlice::Current()->hasAcquiredContext();
+}
+
 bool
 js::ParallelTestsShouldPass(JSContext *cx)
 {

js/src/vm/ForkJoin.h

@@ -346,6 +346,7 @@ struct ForkJoinSlice : ThreadSafeContext
     // Acquire and release the JSContext from the runtime.
     JSContext *acquireContext();
     void releaseContext();
+    bool hasAcquiredContext() const;
 
     // Check the current state of parallel execution.
     static inline ForkJoinSlice *Current();
@@ -364,6 +365,8 @@ struct ForkJoinSlice : ThreadSafeContext
 #endif
 
     ForkJoinShared *const shared;
+
+    bool acquiredContext_;
 };
 
 // Locks a JSContext for its scope. Be very careful, because locking a
@@ -413,6 +416,8 @@ InParallelSection()
 #endif
 }
 
+bool InSequentialOrExclusiveParallelSection();
+
 bool ParallelTestsShouldPass(JSContext *cx);
 
 ///////////////////////////////////////////////////////////////////////////

js/src/vm/ObjectImpl-inl.h

@@ -355,6 +355,7 @@ js::ObjectImpl::tenuredSizeOfThis() const
 JS_ALWAYS_INLINE JS::Zone *
 js::ObjectImpl::zone() const
 {
+    JS_ASSERT(InSequentialOrExclusiveParallelSection());
     return shape_->zone();
 }