Since web workers can move from one thread to another, and the old thread may disappear, it isn't valid to bake &JS_THREAD_DATA(cx)->interruptFlags into traces.

This is the simplest way to fix this.

That's an empty patch :)

It's a simple patch, but not that simple. I messed up when I split two changes apart.

I thought this was going to require an extra load per check, glad to see it doesn't!

Comment on attachment 499437 [details] [diff] [review] updated patch >From: Bill McCloskey <wmccloskey@mozilla.com> >try: -p linux,linux64,win32 > >diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp >--- a/js/src/jstracer.cpp >+++ b/js/src/jstracer.cpp >@@ -2345,17 +2345,22 @@ TraceRecorder::TraceRecorder(JSContext* > > if (fragment == fragment->root) { > /* > * We poll the operation callback request flag. It is updated asynchronously whenever > * the callback is to be invoked. We can use w.nameImmpNonGC here as JIT-ed code is per > * thread and cannot outlive the corresponding JSThreadData. > */ > w.comment("begin-interruptFlags-check"); >- LIns* flagptr = w.nameImmpNonGC((void *) &JS_THREAD_DATA(cx)->interruptFlags); >+#ifdef JS_THREADSAFE >+ void *interrupt = (void*) &cx->runtime->interruptCounter; >+#else >+ void *interrupt = (void*) &JS_THREAD_DATA(cx)->interruptFlags; >+#endif Add fixme bug 621140 about per-compartment flag here.