Here are some updates the the rooting analysis to take care of a bunch of false positives. The following callees are ignored: js::ion::MDefinition.op - this is is a pure virtual. A macro generates trivial definitions which just return a constant js::ion::LInstruction.getDef - this is pure virtual with trivial implementation provided by LInstructionHelper js::ion::IonCache.kind - again it's virtual, implementations are generated by a macro and just return a constant js::GetWeakmapKeyDelegate - this calls the class' weakmapKeyDelegateOp for the argument object. This is called during weakmap marking, so must not GC The TokenStream class is now ignored. It's rooted by virtue of AutoKeepAtoms being present on the stack. The js::ctypes namespace is now recognised as being able to contain rooted types.

Comment on attachment 743143 [details] [diff] [review] Proposed changes Review of attachment 743143 [details] [diff] [review]: ----------------------------------------------------------------- The other changes look convincing. r+ for everything but GetWeakmapKeyDelegate. (I've been landing analysis changes with DONTBUILD, btw.) ::: js/src/devtools/rootAnalysis/annotations.js @@ +53,5 @@ > "nsAXPCNativeCallContext.GetJSContext" : true, > + "js::ion::MDefinition.op" : true, // macro generated virtuals just return a constant > + "js::ion::LInstruction.getDef" : true, // virtual but no implementation can GC > + "js::ion::IonCache.kind" : true, // macro generated virtuals just return a constant > + "js::GetWeakmapKeyDelegate" : true, // op is called in weakmap marking, so must not GC ignoreCallees (sorry, bad name) is only for FieldCalls. There's no '.' in js::GetWeakmapKeyDelegate, so it's in the wrong place. I assume you're talking about jsfriendapi.cpp's js::GetWeakmapKeyDelegate, which I already have in ignoreIndirectCalls, higher up: "JSObject* js::GetWeakmapKeyDelegate(JSObject*)" : true, // FIXME: mark with AutoAssertNoGC in\ Is that not working for you?

(In reply to Steve Fink [:sfink] from comment #1) > > ignoreCallees (sorry, bad name) is only for FieldCalls. There's no '.' in > js::GetWeakmapKeyDelegate, so it's in the wrong place. I assume you're > talking about jsfriendapi.cpp's js::GetWeakmapKeyDelegate, which I already > have in ignoreIndirectCalls, higher up: > > "JSObject* js::GetWeakmapKeyDelegate(JSObject*)" : true, // FIXME: mark > with AutoAssertNoGC in\ > > Is that not working for you? Ah, I didn't see that. Yes it's still showing up in the js analysis.