This includes 3 fixes: the first two hunks ensure that two allocation sites that flow into CompilerRoots are correctly tenured. The third hunk is to keep us from accessing the arena header of arbitrary objects that flow into parallel code: nursery things have no arena header.

Comment on attachment 746696 [details] [diff] [review] v0 Review of attachment 746696 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/builtin/ParallelArray.cpp @@ -115,5 @@ > /*static*/ JSObject * > ParallelArrayObject::newInstance(JSContext *cx) > { > gc::AllocKind kind = gc::GetGCObjectKind(NumFixedSlots); > - RootedObject result(cx, NewBuiltinClassInstance(cx, &class_, kind)); Actually I had a comment about this change: I believe this will cause *all* parallel arrays to be pre-tenured, which doesn't seem like the right thing to do. I imagine we should pass in the Tenured state to newInstance() as a parameter.

Green try at: https://tbpl.mozilla.org/?tree=Try&rev=ab2edeb50f5f Pushed at: https://hg.mozilla.org/integration/mozilla-inbound/rev/c61c7b28bace