Slots/elements can be allocated in the nursery and moved by minor GCs. When this happens we have to update any slots/elements pointers stored in Ion frames to point to the new malloc'ed buffer. This patch tracks slots/elements pointers in safepoints, and updates them during minor GCs. This depends on Terrence's patch in bug 888463 and fixes Kraken.

Comment on attachment 769650 [details] [diff] [review] Patch Review of attachment 769650 [details] [diff] [review]: ----------------------------------------------------------------- The changes to Nursery look righteous. I'll leave the rest to David. r=me ::: js/src/ion/LIR.h @@ -542,5 @@ > #endif > case MIRType_Slots: > case MIRType_Elements: > - // When we begin allocating slots vectors from the GC, this will > - // need to change to ::OBJECT. Well, that was prescient at least.

Comment on attachment 769650 [details] [diff] [review] Patch Review of attachment 769650 [details] [diff] [review]: ----------------------------------------------------------------- Good catch. It's unfortunate we have to add all this extra complexity. It seems like a good long-term goal for the GC will be removing the distinctions between where GC objects are allocated.