Bug 1144920 - Move gray buffer clearing out of GCMarker

js/src/gc/GCRuntime.h

@@ -1022,8 +1022,16 @@ class GCRuntime
     };
     GrayBufferState grayBufferState;
     bool hasBufferedGrayRoots() const { return grayBufferState == GrayBufferState::Okay; }
+
+    // Clear each zone's gray buffers, but do not change the current state.
     void resetBufferedGrayRoots() const;
 
+    // Reset the gray buffering state to Unused.
+    void clearBufferedGrayRoots() {
+        grayBufferState = GrayBufferState::Unused;
+        resetBufferedGrayRoots();
+    }
+
     /*
      * The gray bits can become invalid if UnmarkGray overflows the stack. A
      * full GC will reset this bit, since it fills in all the gray bits.

js/src/gc/Tracer.cpp

@@ -547,9 +547,6 @@ GCMarker::stop()
 
     /* Free non-ballast stack memory. */
     stack.reset();
-
-    runtime()->gc.resetBufferedGrayRoots();
-    runtime()->gc.grayBufferState = GCRuntime::GrayBufferState::Unused;
 }
 
 void
@@ -643,6 +640,8 @@ GCMarker::checkZone(void* p)
 void
 GCRuntime::resetBufferedGrayRoots() const
 {
+    MOZ_ASSERT(grayBufferState != GrayBufferState::Okay,
+               "Do not clear the gray buffers unless we are Failed or becoming Unused");
     for (GCZonesIter zone(rt); !zone.done(); zone.next())
         zone->gcGrayRoots.clearAndFree();
 }

js/src/jsgc.cpp

@@ -5592,6 +5592,7 @@ GCRuntime::finishCollection(JS::gcreason::Reason reason)
 {
     MOZ_ASSERT(marker.isDrained());
     marker.stop();
+    clearBufferedGrayRoots();
 
     uint64_t currentTime = PRMJ_Now();
     schedulingState.updateHighFrequencyMode(lastGCTime, currentTime, tunables);
@@ -5712,6 +5713,7 @@ GCRuntime::resetIncrementalGC(const char* reason)
 
         marker.reset();
         marker.stop();
+        clearBufferedGrayRoots();
 
         for (GCCompartmentsIter c(rt); !c.done(); c.next())
             ResetGrayList(c);