☠☠ backed out by d0fa5c45cabf ☠ ☠ | |
author | Steve Fink <sfink@mozilla.com> |
Wed, 01 May 2013 14:36:21 -0700 | |
changeset 150848 | 015a92e94c0713bdf60dc4b6e0a62699882c3b2f |
parent 150847 | 4546406915c1888356caac095999d46bb4d9e8cf |
child 150849 | e646195f32aea58681eb93eef3fe4dcc99579354 |
push id | 25469 |
push user | cbook@mozilla.com |
push date | Wed, 16 Oct 2013 10:46:01 +0000 |
treeherder | autoland@afae5911a1e0 [default view] [failures only] |
perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
reviewers | luke |
bugs | 861925 |
milestone | 27.0a1 |
first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
js/src/vm/StructuredClone.cpp | file | annotate | diff | comparison | revisions | |
js/src/vm/TypedArrayObject.cpp | file | annotate | diff | comparison | revisions |
--- a/js/src/vm/StructuredClone.cpp +++ b/js/src/vm/StructuredClone.cpp @@ -639,31 +639,32 @@ JSStructuredCloneWriter::parseTransferab if (JSVAL_IS_NULL(transferable) || JSVAL_IS_VOID(transferable)) return true; if (!transferable.isObject()) { reportErrorTransferable(); return false; } - RootedObject array(context(), &transferable.toObject()); - if (!JS_IsArrayObject(context(), array)) { + JSContext *cx = context(); + RootedObject array(cx, &transferable.toObject()); + if (!JS_IsArrayObject(cx, array)) { reportErrorTransferable(); return false; } uint32_t length; - if (!JS_GetArrayLength(context(), array, &length)) { + if (!JS_GetArrayLength(cx, array, &length)) { return false; } RootedValue v(context()); for (uint32_t i = 0; i < length; ++i) { - if (!JS_GetElement(context(), array, i, &v)) { + if (!JS_GetElement(cx, array, i, &v)) { return false; } if (!v.isObject()) { reportErrorTransferable(); return false; } @@ -893,35 +894,36 @@ JSStructuredCloneWriter::startWrite(cons JS_ReportErrorNumber(context(), js_GetErrorMessage, nullptr, JSMSG_SC_UNSUPPORTED_TYPE); return false; } bool JSStructuredCloneWriter::writeTransferMap() { - if (!transferableObjects.empty()) { - if (!out.writePair(SCTAG_TRANSFER_MAP_HEADER, (uint32_t)SCTAG_TM_NOT_MARKED)) + if (transferableObjects.empty()) + return true; + + if (!out.writePair(SCTAG_TRANSFER_MAP_HEADER, (uint32_t)SCTAG_TM_NOT_MARKED)) + return false; + + for (HashSet<JSObject*>::Range r = transferableObjects.all(); + !r.empty(); r.popFront()) { + JSObject *obj = r.front(); + + if (!memory.put(obj, memory.count())) return false; - for (HashSet<JSObject*>::Range r = transferableObjects.all(); - !r.empty(); r.popFront()) { - JSObject *obj = r.front(); - - if (!memory.put(obj, memory.count())) - return false; + void *content; + uint8_t *data; + if (!JS_StealArrayBufferContents(context(), obj, &content, &data)) + return false; - void *content; - uint8_t *data; - if (!JS_StealArrayBufferContents(context(), obj, &content, &data)) - return false; - - if (!out.writePair(SCTAG_TRANSFER_MAP, 0) || !out.writePtr(content)) - return false; - } + if (!out.writePair(SCTAG_TRANSFER_MAP, 0) || !out.writePtr(content)) + return false; } return true; } bool JSStructuredCloneWriter::write(const Value &v) {
--- a/js/src/vm/TypedArrayObject.cpp +++ b/js/src/vm/TypedArrayObject.cpp @@ -327,52 +327,52 @@ GetViewListRef(ArrayBufferObject *obj) { JS_ASSERT(obj->runtimeFromMainThread()->isHeapBusy()); return reinterpret_cast<OldObjectRepresentationHack*>(obj->getElementsHeader())->views; } void ArrayBufferObject::changeContents(JSContext *maybecx, ObjectElements *newHeader) { - // Grab out data before invalidating it. - uint32_t byteLengthCopy = byteLength(); - uintptr_t oldDataPointer = uintptr_t(dataPointer()); + // Grab out data before invalidating it. + uint32_t byteLengthCopy = byteLength(); + uintptr_t oldDataPointer = uintptr_t(dataPointer()); ArrayBufferViewObject *viewListHead = GetViewList(this); - // Update all views. - uintptr_t newDataPointer = uintptr_t(newHeader->elements()); + // Update all views. + uintptr_t newDataPointer = uintptr_t(newHeader->elements()); for (ArrayBufferViewObject *view = viewListHead; view; view = view->nextView()) { - uintptr_t newDataPtr = uintptr_t(view->getPrivate()) - oldDataPointer + newDataPointer; - view->setPrivate(reinterpret_cast<uint8_t*>(newDataPtr)); - - // Notify compiled jit code that the base pointer has moved. - if (maybecx) - MarkObjectStateChange(maybecx, view); - } + uintptr_t newDataPtr = uintptr_t(view->getPrivate()) - oldDataPointer + newDataPointer; + view->setPrivate(reinterpret_cast<uint8_t*>(newDataPtr)); + + // Notify compiled jit code that the base pointer has moved. + if (maybecx) + MarkObjectStateChange(maybecx, view); + } // Change to the new header (now, so we can use SetViewList). - elements = newHeader->elements(); - - // Initialize 'newHeader'. - ArrayBufferObject::setElementsHeader(newHeader, byteLengthCopy); + elements = newHeader->elements(); + + // Initialize 'newHeader'. + ArrayBufferObject::setElementsHeader(newHeader, byteLengthCopy); SetViewList(this, viewListHead); } bool ArrayBufferObject::uninlineData(JSContext *maybecx) { - if (hasDynamicElements()) - return true; - - ObjectElements *newHeader = AllocateArrayBufferContents(maybecx, byteLength(), dataPointer()); - if (!newHeader) - return false; - - changeContents(maybecx, newHeader); - return true; + if (hasDynamicElements()) + return true; + + ObjectElements *newHeader = AllocateArrayBufferContents(maybecx, byteLength(), dataPointer()); + if (!newHeader) + return false; + + changeContents(maybecx, newHeader); + return true; } #if defined(JS_ION) && defined(JS_CPU_X64) // To avoid dynamically checking bounds on each load/store, asm.js code relies // on the SIGSEGV handler in AsmJSSignalHandlers.cpp. However, this only works // if we can guarantee that *any* out-of-bounds access generates a fault. This // isn't generally true since an out-of-bounds access could land on other // Mozilla data. To overcome this on x64, we reserve an entire 4GB space, @@ -4256,18 +4256,18 @@ JS_GetObjectAsArrayBufferView(JSObject * ? obj->as<DataViewObject>().dataPointer() : obj->as<TypedArrayObject>().viewData()); return obj; } JS_FRIEND_API(JSObject *) JS_GetObjectAsArrayBuffer(JSObject *obj, uint32_t *length, uint8_t **data) { - if (!(obj = CheckedUnwrap(obj))) - return nullptr; + if (!(obj = CheckedUnwrap(obj))) + return nullptr; if (!obj->is<ArrayBufferObject>()) return nullptr; *length = obj->as<ArrayBufferObject>().byteLength(); *data = obj->as<ArrayBufferObject>().dataPointer(); return obj; }