Back out 11 changesets (bug 1063233 and bug 1063247)
authorWes Kocher <wkocher@mozilla.com>
Fri, 05 Sep 2014 17:42:45 -0700
changeset 203930 04be894027e67f704d9867a77ec6ee54a18da976
parent 203929 4914c31270255dd074d0b7c25859d353e68bb7ef
child 203931 d32d903d95a2a12fce567c215857ecb786b5a4de
push id48786
push userkwierso@gmail.com
push dateSat, 06 Sep 2014 00:43:17 +0000
treeherdermozilla-inbound@04be894027e6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1063233, 1063247
milestone35.0a1
backs out7c7c837585fb57adc6fc7ec5d6c6216bc3451b43
e584d23b3ce3f9fbe169577f085ed62c030af7d0
ee169ca2e00b387a93ea45173f9a24216aae9d5f
514c713b23137994c346bf274125c5b73b3a48f1
a6033944c4c17831e0ca9f07f99b5d80c9af94bb
c7ffa64956c6fbe1439c905fc3bae0ebe99c2df7
dd80b2984fe223054a6189175d4669c8cc09365f
1f6db27e62402d8d9037ee0b4c29a58f8328e5c1
b8e3d887faa2630462f97635fa2350115febfdf0
8e1913c0732254a014582bc901e9d2984d72af6c
04d42b23a489e8665987d93e14c69dc2bc2e36e1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Back out 11 changesets (bug 1063233 and bug 1063247) * * * Backed out changeset 7c7c837585fb (bug 1063233) * * * Backed out changeset e584d23b3ce3 (bug 1063233) * * * Backed out changeset ee169ca2e00b (bug 1063247) * * * Backed out changeset 514c713b2313 (bug 1063247) * * * Backed out 3 changesets (bug 1063247) Backed out changeset a6033944c4c1 (bug 1063247) Backed out changeset c7ffa64956c6 (bug 1063247) Backed out changeset dd80b2984fe2 (bug 1063247) * * * Backed out 4 changesets (bug 1063233) Backed out changeset 1f6db27e6240 (bug 1063233) Backed out changeset b8e3d887faa2 (bug 1063233) Backed out changeset 8e1913c07322 (bug 1063233) Backed out changeset 04d42b23a489 (bug 1063233)
js/public/Debug.h
js/public/UbiNode.h
js/src/builtin/TestingFunctions.cpp
js/src/configure.in
js/src/jsinfer.cpp
js/src/jsinfer.h
js/src/jsscript.cpp
js/src/jsscript.h
js/src/shell/js.cpp
js/src/vm/DebuggerMemory.cpp
js/src/vm/Runtime.cpp
js/src/vm/Runtime.h
js/src/vm/Shape.cpp
js/src/vm/Shape.h
js/src/vm/UbiNode.cpp
--- a/js/public/Debug.h
+++ b/js/public/Debug.h
@@ -6,17 +6,16 @@
 
 // Interfaces by which the embedding can interact with the Debugger API.
 
 #ifndef js_Debug_h
 #define js_Debug_h
 
 #include "mozilla/Assertions.h"
 #include "mozilla/Attributes.h"
-#include "mozilla/MemoryReporting.h"
 #include "mozilla/Move.h"
 
 #include "jspubtd.h"
 
 #include "js/RootingAPI.h"
 #include "js/TypeDecls.h"
 
 namespace js {
@@ -245,26 +244,13 @@ class BuilderOrigin : public Builder {
   public:
     BuilderOrigin(JSContext *cx, js::Debugger *debugger_)
       : Builder(cx, debugger_)
     { }
 
     JSObject *unwrap(Object &object) { return unwrapAny(object); }
 };
 
-
-// Finding the size of blocks allocated with malloc
-// ------------------------------------------------
-//
-// Debugger.Memory wants to be able to report how many bytes items in memory are
-// consuming. To do this, it needs a function that accepts a pointer to a block,
-// and returns the number of bytes allocated to that block. SpiderMonkey itself
-// doesn't know which function is appropriate to use, but the embedding does.
-
-// Tell Debuggers in |runtime| to use |mallocSizeOf| to find the size of
-// malloc'd blocks.
-void SetDebuggerMallocSizeOf(JSRuntime *runtime, mozilla::MallocSizeOf mallocSizeOf);
-
 } // namespace dbg
 } // namespace JS
 
 
 #endif /* js_Debug_h */
--- a/js/public/UbiNode.h
+++ b/js/public/UbiNode.h
@@ -5,17 +5,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef js_UbiNode_h
 #define js_UbiNode_h
 
 #include "mozilla/Alignment.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/Attributes.h"
-#include "mozilla/MemoryReporting.h"
 #include "mozilla/Move.h"
 
 #include "jspubtd.h"
 
 #include "js/GCAPI.h"
 #include "js/HashTable.h"
 #include "js/TypeDecls.h"
 
@@ -133,19 +132,25 @@
 //
 // If this restriction prevents us from implementing interesting tools, we may
 // teach the GC how to root ubi::Nodes, fix up hash tables that use them as
 // keys, etc.
 
 
 // Forward declarations of SpiderMonkey's ubi::Node reference types.
 namespace js {
+class LazyScript;
+class Shape;
+class BaseShape;
 namespace jit {
 class JitCode;
 }
+namespace types {
+struct TypeObject;
+}
 }
 
 
 namespace JS {
 namespace ubi {
 
 class Edge;
 class EdgeRange;
@@ -182,19 +187,17 @@ class Base {
     // be statically allocated. (You can use MOZ_UTF16("strings") for this.)
     //
     // This must always return Concrete<T>::concreteTypeName; we use that
     // pointer as a tag for this particular referent type.
     virtual const jschar *typeName() const = 0;
 
     // Return the size of this node, in bytes. Include any structures that this
     // node owns exclusively that are not exposed as their own ubi::Nodes.
-    // |mallocSizeOf| should be a malloc block sizing function; see
-    // |mfbt/MemoryReporting.h.
-    virtual size_t size(mozilla::MallocSizeOf mallocSizeof) const = 0;
+    virtual size_t size() const = 0;
 
     // Return an EdgeRange that initially contains all the referent's outgoing
     // edges. The EdgeRange should be freed with 'js_delete'. (You could use
     // ScopedDJSeletePtr<EdgeRange> to manage it.) On OOM, report an exception
     // on |cx| and return nullptr.
     //
     // If wantNames is true, compute names for edges. Doing so can be expensive
     // in time and memory.
@@ -277,17 +280,17 @@ class Node {
     }
     template<typename T>
     Node &operator=(const Rooted<T *> &root) {
         construct(root.get());
         return *this;
     }
 
     // Constructors accepting SpiderMonkey's other generic-pointer-ish types.
-    Node(JS::HandleValue value);
+    explicit Node(JS::Value value);
     Node(JSGCTraceKind kind, void *ptr);
 
     // copy construction and copy assignment just use memcpy, since we know
     // instances contain nothing but a vtable pointer and a data pointer.
     //
     // To be completely correct, concrete classes could provide a virtual
     // 'construct' member function, which we could invoke on rhs to construct an
     // instance in our storage. But this is good enough; there's no need to jump
@@ -327,23 +330,19 @@ class Node {
 
     // If this node refers to something that can be represented as a JavaScript
     // value that is safe to expose to JavaScript code, return that value.
     // Otherwise return UndefinedValue(). JSStrings, JS::Symbols, and some (but
     // not all!) JSObjects can be exposed.
     JS::Value exposeToJS() const;
 
     const jschar *typeName()        const { return base()->typeName(); }
+    size_t size()                   const { return base()->size(); }
     JS::Zone *zone()                const { return base()->zone(); }
     JSCompartment *compartment()    const { return base()->compartment(); }
-
-    size_t size(mozilla::MallocSizeOf mallocSizeof) const {
-        return base()->size(mallocSizeof);
-    }
-
     EdgeRange *edges(JSContext *cx, bool wantNames = true) const {
         return base()->edges(cx, wantNames);
     }
 
     // A hash policy for ubi::Nodes.
     // This simply uses the stock PointerHasher on the ubi::Node's pointer.
     // We specialize DefaultHasher below to make this the default.
     class HashPolicy {
@@ -429,19 +428,17 @@ class EdgeRange {
 
 // Concrete classes for ubi::Node referent types.
 
 // A reusable ubi::Concrete specialization base class for types supported by
 // JS_TraceChildren.
 template<typename Referent>
 class TracerConcrete : public Base {
     const jschar *typeName() const MOZ_OVERRIDE { return concreteTypeName; }
-    size_t size(mozilla::MallocSizeOf mallocSizeof) const MOZ_OVERRIDE {
-        return 0; // not implemented yet; bug 1011300
-    }
+    size_t size() const MOZ_OVERRIDE { return 0; } // not implemented yet; bug 1011300
     EdgeRange *edges(JSContext *, bool wantNames) const MOZ_OVERRIDE;
     JS::Zone *zone() const MOZ_OVERRIDE { return get().zone(); }
     JSCompartment *compartment() const MOZ_OVERRIDE { return nullptr; }
 
   protected:
     explicit TracerConcrete(Referent *ptr) : Base(ptr) { }
     Referent &get() const { return *static_cast<Referent *>(ptr); }
 
@@ -465,23 +462,27 @@ class TracerConcreteWithCompartment : pu
         new (storage) TracerConcreteWithCompartment(ptr);
     }
 };
 
 template<> struct Concrete<JSObject> : TracerConcreteWithCompartment<JSObject> { };
 template<> struct Concrete<JSString> : TracerConcrete<JSString> { };
 template<> struct Concrete<JS::Symbol> : TracerConcrete<JS::Symbol> { };
 template<> struct Concrete<JSScript> : TracerConcreteWithCompartment<JSScript> { };
+template<> struct Concrete<js::LazyScript> : TracerConcrete<js::LazyScript> { };
 template<> struct Concrete<js::jit::JitCode> : TracerConcrete<js::jit::JitCode> { };
+template<> struct Concrete<js::Shape> : TracerConcreteWithCompartment<js::Shape> { };
+template<> struct Concrete<js::BaseShape> : TracerConcreteWithCompartment<js::BaseShape> { };
+template<> struct Concrete<js::types::TypeObject> : TracerConcrete<js::types::TypeObject> { };
 
 // The ubi::Node null pointer. Any attempt to operate on a null ubi::Node asserts.
 template<>
 class Concrete<void> : public Base {
     const jschar *typeName() const MOZ_OVERRIDE;
-    size_t size(mozilla::MallocSizeOf mallocSizeOf) const MOZ_OVERRIDE;
+    size_t size() const MOZ_OVERRIDE;
     EdgeRange *edges(JSContext *cx, bool wantNames) const MOZ_OVERRIDE;
     JS::Zone *zone() const MOZ_OVERRIDE;
     JSCompartment *compartment() const MOZ_OVERRIDE;
 
     explicit Concrete(void *ptr) : Base(ptr) { }
 
   public:
     static void construct(void *storage, void *ptr) { new (storage) Concrete(ptr); }
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -1987,29 +1987,16 @@ IsSimdAvailable(JSContext *cx, unsigned 
     bool available = false;
 #else
     bool available = cx->jitSupportsSimd();
 #endif
     args.rval().set(BooleanValue(available));
     return true;
 }
 
-static bool
-ByteSize(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    mozilla::MallocSizeOf mallocSizeOf = cx->runtime()->debuggerMallocSizeOf;
-    JS::ubi::Node node = args.get(0);
-    if (node)
-        args.rval().set(NumberValue(node.size(mallocSizeOf)));
-    else
-        args.rval().setUndefined();
-    return true;
-}
-
 static const JSFunctionSpecWithHelp TestingFunctions[] = {
     JS_FN_HELP("gc", ::GC, 0, 0,
 "gc([obj] | 'compartment')",
 "  Run the garbage collector. When obj is given, GC only its compartment.\n"
 "  If 'compartment' is given, GC any compartments that were scheduled for\n"
 "  GC via schedulegc."),
 
     JS_FN_HELP("minorgc", ::MinorGC, 0, 0,
@@ -2320,21 +2307,16 @@ static const JSFunctionSpecWithHelp Test
     JS_FN_HELP("getBacktrace", GetBacktrace, 1, 0,
 "getBacktrace([options])",
 "  Return the current stack as a string. Takes an optional options object,\n"
 "  which may contain any or all of the boolean properties\n"
 "    options.args - show arguments to each function\n"
 "    options.locals - show local variables in each frame\n"
 "    options.thisprops - show the properties of the 'this' object of each frame\n"),
 
-    JS_FN_HELP("byteSize", ByteSize, 1, 0,
-"byteSize(value)",
-"  Return the size in bytes occupied by |value|, or |undefined| if value\n"
-"  is not allocated in memory.\n"),
-
     JS_FS_HELP_END
 };
 
 static const JSPropertySpec TestingProperties[] = {
     JS_PSG("timesAccessed", TimesAccessed, 0),
     JS_PS_END
 };
 
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -3909,18 +3909,18 @@ dnl top-level configure may override thi
 MOZ_CONFIG_ICU()
 
 MOZ_SUBCONFIGURE_ICU()
 
 dnl ========================================================
 dnl JavaScript shell
 dnl ========================================================
 
-AC_CHECK_HEADERS(malloc.h)
-AC_CHECK_FUNCS(setlocale localeconv malloc_usable_size)
+AC_HAVE_FUNCS(setlocale)
+AC_HAVE_FUNCS(localeconv)
 
 AC_SUBST(MOZILLA_VERSION)
 
 AC_SUBST(ac_configure_args)
 
 AC_SUBST(TOOLCHAIN_PREFIX)
 
 if test -n "$JS_STANDALONE"; then
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1042,19 +1042,16 @@ TypeObjectKey::ensureTrackedProperty(JSC
         JS_ASSERT(CurrentThreadCanAccessRuntime(cx->runtime()));
         if (JSObject *obj = singleton()) {
             if (obj->isNative() && obj->nativeLookupPure(id))
                 EnsureTrackPropertyTypes(cx, obj, id);
         }
     }
 }
 
-template<> const jschar JS::ubi::TracerConcrete<TypeObject>::concreteTypeName[] =
-    MOZ_UTF16("js::types::TypeObject");
-
 bool
 HeapTypeSetKey::instantiate(JSContext *cx)
 {
     if (maybeTypes())
         return true;
     if (object()->isSingleObject() && !object()->asSingleObject()->getType(cx)) {
         cx->clearPendingException();
         return false;
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -16,17 +16,16 @@
 #include "jsfriendapi.h"
 #include "jstypes.h"
 
 #include "ds/IdValuePair.h"
 #include "ds/LifoAlloc.h"
 #include "gc/Barrier.h"
 #include "gc/Marking.h"
 #include "jit/IonTypes.h"
-#include "js/UbiNode.h"
 #include "js/Utility.h"
 #include "js/Vector.h"
 
 namespace js {
 
 class TypeDescr;
 
 class TaggedProto
@@ -1719,20 +1718,9 @@ inline const char * TypeObjectString(Typ
 #endif
 
 /* Print a warning, dump state and abort the program. */
 MOZ_NORETURN void TypeFailure(JSContext *cx, const char *fmt, ...);
 
 } /* namespace types */
 } /* namespace js */
 
-namespace JS {
-namespace ubi {
-// JS::ubi::Node can trace TypeObjects using JS_TraceChildren, and TypeObject
-// instances don't belong to any particular compartment, so we can use the
-// generic JS::ubi::TracerConcrete template for their JS::ubi::Concrete
-// specialization.
-template<> struct Concrete<js::types::TypeObject> : TracerConcrete<js::types::TypeObject> { };
-}
-}
-
-
 #endif /* jsinfer_h */
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -3747,19 +3747,16 @@ LazyScript::staticLevel(JSContext *cx) c
 {
     for (StaticScopeIter<NoGC> ssi(enclosingScope()); !ssi.done(); ssi++) {
         if (ssi.type() == StaticScopeIter<NoGC>::FUNCTION)
             return ssi.funScript()->staticLevel() + 1;
     }
     return 1;
 }
 
-template<> const jschar JS::ubi::TracerConcrete<LazyScript>::concreteTypeName[] =
-    MOZ_UTF16("js::LazyScript");
-
 void
 JSScript::updateBaselineOrIonRaw()
 {
     if (hasIonScript()) {
         baselineOrIonRaw = ion->method()->raw();
         baselineOrIonSkipArgCheck = ion->method()->raw() + ion->getSkipArgCheckEntryOffset();
     } else if (hasBaselineScript()) {
         baselineOrIonRaw = baseline->method()->raw();
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -17,17 +17,16 @@
 #include "jslock.h"
 #include "jsobj.h"
 #include "jsopcode.h"
 #include "jstypes.h"
 
 #include "gc/Barrier.h"
 #include "gc/Rooting.h"
 #include "jit/IonCode.h"
-#include "js/UbiNode.h"
 #include "vm/Shape.h"
 
 namespace JS {
 struct ScriptSourceInfo;
 }
 
 namespace js {
 
@@ -2033,20 +2032,9 @@ CloneFunctionScript(JSContext *cx, Handl
 static inline JSPrincipals *
 NormalizeOriginPrincipals(JSPrincipals *principals, JSPrincipals *originPrincipals)
 {
     return originPrincipals ? originPrincipals : principals;
 }
 
 } /* namespace js */
 
-namespace JS {
-namespace ubi {
-
-// A LazyScript can be traced with JS_TraceChildren, and belongs to no
-// particular compartment, so we can use the generic JS::ubi::TracerConcrete
-// template for LazyScript's JS::ubi::Concrete specialization..
-template<> struct Concrete<js::LazyScript> : TracerConcrete<js::LazyScript> { };
-
-} // namespace ubi
-} // namespace JS
-
 #endif /* jsscript_h */
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -16,19 +16,16 @@
 # include <process.h>
 #endif
 #include <errno.h>
 #include <fcntl.h>
 #if defined(XP_WIN)
 # include <io.h>     /* for isatty() */
 #endif
 #include <locale.h>
-#ifdef HAVE_MALLOC_H
-#include <malloc.h>
-#endif
 #include <math.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #ifdef XP_UNIX
@@ -54,17 +51,16 @@
 #endif
 #include "jswrapper.h"
 #include "prmjtime.h"
 
 #include "builtin/TestingFunctions.h"
 #include "frontend/Parser.h"
 #include "jit/arm/Simulator-arm.h"
 #include "jit/Ion.h"
-#include "js/Debug.h"
 #include "js/OldDebugAPI.h"
 #include "js/StructuredClone.h"
 #include "perf/jsperf.h"
 #include "shell/jsheaptools.h"
 #include "shell/jsoptparse.h"
 #include "vm/ArgumentsObject.h"
 #include "vm/Debugger.h"
 #include "vm/HelperThreads.h"
@@ -5994,31 +5990,16 @@ MaybeOverrideOutFileFromEnv(const char* 
 
 /* Pretend we can always preserve wrappers for dummy DOM objects. */
 static bool
 DummyPreserveWrapperCallback(JSContext *cx, JSObject *obj)
 {
     return true;
 }
 
-size_t
-ShellMallocSizeOf(const void *ptr)
-{
-    if (!ptr)
-        return 0;
-
-#if defined(HAVE_MALLOC_USABLE_SIZE)
-    return malloc_usable_size((void *) ptr);
-#elif defined(HAVE_MALLOC_SIZE)
-    return malloc_size((void *) ptr);
-#else
-    return 0;
-#endif
-}
-
 int
 main(int argc, char **argv, char **envp)
 {
     sArgc = argc;
     sArgv = argv;
 
     JSRuntime *rt;
     JSContext *cx;
@@ -6256,18 +6237,16 @@ main(int argc, char **argv, char **envp)
     JS_SetSecurityCallbacks(rt, &ShellPrincipals::securityCallbacks);
     JS_InitDestroyPrincipalsCallback(rt, ShellPrincipals::destroy);
 
     JS_SetInterruptCallback(rt, ShellInterruptCallback);
     JS::SetAsmJSCacheOps(rt, &asmJSCacheOps);
 
     JS_SetNativeStackQuota(rt, gMaxStackSize);
 
-    JS::dbg::SetDebuggerMallocSizeOf(rt, ShellMallocSizeOf);
-
     if (!offThreadState.init())
         return 1;
 
     if (!InitWatchdog(rt))
         return 1;
 
     cx = NewContext(rt);
     if (!cx)
--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@@ -10,17 +10,16 @@
 #include "mozilla/Move.h"
 #include "mozilla/Vector.h"
 
 #include <stdlib.h>
 
 #include "jscompartment.h"
 
 #include "gc/Marking.h"
-#include "js/Debug.h"
 #include "js/UbiNode.h"
 #include "js/UbiNodeTraverse.h"
 #include "vm/Debugger.h"
 #include "vm/GlobalObject.h"
 #include "vm/SavedStacks.h"
 
 #include "vm/Debugger-inl.h"
 
@@ -245,21 +244,16 @@ DebuggerMemory::setMaxAllocationsLogLeng
     args.rval().setUndefined();
     return true;
 }
 
 
 
 /* Debugger.Memory.prototype.takeCensus */
 
-void
-JS::dbg::SetDebuggerMallocSizeOf(JSRuntime *rt, mozilla::MallocSizeOf mallocSizeOf) {
-    rt->debuggerMallocSizeOf = mallocSizeOf;
-}
-
 namespace js {
 namespace dbg {
 
 // Common data for census traversals.
 struct Census {
     JSContext * const cx;
     Zone::ZoneSet debuggeeZones;
     Zone *atomsZone;
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -116,22 +116,16 @@ PerThreadData::init()
     return true;
 }
 
 static const JSWrapObjectCallbacks DefaultWrapObjectCallbacks = {
     TransparentObjectWrapper,
     nullptr
 };
 
-static size_t
-ReturnZeroSize(const void *p)
-{
-    return 0;
-}
-
 JSRuntime::JSRuntime(JSRuntime *parentRuntime)
   : JS::shadow::Runtime(
 #ifdef JSGC_GENERATIONAL
         &gc.storeBuffer
 #endif
     ),
     mainThread(this),
     parentRuntime(parentRuntime),
@@ -224,18 +218,17 @@ JSRuntime::JSRuntime(JSRuntime *parentRu
     ctypesActivityCallback(nullptr),
     forkJoinWarmup(0),
     offthreadIonCompilationEnabled_(true),
     parallelParsingEnabled_(true),
 #ifdef DEBUG
     enteredPolicy(nullptr),
 #endif
     largeAllocationFailureCallback(nullptr),
-    oomCallback(nullptr),
-    debuggerMallocSizeOf(ReturnZeroSize)
+    oomCallback(nullptr)
 {
     liveRuntimesCount++;
 
     /* Initialize infallibly first, so we can goto bad and JS_DestroyRuntime. */
     JS_INIT_CLIST(&onNewGlobalObjectWatchers);
 
     PodArrayZero(nativeStackQuota);
     PodZero(&asmJSCacheOps);
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -1422,22 +1422,16 @@ struct JSRuntime : public JS::shadow::Ru
         if (MOZ_LIKELY(!!p2))
             return p2;
         if (newSize & mozilla::tl::MulOverflowMask<sizeof(T)>::value) {
             reportAllocationOverflow();
             return nullptr;
         }
         return (T *)onOutOfMemoryCanGC(p, newSize * sizeof(T));
     }
-
-    /*
-     * Debugger.Memory functions like takeCensus use this embedding-provided
-     * function to assess the size of malloc'd blocks of memory.
-     */
-    mozilla::MallocSizeOf debuggerMallocSizeOf;
 };
 
 namespace js {
 
 // When entering JIT code, the calling JSContext* is stored into the thread's
 // PerThreadData. This function retrieves the JSContext with the pre-condition
 // that the caller is JIT code or C++ called directly from JIT code. This
 // function should not be called from arbitrary locations since the JSContext
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1433,19 +1433,16 @@ Shape::setObjectFlag(ExclusiveContext *c
 
     StackBaseShape base(last);
     base.flags |= flag;
 
     RootedShape lastRoot(cx, last);
     return replaceLastProperty(cx, base, proto, lastRoot);
 }
 
-template<> const jschar JS::ubi::TracerConcrete<Shape>::concreteTypeName[] =
-    MOZ_UTF16("js::Shape");
-
 /* static */ inline HashNumber
 StackBaseShape::hash(const StackBaseShape *base)
 {
     HashNumber hash = base->flags;
     hash = RotateLeft(hash, 4) ^ (uintptr_t(base->clasp) >> 3);
     hash = RotateLeft(hash, 4) ^ (uintptr_t(base->parent) >> 3);
     hash = RotateLeft(hash, 4) ^ (uintptr_t(base->metadata) >> 3);
     hash = RotateLeft(hash, 4) ^ uintptr_t(base->rawGetter);
@@ -1567,19 +1564,16 @@ void
 BaseShape::finalize(FreeOp *fop)
 {
     if (table_) {
         fop->delete_(table_);
         table_ = nullptr;
     }
 }
 
-template<> const jschar JS::ubi::TracerConcrete<BaseShape>::concreteTypeName[] =
-    MOZ_UTF16("js::BaseShape");
-
 inline
 InitialShapeEntry::InitialShapeEntry() : shape(nullptr), proto(nullptr)
 {
 }
 
 inline
 InitialShapeEntry::InitialShapeEntry(const ReadBarrieredShape &shape, TaggedProto proto)
   : shape(shape), proto(proto)
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -23,17 +23,16 @@
 
 #include "gc/Barrier.h"
 #include "gc/Heap.h"
 #include "gc/Marking.h"
 #include "gc/Rooting.h"
 #include "js/HashTable.h"
 #include "js/MemoryMetrics.h"
 #include "js/RootingAPI.h"
-#include "js/UbiNode.h"
 #include "vm/PropDesc.h"
 
 #ifdef _MSC_VER
 #pragma warning(push)
 #pragma warning(disable:4800)
 #pragma warning(push)
 #pragma warning(disable:4100) /* Silence unreferenced formal parameter warnings */
 #endif
@@ -1451,21 +1450,11 @@ IsImplicitDenseOrTypedArrayElement(Shape
 #ifdef _MSC_VER
 #pragma warning(pop)
 #pragma warning(pop)
 #endif
 
 namespace JS {
 template<> class AnchorPermitted<js::Shape *> { };
 template<> class AnchorPermitted<const js::Shape *> { };
-
-namespace ubi {
-
-// JS::ubi::Node can trace Shapes and BaseShapes with JS_TraceChildren, and both
-// have a 'compartment' method, so we can use the generic
-// JS::ubi::TracerConcrete template for their JS::ubi::Concrete specialization.
-template<> struct Concrete<js::Shape> : TracerConcreteWithCompartment<js::Shape> { };
-template<> struct Concrete<js::BaseShape> : TracerConcreteWithCompartment<js::BaseShape> { };
-
-} // namespace ubi
-} // namespace JS
+}
 
 #endif /* vm_Shape_h */
--- a/js/src/vm/UbiNode.cpp
+++ b/js/src/vm/UbiNode.cpp
@@ -24,26 +24,21 @@ using JS::Value;
 using JS::ubi::Concrete;
 using JS::ubi::Edge;
 using JS::ubi::EdgeRange;
 using JS::ubi::Node;
 using JS::ubi::TracerConcrete;
 
 // All operations on null ubi::Nodes crash.
 const jschar *Concrete<void>::typeName() const            { MOZ_CRASH("null ubi::Node"); }
+size_t Concrete<void>::size() const                       { MOZ_CRASH("null ubi::Node"); }
 EdgeRange *Concrete<void>::edges(JSContext *, bool) const { MOZ_CRASH("null ubi::Node"); }
 JS::Zone *Concrete<void>::zone() const                    { MOZ_CRASH("null ubi::Node"); }
 JSCompartment *Concrete<void>::compartment() const        { MOZ_CRASH("null ubi::Node"); }
 
-size_t
-Concrete<void>::size(mozilla::MallocSizeOf mallocSizeof) const
-{
-    MOZ_CRASH("null ubi::Node");
-}
-
 Node::Node(JSGCTraceKind kind, void *ptr)
 {
     switch (kind) {
       case JSTRACE_OBJECT:      construct(static_cast<JSObject *>(ptr));              break;
       case JSTRACE_STRING:      construct(static_cast<JSString *>(ptr));              break;
       case JSTRACE_SYMBOL:      construct(static_cast<JS::Symbol *>(ptr));            break;
       case JSTRACE_SCRIPT:      construct(static_cast<JSScript *>(ptr));              break;
       case JSTRACE_LAZY_SCRIPT: construct(static_cast<js::LazyScript *>(ptr));        break;
@@ -52,17 +47,17 @@ Node::Node(JSGCTraceKind kind, void *ptr
       case JSTRACE_BASE_SHAPE:  construct(static_cast<js::BaseShape *>(ptr));         break;
       case JSTRACE_TYPE_OBJECT: construct(static_cast<js::types::TypeObject *>(ptr)); break;
 
       default:
         MOZ_CRASH("bad JSGCTraceKind passed to JS::ubi::Node::Node");
     }
 }
 
-Node::Node(HandleValue value)
+Node::Node(Value value)
 {
     if (value.isObject())
         construct(&value.toObject());
     else if (value.isString())
         construct(value.toString());
     else if (value.isSymbol())
         construct(value.toSymbol());
     else
@@ -230,10 +225,18 @@ TracerConcrete<Referent>::edges(JSContex
 template<> const jschar TracerConcrete<JSObject>::concreteTypeName[] =
     MOZ_UTF16("JSObject");
 template<> const jschar TracerConcrete<JSString>::concreteTypeName[] =
     MOZ_UTF16("JSString");
 template<> const jschar TracerConcrete<JS::Symbol>::concreteTypeName[] =
     MOZ_UTF16("JS::Symbol");
 template<> const jschar TracerConcrete<JSScript>::concreteTypeName[] =
     MOZ_UTF16("JSScript");
+template<> const jschar TracerConcrete<js::LazyScript>::concreteTypeName[] =
+    MOZ_UTF16("js::LazyScript");
 template<> const jschar TracerConcrete<js::jit::JitCode>::concreteTypeName[] =
     MOZ_UTF16("js::jit::JitCode");
+template<> const jschar TracerConcrete<js::Shape>::concreteTypeName[] =
+    MOZ_UTF16("js::Shape");
+template<> const jschar TracerConcrete<js::BaseShape>::concreteTypeName[] =
+    MOZ_UTF16("js::BaseShape");
+template<> const jschar TracerConcrete<js::types::TypeObject>::concreteTypeName[] =
+    MOZ_UTF16("js::types::TypeObject");