Bug 981991 - Make most poisoning unconditional r=jandem
authorJon Coppeard <jcoppeard@mozilla.com>
Thu, 10 Jan 2019 13:21:46 +0000
changeset 453221 65174e3014705687e7ca1050d5d1ffbe81126ac0
parent 453220 77dfbff3744411eaec7b5d834e3c517dda9c22b6
child 453222 6bd0bdab93cb653f984195f55a833a1925f7b2b0
child 453275 d0a6668cf2fe907399cff20030b7b8218d56f005
push id111061
push userjcoppeard@mozilla.com
push dateThu, 10 Jan 2019 13:24:50 +0000
treeherdermozilla-inbound@65174e301470 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs981991
milestone66.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 981991 - Make most poisoning unconditional r=jandem
js/src/builtin/Array.cpp
js/src/builtin/Promise.cpp
js/src/frontend/NameFunctions.cpp
js/src/gc/GC.cpp
js/src/gc/Marking.cpp
js/src/vm/Iteration.cpp
js/src/vm/JSScript.cpp
js/src/vm/Scope.h
js/src/vm/TypeInference.cpp
--- a/js/src/builtin/Array.cpp
+++ b/js/src/builtin/Array.cpp
@@ -4419,17 +4419,17 @@ void js::ArraySpeciesLookup::initialize(
   arraySpeciesShape_ = speciesShape;
   canonicalSpeciesFunc_ = speciesFun;
 #endif
   arrayProtoShape_ = arrayProto->lastProperty();
   arrayProtoConstructorSlot_ = ctorShape->slot();
 }
 
 void js::ArraySpeciesLookup::reset() {
-  Poison(this, 0xBB, sizeof(*this), MemCheckKind::MakeUndefined);
+  AlwaysPoison(this, 0xBB, sizeof(*this), MemCheckKind::MakeUndefined);
   state_ = State::Uninitialized;
 }
 
 bool js::ArraySpeciesLookup::isArrayStateStillSane() {
   MOZ_ASSERT(state_ == State::Initialized);
 
   // Ensure that Array.prototype still has the expected shape.
   if (arrayProto_->lastProperty() != arrayProtoShape_) {
--- a/js/src/builtin/Promise.cpp
+++ b/js/src/builtin/Promise.cpp
@@ -4690,17 +4690,17 @@ void js::PromiseLookup::initialize(JSCon
 #endif
   promiseProtoShape_ = promiseProto->lastProperty();
   promiseResolveSlot_ = resolveShape->slot();
   promiseProtoConstructorSlot_ = ctorShape->slot();
   promiseProtoThenSlot_ = thenShape->slot();
 }
 
 void js::PromiseLookup::reset() {
-  Poison(this, 0xBB, sizeof(*this), MemCheckKind::MakeUndefined);
+  AlwaysPoison(this, 0xBB, sizeof(*this), MemCheckKind::MakeUndefined);
   state_ = State::Uninitialized;
 }
 
 bool js::PromiseLookup::isPromiseStateStillSane(JSContext* cx) {
   MOZ_ASSERT(state_ == State::Initialized);
 
   NativeObject* promiseProto = getPromisePrototype(cx);
   MOZ_ASSERT(promiseProto);
--- a/js/src/frontend/NameFunctions.cpp
+++ b/js/src/frontend/NameFunctions.cpp
@@ -980,18 +980,18 @@ class NameResolver {
 
     // It would be nice to common up the repeated |parents[initialParents]|
     // in a single variable, but the #if condition required to prevent an
     // unused-variable warning across three separate conditionally-expanded
     // macros would be super-ugly.  :-(
     MOZ_ASSERT(parents[initialParents] == cur,
                "pushed child shouldn't change underneath us");
 
-    Poison(&parents[initialParents], 0xFF, sizeof(parents[initialParents]),
-           MemCheckKind::MakeUndefined);
+    AlwaysPoison(&parents[initialParents], 0xFF, sizeof(parents[initialParents]),
+                 MemCheckKind::MakeUndefined);
 
     return true;
   }
 };
 
 } /* anonymous namespace */
 
 bool frontend::NameFunctions(JSContext* cx, ParseNode* pn) {
--- a/js/src/gc/GC.cpp
+++ b/js/src/gc/GC.cpp
@@ -585,17 +585,17 @@ inline size_t Arena::finalize(FreeOp* fo
         newListTail->initBounds(firstThingOrSuccessorOfLastMarkedThing,
                                 thing - thingSize, this);
         newListTail = newListTail->nextSpanUnchecked(this);
       }
       firstThingOrSuccessorOfLastMarkedThing = thing + thingSize;
       nmarked++;
     } else {
       t->finalize(fop);
-      Poison(t, JS_SWEPT_TENURED_PATTERN, thingSize,
+      AlwaysPoison(t, JS_SWEPT_TENURED_PATTERN, thingSize,
              MemCheckKind::MakeUndefined);
       gcTracer.traceTenuredFinalize(t);
     }
   }
 
   if (nmarked == 0) {
     // Do nothing. The caller will update the arena appropriately.
     MOZ_ASSERT(newListTail == &newListHead);
@@ -2947,21 +2947,19 @@ void GCRuntime::releaseRelocatedArenasWi
     arenaList = arenaList->next;
 
     // Clear the mark bits
     arena->unmarkAll();
 
     // Mark arena as empty
     arena->setAsFullyUnused();
 
-#if defined(JS_CRASH_DIAGNOSTICS) || defined(JS_GC_ZEAL)
-    Poison(reinterpret_cast<void*>(arena->thingsStart()),
-           JS_MOVED_TENURED_PATTERN, arena->getThingsSpan(),
-           MemCheckKind::MakeNoAccess);
-#endif
+    AlwaysPoison(reinterpret_cast<void*>(arena->thingsStart()),
+                 JS_MOVED_TENURED_PATTERN, arena->getThingsSpan(),
+                 MemCheckKind::MakeNoAccess);
 
     releaseArena(arena, lock);
     ++count;
   }
 }
 
 // In debug mode we don't always release relocated arenas straight away.
 // Sometimes protect them instead and hold onto them until the next GC sweep
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -2282,18 +2282,18 @@ bool MarkStack::resize(size_t newCapacit
   return true;
 }
 
 inline void MarkStack::poisonUnused() {
   static_assert((JS_FRESH_MARK_STACK_PATTERN & TagMask) > LastTag,
                 "The mark stack poison pattern must not look like a valid "
                 "tagged pointer");
 
-  Poison(stack().begin() + topIndex_, JS_FRESH_MARK_STACK_PATTERN,
-         stack().capacity() - topIndex_, MemCheckKind::MakeUndefined);
+  AlwaysPoison(stack().begin() + topIndex_, JS_FRESH_MARK_STACK_PATTERN,
+               stack().capacity() - topIndex_, MemCheckKind::MakeUndefined);
 }
 
 size_t MarkStack::sizeOfExcludingThis(
     mozilla::MallocSizeOf mallocSizeOf) const {
   return stack().sizeOfExcludingThis(mallocSizeOf);
 }
 
 MarkStackIter::MarkStackIter(MarkStack& stack)
--- a/js/src/vm/Iteration.cpp
+++ b/js/src/vm/Iteration.cpp
@@ -669,18 +669,18 @@ static PropertyIteratorObject* CreatePro
 /**
  * Initialize a sentinel NativeIterator whose purpose is only to act as the
  * start/end of the circular linked list of NativeIterators in
  * ObjectRealm::enumerators.
  */
 NativeIterator::NativeIterator() {
   // Do our best to enforce that nothing in |this| except the two fields set
   // below is ever observed.
-  Poison(static_cast<void*>(this), 0xCC, sizeof(*this),
-         MemCheckKind::MakeUndefined);
+  AlwaysPoison(static_cast<void*>(this), 0xCC, sizeof(*this),
+               MemCheckKind::MakeUndefined);
 
   // These are the only two fields in sentinel NativeIterators that are
   // examined, in ObjectRealm::sweepNativeIterators.  Everything else is
   // only examined *if* it's a NativeIterator being traced by a
   // PropertyIteratorObject that owns it, and nothing owns this iterator.
   prev_ = next_ = this;
 }
 
--- a/js/src/vm/JSScript.cpp
+++ b/js/src/vm/JSScript.cpp
@@ -3560,17 +3560,17 @@ void JSScript::finalize(FreeOp* fop) {
 #ifdef MOZ_VTUNE
   if (realm()->scriptVTuneIdMap) {
     // Note: we should only get here if the VTune JIT profiler is running.
     realm()->scriptVTuneIdMap->remove(this);
   }
 #endif
 
   if (data_) {
-    Poison(data_, 0xdb, computedSizeOfData(), MemCheckKind::MakeNoAccess);
+    AlwaysPoison(data_, 0xdb, computedSizeOfData(), MemCheckKind::MakeNoAccess);
     fop->free_(data_);
   }
 
   if (scriptData_) {
     scriptData_->decRefCount();
   }
 
   // In most cases, our LazyScript's script pointer will reference this
--- a/js/src/vm/Scope.h
+++ b/js/src/vm/Scope.h
@@ -171,18 +171,18 @@ class TrailingNamesArray {
 
  public:
   // Explicitly ensure no one accidentally allocates scope data without
   // poisoning its trailing names.
   TrailingNamesArray() = delete;
 
   explicit TrailingNamesArray(size_t nameCount) {
     if (nameCount) {
-      Poison(&data_, 0xCC, sizeof(BindingName) * nameCount,
-             MemCheckKind::MakeUndefined);
+      AlwaysPoison(&data_, 0xCC, sizeof(BindingName) * nameCount,
+                   MemCheckKind::MakeUndefined);
     }
   }
 
   BindingName* start() { return reinterpret_cast<BindingName*>(ptr()); }
 
   BindingName& get(size_t i) { return start()[i]; }
   BindingName& operator[](size_t i) { return get(i); }
 };
--- a/js/src/vm/TypeInference.cpp
+++ b/js/src/vm/TypeInference.cpp
@@ -4464,19 +4464,19 @@ void ConstraintTypeSet::sweep(const Auto
         flags |= TYPE_FLAG_ANYOBJECT;
         clearObjects();
         objectCount = 0;
         break;
       }
     }
     setBaseObjectCount(objectCount);
     // Note: -1/+1 to also poison the capacity field.
-    Poison(oldArray - 1, JS_SWEPT_TI_PATTERN,
-           (oldCapacity + 1) * sizeof(oldArray[0]),
-           MemCheckKind::MakeUndefined);
+    AlwaysPoison(oldArray - 1, JS_SWEPT_TI_PATTERN,
+                 (oldCapacity + 1) * sizeof(oldArray[0]),
+                 MemCheckKind::MakeUndefined);
   } else if (objectCount == 1) {
     ObjectKey* key = (ObjectKey*)objectSet;
     if (!IsObjectKeyAboutToBeFinalized(&key)) {
       objectSet = reinterpret_cast<ObjectKey**>(key);
     } else {
       // As above, mark type sets containing objects with unknown
       // properties as unknown.
       if (key->isGroup() &&
@@ -4502,18 +4502,18 @@ void ConstraintTypeSet::sweep(const Auto
         MOZ_ASSERT(zone->types.typeLifoAlloc().contains(copy));
         copy->setNext(constraintList_);
         constraintList_ = copy;
       } else {
         zone->types.setOOMSweepingTypes();
       }
     }
     TypeConstraint* next = constraint->next();
-    Poison(constraint, JS_SWEPT_TI_PATTERN, sizeof(TypeConstraint),
-           MemCheckKind::MakeUndefined);
+    AlwaysPoison(constraint, JS_SWEPT_TI_PATTERN, sizeof(TypeConstraint),
+                 MemCheckKind::MakeUndefined);
     constraint = next;
   }
 }
 
 inline void ObjectGroup::clearProperties(const AutoSweepObjectGroup& sweep) {
   // We're about to remove edges from the group to property ids. Incremental
   // GC should know about these edges.
   if (zone()->needsIncrementalBarrier()) {
@@ -4580,18 +4580,18 @@ void ObjectGroup::sweep(const AutoSweepO
   if (propertyCount >= 2) {
     unsigned oldCapacity = TypeHashSet::Capacity(propertyCount);
     Property** oldArray = propertySet;
 
     MOZ_RELEASE_ASSERT(uintptr_t(oldArray[-1]) == oldCapacity);
 
     auto poisonArray = mozilla::MakeScopeExit([oldArray, oldCapacity] {
       size_t size = sizeof(Property*) * (oldCapacity + 1);
-      Poison(oldArray - 1, JS_SWEPT_TI_PATTERN, size,
-             MemCheckKind::MakeUndefined);
+      AlwaysPoison(oldArray - 1, JS_SWEPT_TI_PATTERN, size,
+                   MemCheckKind::MakeUndefined);
     });
 
     unsigned oldPropertyCount = propertyCount;
     unsigned oldPropertiesFound = 0;
 
     clearProperties(sweep);
     propertyCount = 0;
     for (unsigned i = 0; i < oldCapacity; i++) {
@@ -4602,24 +4602,24 @@ void ObjectGroup::sweep(const AutoSweepO
         if (singleton() && !prop->types.constraintList(sweep) &&
             !zone()->isPreservingCode()) {
           /*
            * Don't copy over properties of singleton objects when their
            * presence will not be required by jitcode or type constraints
            * (i.e. for the definite properties analysis). The contents of
            * these type sets will be regenerated as necessary.
            */
-          Poison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
-                 MemCheckKind::MakeUndefined);
+          AlwaysPoison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
+                       MemCheckKind::MakeUndefined);
           continue;
         }
 
         Property* newProp = typeLifoAlloc.new_<Property>(*prop);
-        Poison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
-               MemCheckKind::MakeUndefined);
+        AlwaysPoison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
+                     MemCheckKind::MakeUndefined);
         if (newProp) {
           Property** pentry = TypeHashSet::Insert<jsid, Property, Property>(
               typeLifoAlloc, propertySet, propertyCount, newProp->id);
           if (pentry) {
             *pentry = newProp;
             newProp->types.sweep(sweep, zone());
             continue;
           }
@@ -4635,23 +4635,23 @@ void ObjectGroup::sweep(const AutoSweepO
     MOZ_RELEASE_ASSERT(oldPropertyCount == oldPropertiesFound);
     setBasePropertyCount(sweep, propertyCount);
   } else if (propertyCount == 1) {
     Property* prop = (Property*)propertySet;
     prop->types.checkMagic();
     if (singleton() && !prop->types.constraintList(sweep) &&
         !zone()->isPreservingCode()) {
       // Skip, as above.
-      Poison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
-             MemCheckKind::MakeUndefined);
+      AlwaysPoison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
+                   MemCheckKind::MakeUndefined);
       clearProperties(sweep);
     } else {
       Property* newProp = typeLifoAlloc.new_<Property>(*prop);
-      Poison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
-             MemCheckKind::MakeUndefined);
+      AlwaysPoison(prop, JS_SWEPT_TI_PATTERN, sizeof(Property),
+                   MemCheckKind::MakeUndefined);
       if (newProp) {
         propertySet = (Property**)newProp;
         newProp->types.sweep(sweep, zone());
       } else {
         zone()->types.setOOMSweepingTypes();
         addFlags(sweep,
                  OBJECT_FLAG_DYNAMIC_MASK | OBJECT_FLAG_UNKNOWN_PROPERTIES);
         clearProperties(sweep);