author | Jeff Walden <jwalden@mit.edu> |
Wed, 16 May 2018 19:29:57 -0700 | |
changeset 418915 | d642657c6d7ae426a192e60341bafa8abbf70185 |
parent 418914 | 8d85342160ac1a0cddff928c39cc25629bb4a338 |
child 418916 | 5c09010d054eeb3e44a1401cc917677db9579cfc |
push id | 103419 |
push user | jwalden@mit.edu |
push date | Fri, 18 May 2018 19:33:51 +0000 |
treeherder | mozilla-inbound@7658d2d1e0d7 [default view] [failures only] |
perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
reviewers | jandem |
bugs | 1461556 |
milestone | 62.0a1 |
first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
js/src/vm/TypeInference.cpp | file | annotate | diff | comparison | revisions | |
js/src/vm/TypeInference.h | file | annotate | diff | comparison | revisions |
--- a/js/src/vm/TypeInference.cpp +++ b/js/src/vm/TypeInference.cpp @@ -8,16 +8,18 @@ #include "mozilla/DebugOnly.h" #include "mozilla/IntegerPrintfMacros.h" #include "mozilla/MemoryReporting.h" #include "mozilla/Move.h" #include "mozilla/PodOperations.h" #include "mozilla/Sprintf.h" +#include <new> + #include "jsapi.h" #include "builtin/String.h" #include "gc/HashUtil.h" #include "jit/BaselineJIT.h" #include "jit/CompileInfo.h" #include "jit/Ion.h" #include "jit/IonAnalysis.h" @@ -867,43 +869,41 @@ TypeSet::IsTypeAboutToBeFinalized(TypeSe *v = TypeSet::ObjectType(key); } else { isAboutToBeFinalized = false; } return isAboutToBeFinalized; } bool -TypeSet::clone(LifoAlloc* alloc, TemporaryTypeSet* result) const +TypeSet::cloneIntoUninitialized(LifoAlloc* alloc, TemporaryTypeSet* result) const { - MOZ_ASSERT(result->empty()); - unsigned objectCount = baseObjectCount(); unsigned capacity = (objectCount >= 2) ? TypeHashSet::Capacity(objectCount) : 0; ObjectKey** newSet; if (capacity) { // We allocate an extra word right before the array that stores the // capacity, so make sure we clone that as well. newSet = alloc->newArray<ObjectKey*>(capacity + 1); if (!newSet) return false; newSet++; PodCopy(newSet - 1, objectSet - 1, capacity + 1); } - new(result) TemporaryTypeSet(flags, capacity ? newSet : objectSet); + new (result) TemporaryTypeSet(flags, capacity ? newSet : objectSet); return true; } TemporaryTypeSet* TypeSet::clone(LifoAlloc* alloc) const { - TemporaryTypeSet* res = alloc->new_<TemporaryTypeSet>(); - if (!res || !clone(alloc, res)) + TemporaryTypeSet* res = alloc->pod_malloc<TemporaryTypeSet>(); + if (!res || !cloneIntoUninitialized(alloc, res)) return nullptr; return res; } TemporaryTypeSet* TypeSet::cloneObjectsOnly(LifoAlloc* alloc) { TemporaryTypeSet* res = clone(alloc); @@ -1162,20 +1162,19 @@ TypeScript::FreezeTypeSets(CompilerConst LifoAlloc* alloc = constraints->alloc(); AutoSweepTypeScript sweep(script); StackTypeSet* existing = script->types(sweep)->typeArray(); size_t count = NumTypeSets(script); TemporaryTypeSet* types = alloc->newArrayUninitialized<TemporaryTypeSet>(count); if (!types) return false; - PodZero(types, count); for (size_t i = 0; i < count; i++) { - if (!existing[i].clone(alloc, &types[i])) + if (!existing[i].cloneIntoUninitialized(alloc, &types[i])) return false; } *pThisTypes = types + (ThisTypes(script) - existing); *pArgTypes = (script->functionNonDelazifying() && script->functionNonDelazifying()->nargs()) ? (types + (ArgTypes(script, 0) - existing)) : nullptr; *pBytecodeTypes = types;
--- a/js/src/vm/TypeInference.h +++ b/js/src/vm/TypeInference.h @@ -503,17 +503,20 @@ class TypeSet bool objectsIntersect(const TypeSet* other) const; /* Forward all types in this set to the specified constraint. */ bool addTypesToConstraint(JSContext* cx, TypeConstraint* constraint); // Clone a type set into an arbitrary allocator. TemporaryTypeSet* clone(LifoAlloc* alloc) const; - bool clone(LifoAlloc* alloc, TemporaryTypeSet* result) const; + + // |*result| is not even partly initialized when this function is called: + // this function placement-new's its contents into existence. + bool cloneIntoUninitialized(LifoAlloc* alloc, TemporaryTypeSet* result) const; // Create a new TemporaryTypeSet where undefined and/or null has been filtered out. TemporaryTypeSet* filter(LifoAlloc* alloc, bool filterUndefined, bool filterNull) const; // Create a new TemporaryTypeSet where the type has been set to object. TemporaryTypeSet* cloneObjectsOnly(LifoAlloc* alloc); TemporaryTypeSet* cloneWithoutObjects(LifoAlloc* alloc); JSCompartment* maybeCompartment();