Rename freeslot appropriately (593256 separated cosmetics-only patch, r=jorendorff).
authorBrendan Eich <brendan@mozilla.org>
Fri, 03 Sep 2010 11:05:43 -0700
changeset 53652 65a532c7885e213d1463d8afa9e0566ad4129136
parent 53651 3feb012b18a3764b75900c521df799c191dcde23
child 53653 0b33419e048dc0a39c9f40538017f239e8673a56
push id15666
push userrsayre@mozilla.com
push dateSun, 12 Sep 2010 04:18:05 +0000
treeherdermozilla-central@421427ca9809 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjorendorff
bugs593256
milestone2.0b6pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Rename freeslot appropriately (593256 separated cosmetics-only patch, r=jorendorff).
js/src/jsapi.cpp
js/src/jsbuiltins.cpp
js/src/jsfun.cpp
js/src/jsinterp.cpp
js/src/jslock.cpp
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsparse.cpp
js/src/jspropertycacheinlines.h
js/src/jsscope.cpp
js/src/jsscope.h
js/src/jsscopeinlines.h
js/src/methodjit/StubCalls.cpp
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -2960,17 +2960,17 @@ JS_SealObject(JSContext *cx, JSObject *o
     JS_DestroyIdArray(cx, ida);
 
     /* If not sealing an entire object graph, we're done after sealing obj. */
     obj->seal(cx);
     if (!deep)
         return true;
 
     /* Walk slots in obj and if any value is a non-null object, seal it. */
-    for (uint32 i = 0, n = obj->freeslot(); i != n; ++i) {
+    for (uint32 i = 0, n = obj->slotSpan(); i != n; ++i) {
         const Value &v = obj->getSlot(i);
         if (i == JSSLOT_PRIVATE && (obj->getClass()->flags & JSCLASS_HAS_PRIVATE))
             continue;
         if (v.isPrimitive())
             continue;
         if (!JS_SealObject(cx, &v.toObject(), deep))
             return false;
     }
--- a/js/src/jsbuiltins.cpp
+++ b/js/src/jsbuiltins.cpp
@@ -190,17 +190,17 @@ AddPropertyHelper(JSContext* cx, JSObjec
 
     if (obj->nativeEmpty()) {
         if (!obj->ensureClassReservedSlotsForEmptyObject(cx))
             goto exit_trace;
     }
 
     uint32 slot;
     slot = shape->slot;
-    JS_ASSERT(slot == obj->freeslot());
+    JS_ASSERT(slot == obj->slotSpan());
 
     if (slot < obj->numSlots()) {
         JS_ASSERT(obj->getSlot(slot).isUndefined());
     } else {
         if (!obj->allocSlot(cx, &slot))
             goto exit_trace;
         JS_ASSERT(slot == shape->slot);
     }
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -963,17 +963,17 @@ NewCallObject(JSContext *cx, JSFunction 
     /* This must come after callobj->lastProp has been set. */
     if (!callobj->ensureInstanceReservedSlots(cx, fun->countArgsAndVars()))
         return NULL;
 
 #ifdef DEBUG
     for (Shape::Range r = callobj->lastProp; !r.empty(); r.popFront()) {
         const Shape &s = r.front();
         if (s.slot != SHAPE_INVALID_SLOT) {
-            JS_ASSERT(s.slot + 1 == callobj->freeslot());
+            JS_ASSERT(s.slot + 1 == callobj->slotSpan());
             break;
         }
     }
 #endif
     return callobj;
 }
 
 static inline JSObject *
@@ -2410,17 +2410,17 @@ JSObject::initBoundFunction(JSContext *c
     fslots[JSSLOT_BOUND_FUNCTION_THIS] = thisArg;
     fslots[JSSLOT_BOUND_FUNCTION_ARGS_COUNT].setPrivateUint32(argslen);
     if (argslen != 0) {
         /* FIXME? Burn memory on an empty scope whose shape covers the args slots. */
         EmptyShape *empty = EmptyShape::create(cx, clasp);
         if (!empty)
             return false;
 
-        empty->freeslot += argslen;
+        empty->slotSpan += argslen;
         map = empty;
 
         if (!ensureInstanceReservedSlots(cx, argslen))
             return false;
 
         JS_ASSERT(dslots);
         JS_ASSERT(dslots[-1].toPrivateUint32() >= argslen);
         memcpy(&dslots[0], args, argslen * sizeof(Value));
@@ -3207,18 +3207,18 @@ JSFunction::addLocal(JSContext *cx, JSAt
         if (kind == JSLOCAL_ARG && parent->inDictionary())
             findArgInsertionPoint = true;
         id = ATOM_TO_JSID(atom);
     }
 
     if (findArgInsertionPoint) {
         while (parent->parent && parent->getter() != js_GetCallArg) {
             ++parent->slot;
-            JS_ASSERT(parent->slot == parent->freeslot);
-            ++parent->freeslot;
+            JS_ASSERT(parent->slot == parent->slotSpan);
+            ++parent->slotSpan;
             listp = &parent->parent;
             parent = *listp;
         }
     }
 
     Shape child(id, getter, setter, slot, attrs, Shape::HAS_SHORTID, *indexp);
 
     Shape *shape = parent->getChild(cx, child, listp);
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -4191,17 +4191,17 @@ BEGIN_CASE(JSOP_SETMETHOD)
                         goto error;
                 }
 
                 uint32 slot;
                 if (shape->previous() == obj->lastProperty() &&
                     entry->vshape() == rt->protoHazardShape &&
                     shape->hasDefaultSetter()) {
                     slot = shape->slot;
-                    JS_ASSERT(slot == obj->freeslot());
+                    JS_ASSERT(slot == obj->slotSpan());
 
                     /*
                      * Fast path: adding a plain old property that was once at
                      * the frontier of the property tree, whose slot is next to
                      * claim among the already-allocated slots in obj, where
                      * shape->table has not been created yet.
                      */
                     PCMETER(cache->pchits++);
@@ -5856,17 +5856,17 @@ BEGIN_CASE(JSOP_INITMETHOD)
     if (CX_OWNS_OBJECT_TITLE(cx, obj) &&
         JS_PROPERTY_CACHE(cx).testForInit(rt, regs.pc, obj, &shape, &entry) &&
         shape->hasDefaultSetter() &&
         shape->previous() == obj->lastProperty())
     {
         /* Fast path. Property cache hit. */
         uint32 slot = shape->slot;
 
-        JS_ASSERT(slot == obj->freeslot());
+        JS_ASSERT(slot == obj->slotSpan());
         JS_ASSERT(slot >= JSSLOT_FREE(obj->getClass()));
         if (slot < obj->numSlots()) {
             JS_ASSERT(obj->getSlot(slot).isUndefined());
         } else {
             if (!obj->allocSlot(cx, &slot))
                 goto error;
             JS_ASSERT(slot == shape->slot);
         }
--- a/js/src/jslock.cpp
+++ b/js/src/jslock.cpp
@@ -502,17 +502,17 @@ ShareTitle(JSContext *cx, JSTitle *title
 static void
 FinishSharingTitle(JSContext *cx, JSTitle *title)
 {
     js_InitLock(&title->lock);
     title->u.count = 0;     /* NULL may not pun as 0 */
 
     JSObject *obj = TITLE_TO_OBJECT(title);
     if (obj) {
-        uint32 nslots = obj->freeslot();
+        uint32 nslots = obj->slotSpan();
         JS_ASSERT(nslots >= JSSLOT_START(obj->getClass()));
         for (uint32 i = JSSLOT_START(obj->getClass()); i != nslots; ++i) {
             Value v = obj->getSlot(i);
             if (v.isString() &&
                 !js_MakeStringImmutable(cx, v.toString())) {
                 /*
                  * FIXME bug 363059: The following error recovery changes
                  * runtime execution semantics, arbitrarily and silently
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -3861,25 +3861,25 @@ js_ConstructObject(JSContext *cx, Class 
         return NULL;
     }
     return obj;
 }
 
 bool
 JSObject::allocSlot(JSContext *cx, uint32 *slotp)
 {
-    uint32 slot = freeslot();
+    uint32 slot = slotSpan();
     JS_ASSERT(slot >= JSSLOT_FREE(clasp));
 
     /*
      * If this object is in dictionary mode and it has a property table, try to
      * pull a free slot from the property table's slot-number freelist.
      */
     if (inDictionaryMode() && lastProp->table) {
-        uint32 &last = lastProp->table->freeslot;
+        uint32 &last = lastProp->table->freelist;
         if (last != SHAPE_INVALID_SLOT) {
 #ifdef DEBUG
             JS_ASSERT(last < slot);
             uint32 next = getSlot(last).toPrivateUint32();
             JS_ASSERT_IF(next != SHAPE_INVALID_SLOT, next < slot);
 #endif
 
             *slotp = last;
@@ -3898,34 +3898,34 @@ JSObject::allocSlot(JSContext *cx, uint3
     JS_ASSERT(getSlot(slot).isUndefined());
     *slotp = slot;
     return true;
 }
 
 void
 JSObject::freeSlot(JSContext *cx, uint32 slot)
 {
-    uint32 limit = freeslot();
+    uint32 limit = slotSpan();
     JS_ASSERT(slot < limit);
 
     Value &vref = getSlotRef(slot);
     if (inDictionaryMode() && lastProp->table) {
-        uint32 &last = lastProp->table->freeslot;
+        uint32 &last = lastProp->table->freelist;
 
         /* Can't afford to check the whole freelist, but let's check the head. */
         JS_ASSERT_IF(last != SHAPE_INVALID_SLOT, last < limit && last != slot);
 
         /*
          * Freeing a slot other than the last one mapped by this object's
          * shape: push the slot onto the dictionary table's freelist. We want
          * to let the last slot be freed by shrinking the dslots vector; see
          * js_TraceObject.
          */
         if (slot + 1 < limit) {
-            JS_ASSERT_IF(last != SHAPE_INVALID_SLOT, last < freeslot());
+            JS_ASSERT_IF(last != SHAPE_INVALID_SLOT, last < slotSpan());
             vref.setPrivateUint32(last);
             last = slot;
             return;
         }
     }
     vref.setUndefined();
 }
 
@@ -5916,17 +5916,17 @@ js_TraceObject(JSTracer *trc, JSObject *
     JSContext *cx = trc->context;
     if (!obj->nativeEmpty() && IS_GC_MARKING_TRACER(trc)) {
         /*
          * Trim overlong dslots allocations from the GC, to avoid thrashing in
          * case of delete-happy code that settles down at a given population.
          * The !obj->nativeEmpty() guard above is due to the bug described by
          * the FIXME comment below.
          */
-        size_t slots = obj->freeslot();
+        size_t slots = obj->slotSpan();
         if (obj->numSlots() != slots)
             obj->shrinkSlots(cx, slots);
     }
 
 #ifdef JS_DUMP_SCOPE_METERS
     MeterEntryCount(obj->propertyCount);
 #endif
 
@@ -5948,24 +5948,24 @@ js_TraceObject(JSTracer *trc, JSObject *
         compartment->marked = true;
     }
 
     /*
      * NB: In case clasp->mark mutates something (which would be a bug, but we
      * want to be defensive), leave this code here -- don't move it up and
      * unify it with the |if (!traceScope)| section above.
      *
-     * FIXME: We minimize nslots against obj->freeslot because native objects
-     * such as Date instances may have failed to advance freeslot to cover all
+     * FIXME: We minimize nslots against obj->slotSpan because native objects
+     * such as Date instances may have failed to advance slotSpan to cover all
      * reserved slots (this Date issue may be a bug in JSObject::growSlots, but
      * the general problem occurs in other built-in class implementations).
      */
     uint32 nslots = obj->numSlots();
-    if (!obj->nativeEmpty() && obj->freeslot() < nslots)
-        nslots = obj->freeslot();
+    if (!obj->nativeEmpty() && obj->slotSpan() < nslots)
+        nslots = obj->slotSpan();
     JS_ASSERT(nslots >= JSSLOT_START(clasp));
 
     for (uint32 i = JSSLOT_START(clasp); i != nslots; ++i) {
         const Value &v = obj->getSlot(i);
         JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);
         MarkValueRaw(trc, v);
     }
 }
@@ -5977,17 +5977,17 @@ js_ClearNative(JSContext *cx, JSObject *
      * Clear obj of all obj's properties. FIXME: we do not clear reserved slots
      * lying below JSSLOT_FREE(clasp). JS_ClearScope does that.
      */
     JS_LOCK_OBJ(cx, obj);
     if (!obj->nativeEmpty()) {
         /* Now that we're done using real properties, clear obj. */
         obj->clear(cx);
 
-        /* Clear slot values and reset freeslot so we're consistent. */
+        /* Clear slot values since obj->clear reset our shape to empty. */
         uint32 freeslot = JSSLOT_FREE(obj->getClass());
         uint32 n = obj->numSlots();
         for (uint32 i = freeslot; i < n; ++i)
             obj->setSlot(i, UndefinedValue());
     }
     JS_UNLOCK_OBJ(cx, obj);
 }
 
@@ -6327,17 +6327,17 @@ js_DumpObject(JSObject *obj)
     i = JSSLOT_PRIVATE;
     if (clasp->flags & JSCLASS_HAS_PRIVATE) {
         i = JSSLOT_PRIVATE + 1;
         fprintf(stderr, "private %p\n", obj->getPrivate());
     }
 
     fprintf(stderr, "slots:\n");
     reservedEnd = i + JSCLASS_RESERVED_SLOTS(clasp);
-    slots = obj->freeslot();
+    slots = obj->slotSpan();
     for (; i < slots; i++) {
         fprintf(stderr, " %3d ", i);
         if (i < reservedEnd)
             fprintf(stderr, "(reserved) ");
         fprintf(stderr, "= ");
         dumpValue(obj->getSlot(i));
         fputc('\n', stderr);
     }
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -176,20 +176,20 @@ namespace js {
 typedef Vector<PropDesc, 1> PropDescArray;
 
 } /* namespace js */
 
 struct JSObjectMap {
     static JS_FRIEND_DATA(const JSObjectMap) sharedNonNative;
 
     uint32 shape;       /* shape identifier */
-    uint32 freeslot;    /* first free object slot */
+    uint32 slotSpan;    /* one more than maximum live slot number */
 
-    explicit JSObjectMap(uint32 shape) : shape(shape), freeslot(0) {}
-    JSObjectMap(uint32 shape, uint32 freeslot) : shape(shape), freeslot(freeslot) {}
+    explicit JSObjectMap(uint32 shape) : shape(shape), slotSpan(0) {}
+    JSObjectMap(uint32 shape, uint32 slotSpan) : shape(shape), slotSpan(slotSpan) {}
 
     enum { INVALID_SHAPE = 0x8fffffff, SHAPELESS = 0xffffffff };
 
     bool isNative() const { return this != &sharedNonNative; }
 
   private:
     /* No copy or assignment semantics. */
     JSObjectMap(JSObjectMap &);
@@ -351,18 +351,18 @@ struct JSObject {
     js::EmptyShape *emptyShape;
 
     js::Value   fslots[JS_INITIAL_NSLOTS];  /* small number of fixed slots */
 #ifdef JS_THREADSAFE
     JSTitle     title;
 #endif
 
     /*
-     * Return an immutable, shareable, empty scope with the same ops as this
-     * and the same freeslot as this had when empty.
+     * Return an immutable, shareable, empty shape with the same clasp as this
+     * and the same slotSpan as this had when empty.
      *
      * If |this| is the scope of an object |proto|, the resulting scope can be
      * used as the scope of a new object whose prototype is |proto|.
      */
     inline bool canProvideEmptyShape(js::Class *clasp);
     inline js::EmptyShape *getEmptyShape(JSContext *cx, js::Class *aclasp);
 
     bool isNative() const       { return map->isNative(); }
@@ -572,19 +572,19 @@ struct JSObject {
      * NB: ensureClassReservedSlotsForEmptyObject asserts that nativeEmpty()
      * Use ensureClassReservedSlots for any object, either empty or already
      * extended with properties.
      */
     bool ensureClassReservedSlotsForEmptyObject(JSContext *cx);
 
     inline bool ensureClassReservedSlots(JSContext *cx);
 
-    uint32 freeslot() const { return map->freeslot; }
+    uint32 slotSpan() const { return map->slotSpan; }
 
-    bool containsSlot(uint32 slot) const { return slot < freeslot(); }
+    bool containsSlot(uint32 slot) const { return slot < slotSpan(); }
 
     js::Value& getSlotRef(uintN slot) {
         return (slot < JS_INITIAL_NSLOTS)
                ? fslots[slot]
                : (JS_ASSERT(slot < dslots[-1].toPrivateUint32()),
                   dslots[slot - JS_INITIAL_NSLOTS]);
     }
 
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -772,17 +772,17 @@ Compiler::compileScript(JSContext *cx, J
         JS_ASSERT(globalObj->isNative());
         JS_ASSERT((globalObj->getClass()->flags & JSCLASS_GLOBAL_FLAGS) == JSCLASS_GLOBAL_FLAGS);
 
         /* Make sure function and object classes are initialized. */
         JSObject *tobj;
         if (!js_GetClassPrototype(cx, scopeChain, JSProto_Function, &tobj))
             return NULL;
 
-        globalScope.globalFreeSlot = globalObj->freeslot();
+        globalScope.globalFreeSlot = globalObj->slotSpan();
     }
 
     /* Null script early in case of error, to reduce our code footprint. */
     script = NULL;
 
     globalScope.cg = &cg;
     cg.flags |= tcflags;
     cg.scopeChain = scopeChain;
@@ -942,17 +942,17 @@ Compiler::compileScript(JSContext *cx, J
                 if (slot >= SLOTNO_LIMIT)
                     goto too_many_slots;
                 SET_SLOTNO(code, slot);
             }
         }
     }
 
     if (globalScope.defs.length()) {
-        JS_ASSERT(globalObj->freeslot() == globalScope.globalFreeSlot);
+        JS_ASSERT(globalObj->slotSpan() == globalScope.globalFreeSlot);
         JS_ASSERT(!cg.compilingForEval());
         for (size_t i = 0; i < globalScope.defs.length(); i++) {
             GlobalScope::GlobalDef &def = globalScope.defs[i];
             jsid id = ATOM_TO_JSID(def.atom);
             Value rval;
 
             if (def.funbox) {
                 JSFunction *fun = (JSFunction *)def.funbox->object;
--- a/js/src/jspropertycacheinlines.h
+++ b/js/src/jspropertycacheinlines.h
@@ -128,17 +128,17 @@ PropertyCache::testForSet(JSContext *cx,
     *atomp = atom;
     return false;
 }
 
 JS_ALWAYS_INLINE bool
 PropertyCache::testForInit(JSRuntime *rt, jsbytecode *pc, JSObject *obj,
                            const js::Shape **shapep, PropertyCacheEntry **entryp)
 {
-    JS_ASSERT(obj->freeslot() >= JSSLOT_FREE(obj->getClass()));
+    JS_ASSERT(obj->slotSpan() >= JSSLOT_FREE(obj->getClass()));
     JS_ASSERT(!obj->sealed());
     uint32 kshape = obj->shape();
     PropertyCacheEntry *entry = &table[hash(pc, kshape)];
     *entryp = entry;
     PCMETER(pctestentry = entry);
     PCMETER(tests++);
     PCMETER(initests++);
     JS_ASSERT(entry->kshape < SHAPE_OVERFLOW_BIT);
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -102,17 +102,17 @@ JSObject::ensureClassReservedSlotsForEmp
 
     /*
      * Subtle rule: objects that call JSObject::ensureInstanceReservedSlots
      * must either:
      *
      * (a) never escape anywhere an ad-hoc property could be set on them; or
      *
      * (b) protect their instance-reserved slots with shapes, at least a custom
-     * empty shape with the right freeslot member.
+     * empty shape with the right slotSpan member.
      *
      * Block objects are the only objects that fall into category (a). While
      * Call objects cannot escape, they can grow ad-hoc properties via eval
      * of a var declaration, or due to a function statement being evaluated,
      * but they have slots mapped by compiler-created shapes, and thus (b) no
      * problem predicting first ad-hoc property slot. Bound Function objects
      * have a custom empty shape.
      *
@@ -523,17 +523,17 @@ Shape *
 Shape::newDictionaryShape(JSContext *cx, const Shape &child, Shape **listp)
 {
     Shape *dprop = JS_PROPERTY_TREE(cx).newShape(cx);
     if (!dprop)
         return NULL;
 
     new (dprop) Shape(child.id, child.rawGetter, child.rawSetter, child.slot, child.attrs,
                       (child.flags & ~FROZEN) | IN_DICTIONARY, child.shortid,
-                      js_GenerateShape(cx, false), child.freeslot);
+                      js_GenerateShape(cx, false), child.slotSpan);
 
     dprop->listp = NULL;
     dprop->insertIntoDictionary(listp);
 
     JS_RUNTIME_METER(cx->runtime, liveDictModeNodes);
     return dprop;
 }
 
@@ -642,56 +642,56 @@ JSObject::checkShapeConsistency()
     else
         JS_ASSERT(objShape == lastProp->shape);
 
     Shape *shape = lastProp;
     Shape *prev = NULL;
 
     if (inDictionaryMode()) {
         if (PropertyTable *table = shape->table) {
-            for (uint32 fslot = table->freeslot; fslot != SHAPE_INVALID_SLOT;
+            for (uint32 fslot = table->freelist; fslot != SHAPE_INVALID_SLOT;
                  fslot = getSlotRef(fslot).toPrivateUint32()) {
-                JS_ASSERT(fslot < shape->freeslot);
+                JS_ASSERT(fslot < shape->slotSpan);
             }
 
             for (int n = throttle; --n >= 0 && shape->parent; shape = shape->parent) {
                 JS_ASSERT_IF(shape != lastProp, !shape->table);
 
                 Shape **spp = table->search(shape->id, false);
                 JS_ASSERT(SHAPE_FETCH(spp) == shape);
             }
         } else {
             shape = shape->parent;
             for (int n = throttle; --n >= 0 && shape; shape = shape->parent)
                 JS_ASSERT(!shape->table);
         }
 
         shape = lastProp;
         for (int n = throttle; --n >= 0 && shape; shape = shape->parent) {
-            JS_ASSERT_IF(shape->slot != SHAPE_INVALID_SLOT, shape->slot < shape->freeslot);
+            JS_ASSERT_IF(shape->slot != SHAPE_INVALID_SLOT, shape->slot < shape->slotSpan);
             if (!prev) {
                 JS_ASSERT(shape == lastProp);
                 JS_ASSERT(shape->listp == &lastProp);
             } else {
                 JS_ASSERT(shape->listp == &prev->parent);
-                JS_ASSERT(prev->freeslot >= shape->freeslot);
+                JS_ASSERT(prev->slotSpan >= shape->slotSpan);
             }
             prev = shape;
         }
     } else {
         for (int n = throttle; --n >= 0 && shape->parent; shape = shape->parent) {
             if (PropertyTable *table = shape->table) {
                 JS_ASSERT(shape->parent);
                 for (Shape::Range r(shape); !r.empty(); r.popFront()) {
                     Shape **spp = table->search(r.front().id, false);
                     JS_ASSERT(SHAPE_FETCH(spp) == &r.front());
                 }
             }
             if (prev) {
-                JS_ASSERT(prev->freeslot >= shape->freeslot);
+                JS_ASSERT(prev->slotSpan >= shape->slotSpan);
                 if (shape->kids.isShape()) {
                     JS_ASSERT(shape->kids.toShape() == prev);
                 } else if (shape->kids.isChunk()) {
                     bool found = false;
                     for (KidsChunk *chunk = shape->kids.toChunk(); chunk; chunk = chunk->next) {
                         for (uintN i = 0; i < MAX_KIDS_PER_CHUNK; i++) {
                             if (!chunk->kids[i]) {
                                 JS_ASSERT(!chunk->next);
@@ -899,21 +899,21 @@ JSObject::putProperty(JSContext *cx, jsi
             table = lastProp->table;
             oldLastProp = lastProp;
         }
         shape->removeFromDictionary(this);
     }
 
 #ifdef DEBUG
     if (shape == oldLastProp) {
-        JS_ASSERT(lastProp->freeslot <= shape->freeslot);
+        JS_ASSERT(lastProp->slotSpan <= shape->slotSpan);
         if (shape->hasSlot())
-            JS_ASSERT(shape->slot < shape->freeslot);
-        if (lastProp->freeslot < numSlots())
-            getSlotRef(lastProp->freeslot).setUndefined();
+            JS_ASSERT(shape->slot < shape->slotSpan);
+        if (lastProp->slotSpan < numSlots())
+            getSlotRef(lastProp->slotSpan).setUndefined();
     }
 #endif
 
     /*
      * If we fail later on trying to find or create a new shape, we will
      * restore *spp from |overwriting|. Note that we don't bother to keep
      * table->removedCount in sync, because we will fix up both *spp and
      * table->entryCount shortly.
@@ -1114,26 +1114,26 @@ JSObject::removeProperty(JSContext *cx, 
             setOwnShape(lastProp->shape);
 
         Shape *oldLastProp = lastProp;
         shape->removeFromDictionary(this);
         if (table) {
             if (shape == oldLastProp) {
                 JS_ASSERT(shape->table == table);
                 JS_ASSERT(shape->parent == lastProp);
-                JS_ASSERT(shape->freeslot >= lastProp->freeslot);
-                JS_ASSERT_IF(hadSlot, shape->slot + 1 <= shape->freeslot);
+                JS_ASSERT(shape->slotSpan >= lastProp->slotSpan);
+                JS_ASSERT_IF(hadSlot, shape->slot + 1 <= shape->slotSpan);
 
                 /*
                  * If the dictionary table's freelist is non-empty, we must
-                 * preserve lastProp->freeslot. We can't reduce freeslot even
-                 * by one or we might lose non-decreasing freeslot order.
+                 * preserve lastProp->slotSpan. We can't reduce slotSpan even
+                 * by one or we might lose non-decreasing slotSpan order.
                  */
-                if (table->freeslot != SHAPE_INVALID_SLOT)
-                    lastProp->freeslot = shape->freeslot;
+                if (table->freelist != SHAPE_INVALID_SLOT)
+                    lastProp->slotSpan = shape->slotSpan;
             }
 
             /* Hand off table from old to new lastProp. */
             oldLastProp->setTable(NULL);
             lastProp->setTable(table);
         }
     } else {
         /*
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -223,26 +223,26 @@ struct PropertyTable {
         MIN_SIZE_LOG2   = 4,
         MIN_SIZE        = JS_BIT(MIN_SIZE_LOG2)
     };
 
     int             hashShift;          /* multiplicative hash shift */
 
     uint32          entryCount;         /* number of entries in table */
     uint32          removedCount;       /* removed entry sentinels in table */
-    uint32          freeslot;           /* SHAPE_INVALID_SLOT or head of slot
+    uint32          freelist;           /* SHAPE_INVALID_SLOT or head of slot
                                            freelist in owning dictionary-mode
                                            object */
     js::Shape       **entries;          /* table of ptrs to shared tree nodes */
 
     PropertyTable(uint32 nentries)
       : hashShift(JS_DHASH_BITS - MIN_SIZE_LOG2),
         entryCount(nentries),
         removedCount(0),
-        freeslot(SHAPE_INVALID_SLOT)
+        freelist(SHAPE_INVALID_SLOT)
     {
         /* NB: entries is set by init, which must be called. */
     }
 
     ~PropertyTable() {
         js_free(entries);
     }
 
@@ -356,65 +356,65 @@ struct Shape : public JSObjectMap
     inline void removeFromDictionary(JSObject *obj) const;
     inline void insertIntoDictionary(js::Shape **dictp);
 
     js::Shape *getChild(JSContext *cx, const js::Shape &child, js::Shape **listp);
 
     bool maybeHash(JSContext *cx);
 
     void setTable(js::PropertyTable *t) const {
-        JS_ASSERT_IF(t && t->freeslot != SHAPE_INVALID_SLOT, t->freeslot < freeslot);
+        JS_ASSERT_IF(t && t->freelist != SHAPE_INVALID_SLOT, t->freelist < slotSpan);
         table = t;
     }
 
     /*
-     * Setter for parent. The challenge is to maintain JSObjectMap::freeslot in
+     * Setter for parent. The challenge is to maintain JSObjectMap::slotSpan in
      * the face of arbitrary slot order.
      *
-     * By induction, an empty shape has a freeslot member correctly computed as
+     * By induction, an empty shape has a slotSpan member correctly computed as
      * JSCLASS_FREE(clasp) -- see EmptyShape's constructor in jsscopeinlines.h.
      * This is the basis case, where p is null.
      *
      * Any child shape, whether in a shape tree or in a dictionary list, must
-     * have a freeslot either one greater than its slot value (if the child's
+     * have a slotSpan either one greater than its slot value (if the child's
      * slot is SHAPE_INVALID_SLOT, this will yield 0; the static assertion just
      * after the SHAPE_INVALID_SLOT definition enforces this), or equal to its
-     * parent p's freeslot, whichever is greater. This is the inductive step.
+     * parent p's slotSpan, whichever is greater. This is the inductive step.
      *
      * If we maintained shape paths such that parent slot was always one less
      * than child slot, possibly with an exception for SHAPE_INVALID_SLOT slot
-     * values where we would use another way of computing freeslot based on the
-     * PropertyTable (as JSC does), then we would not need to store freeslot in
+     * values where we would use another way of computing slotSpan based on the
+     * PropertyTable (as JSC does), then we would not need to store slotSpan in
      * Shape (to be precise, in its base struct, JSobjectMap).
      *
      * But we currently scramble slots along shape paths due to resolve-based
      * creation of shapes mapping reserved slots, and we do not have the needed
      * PropertyTable machinery to use as an alternative when parent slot is not
      * one less than child slot. This machinery is neither simple nor free, as
      * it must involve creating a table for any slot-less transition and then
      * pinning the table to its shape.
      *
      * Use of 'delete' can scramble slots along the shape lineage too, although
      * it always switches the target object to dictionary mode, so the cost of
      * a pinned table is less onerous.
      *
-     * Note that allocating a uint32 freeslot member in JSObjectMap takes no
+     * Note that allocating a uint32 slotSpan member in JSObjectMap takes no
      * net extra space on 64-bit targets (it packs with shape). And on 32-bit
-     * targets, adding freeslot to JSObjectMap takes no gross extra space,
+     * targets, adding slotSpan to JSObjectMap takes no gross extra space,
      * because Shape rounds up to an even number of 32-bit words (required for
      * GC-thing and js::Value allocation in any event) on 32-bit targets.
      *
-     * So in terms of space, we can afford to maintain both freeslot and slot,
-     * but it might be better if we eliminated freeslot using slot combined
+     * So in terms of space, we can afford to maintain both slotSpan and slot,
+     * but it might be better if we eliminated slotSpan using slot combined
      * with an auxiliary mechanism based on table.
      */
     void setParent(js::Shape *p) {
         if (p)
-            freeslot = JS_MAX(p->freeslot, slot + 1);
-        JS_ASSERT(freeslot < JSObject::NSLOTS_LIMIT);
+            slotSpan = JS_MAX(p->slotSpan, slot + 1);
+        JS_ASSERT(slotSpan < JSObject::NSLOTS_LIMIT);
         parent = p;
     }
 
     void insertFree(js::Shape **freep) {
         id = JSID_VOID;
         parent = *freep;
         if (parent)
             parent->listp = &parent;
@@ -485,17 +485,17 @@ struct Shape : public JSObjectMap
         /* Property stored in per-object dictionary, not shared property tree. */
         IN_DICTIONARY   = 0x08,
 
         /* Prevent unwanted mutation of shared JSFunction::u.i.names nodes. */
         FROZEN          = 0x10
     };
 
     Shape(jsid id, js::PropertyOp getter, js::PropertyOp setter, uint32 slot, uintN attrs,
-          uintN flags, intN shortid, uint32 shape = INVALID_SHAPE, uint32 freeslot = 0);
+          uintN flags, intN shortid, uint32 shape = INVALID_SHAPE, uint32 slotSpan = 0);
 
     /* Used by EmptyShape (see jsscopeinlines.h). */
     Shape(JSContext *cx, Class *aclasp);
 
     bool marked() const         { return (flags & MARK) != 0; }
     void mark() const           { flags |= MARK; }
     void clearMark()            { flags &= ~MARK; }
 
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -140,22 +140,22 @@ JSObject::trace(JSTracer *trc)
         shape->trace(trc);
     } while ((shape = shape->parent) != NULL);
 }
 
 namespace js {
 
 inline
 Shape::Shape(jsid id, js::PropertyOp getter, js::PropertyOp setter, uint32 slot, uintN attrs,
-             uintN flags, intN shortid, uint32 shape, uint32 freeslot)
-  : JSObjectMap(shape, freeslot),
+             uintN flags, intN shortid, uint32 shape, uint32 slotSpan)
+  : JSObjectMap(shape, slotSpan),
     table(NULL), id(id), rawGetter(getter), rawSetter(setter), slot(slot), attrs(uint8(attrs)),
     flags(uint8(flags)), shortid(int16(shortid)), parent(NULL)
 {
-    JS_ASSERT_IF(freeslot != SHAPE_INVALID_SLOT, freeslot < JSObject::NSLOTS_LIMIT);
+    JS_ASSERT_IF(slotSpan != SHAPE_INVALID_SLOT, slotSpan < JSObject::NSLOTS_LIMIT);
     JS_ASSERT_IF(getter && (attrs & JSPROP_GETTER), getterObj->isCallable());
     JS_ASSERT_IF(setter && (attrs & JSPROP_SETTER), setterObj->isCallable());
     kids.setNull();
 }
 
 inline
 Shape::Shape(JSContext *cx, Class *aclasp)
   : JSObjectMap(js_GenerateShape(cx, false), JSSLOT_FREE(aclasp)), table(NULL),
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -192,17 +192,17 @@ stubs::SetName(VMFrame &f, JSAtom *origA
                         THROW();
                 }
 
                 uint32 slot;
                 if (shape->previous() == obj->lastProperty() &&
                     entry->vshape() == cx->runtime->protoHazardShape &&
                     shape->hasDefaultSetter()) {
                     slot = shape->slot;
-                    JS_ASSERT(slot == obj->freeslot());
+                    JS_ASSERT(slot == obj->slotSpan());
 
                     /*
                      * Fast path: adding a plain old property that was once at
                      * the frontier of the property tree, whose slot is next to
                      * claim among the already-allocated slots in obj, where
                      * shape->table has not been created yet.
                      */
                     PCMETER(cache->pchits++);
@@ -2174,17 +2174,17 @@ InitPropOrMethod(VMFrame &f, JSAtom *ato
     if (CX_OWNS_OBJECT_TITLE(cx, obj) &&
         JS_PROPERTY_CACHE(cx).testForInit(rt, regs.pc, obj, &shape, &entry) &&
         shape->hasDefaultSetter() &&
         shape->previous() == obj->lastProperty())
     {
         /* Fast path. Property cache hit. */
         uint32 slot = shape->slot;
 
-        JS_ASSERT(slot == obj->freeslot());
+        JS_ASSERT(slot == obj->slotSpan());
         JS_ASSERT(slot >= JSSLOT_FREE(obj->getClass()));
         if (slot < obj->numSlots()) {
             JS_ASSERT(obj->getSlot(slot).isUndefined());
         } else {
             if (!obj->allocSlot(cx, &slot))
                 THROW();
             JS_ASSERT(slot == shape->slot);
         }