Backed out changeset b8137cbaf9cf (bug 1532946) for causing bug 1534118.
authorGurzau Raul <rgurzau@mozilla.com>
Mon, 11 Mar 2019 08:54:20 +0200
changeset 521296 1072bbe0b8c4
parent 521295 2bec5d831e88
child 521307 06e2967e09ef
push id10862
push userffxbld-merge
push dateMon, 11 Mar 2019 13:01:11 +0000
treeherdermozilla-beta@a2e7f5c935da [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1532946, 1534118
milestone67.0a1
backs outb8137cbaf9cf
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset b8137cbaf9cf (bug 1532946) for causing bug 1534118.
js/src/builtin/TypedObject.cpp
js/src/gc/Allocator.cpp
js/src/gc/Allocator.h
js/src/jit/CodeGenerator.cpp
js/src/vm/ArrayObject-inl.h
js/src/vm/Caches-inl.h
js/src/vm/JSFunction-inl.h
js/src/vm/NativeObject-inl.h
js/src/vm/ProxyObject.cpp
js/src/vm/StringType-inl.h
js/src/vm/UnboxedObject.cpp
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -2312,17 +2312,17 @@ bool TypedObject::construct(JSContext* c
     JSContext* cx, js::gc::AllocKind kind, js::gc::InitialHeap heap,
     js::HandleShape shape, js::HandleObjectGroup group) {
   debugCheckNewObject(group, shape, kind, heap);
 
   const js::Class* clasp = group->clasp();
   MOZ_ASSERT(::IsTypedObjectClass(clasp));
 
   JSObject* obj =
-      js::AllocateObject(cx, kind, /* nDynamicSlots = */ 0, heap, clasp);
+      js::Allocate<JSObject>(cx, kind, /* nDynamicSlots = */ 0, heap, clasp);
   if (!obj) {
     return cx->alreadyReportedOOM();
   }
 
   TypedObject* tobj = static_cast<TypedObject*>(obj);
   tobj->initGroup(group);
   tobj->initShape(shape);
 
--- a/js/src/gc/Allocator.cpp
+++ b/js/src/gc/Allocator.cpp
@@ -20,19 +20,21 @@
 #include "gc/ArenaList-inl.h"
 #include "gc/Heap-inl.h"
 #include "gc/PrivateIterators-inl.h"
 #include "vm/JSObject-inl.h"
 
 using namespace js;
 using namespace gc;
 
-template <AllowGC allowGC /* = CanGC */>
-JSObject* js::AllocateObject(JSContext* cx, AllocKind kind, size_t nDynamicSlots,
-                             InitialHeap heap, const Class* clasp) {
+template <typename T, AllowGC allowGC /* = CanGC */>
+JSObject* js::Allocate(JSContext* cx, AllocKind kind, size_t nDynamicSlots,
+                       InitialHeap heap, const Class* clasp) {
+  static_assert(mozilla::IsConvertible<T*, JSObject*>::value,
+                "must be JSObject derived");
   MOZ_ASSERT(IsObjectAllocKind(kind));
   size_t thingSize = Arena::thingSize(kind);
 
   MOZ_ASSERT(thingSize == Arena::thingSize(kind));
   MOZ_ASSERT(thingSize >= sizeof(JSObject_Slots0));
   static_assert(
       sizeof(JSObject_Slots0) >= MinCellSize,
       "All allocations must be at least the allocator-imposed minimum size.");
@@ -70,26 +72,26 @@ JSObject* js::AllocateObject(JSContext* 
     if (!allowGC) {
       return nullptr;
     }
   }
 
   return GCRuntime::tryNewTenuredObject<allowGC>(cx, kind, thingSize,
                                                  nDynamicSlots);
 }
-template JSObject* js::AllocateObject<NoGC>(JSContext* cx,
-                                            gc::AllocKind kind,
-                                            size_t nDynamicSlots,
-                                            gc::InitialHeap heap,
-                                            const Class* clasp);
-template JSObject* js::AllocateObject<CanGC>(JSContext* cx,
-                                               gc::AllocKind kind,
-                                               size_t nDynamicSlots,
-                                               gc::InitialHeap heap,
-                                               const Class* clasp);
+template JSObject* js::Allocate<JSObject, NoGC>(JSContext* cx,
+                                                gc::AllocKind kind,
+                                                size_t nDynamicSlots,
+                                                gc::InitialHeap heap,
+                                                const Class* clasp);
+template JSObject* js::Allocate<JSObject, CanGC>(JSContext* cx,
+                                                 gc::AllocKind kind,
+                                                 size_t nDynamicSlots,
+                                                 gc::InitialHeap heap,
+                                                 const Class* clasp);
 
 // Attempt to allocate a new JSObject out of the nursery. If there is not
 // enough room in the nursery or there is an OOM, this method will return
 // nullptr.
 template <AllowGC allowGC>
 JSObject* GCRuntime::tryNewNurseryObject(JSContext* cx, size_t thingSize,
                                          size_t nDynamicSlots,
                                          const Class* clasp) {
@@ -170,17 +172,17 @@ JSString* GCRuntime::tryNewNurseryString
       return static_cast<JSString*>(
           cx->nursery().allocateString(cx->zone(), thingSize, kind));
     }
   }
   return nullptr;
 }
 
 template <typename StringAllocT, AllowGC allowGC /* = CanGC */>
-StringAllocT* js::AllocateStringImpl(JSContext* cx, InitialHeap heap) {
+StringAllocT* js::AllocateString(JSContext* cx, InitialHeap heap) {
   static_assert(mozilla::IsConvertible<StringAllocT*, JSString*>::value,
                 "must be JSString derived");
 
   AllocKind kind = MapTypeToFinalizeKind<StringAllocT>::kind;
   size_t size = sizeof(StringAllocT);
   MOZ_ASSERT(size == Arena::thingSize(kind));
   MOZ_ASSERT(size == sizeof(JSString) || size == sizeof(JSFatInlineString));
 
@@ -217,20 +219,20 @@ StringAllocT* js::AllocateStringImpl(JSC
     }
   }
 
   return GCRuntime::tryNewTenuredThing<StringAllocT, allowGC>(cx, kind, size);
 }
 
 #define DECL_ALLOCATOR_INSTANCES(allocKind, traceKind, type, sizedType, \
                                  bgfinal, nursery, compact)             \
-  template type* js::AllocateStringImpl<type, NoGC>(JSContext * cx,     \
-                                                    InitialHeap heap);  \
-  template type* js::AllocateStringImpl<type, CanGC>(JSContext * cx,    \
-                                                     InitialHeap heap);
+  template type* js::AllocateString<type, NoGC>(JSContext * cx,         \
+                                                InitialHeap heap);      \
+  template type* js::AllocateString<type, CanGC>(JSContext * cx,        \
+                                                 InitialHeap heap);
 FOR_EACH_NURSERY_STRING_ALLOCKIND(DECL_ALLOCATOR_INSTANCES)
 #undef DECL_ALLOCATOR_INSTANCES
 
 template <typename T, AllowGC allowGC /* = CanGC */>
 T* js::Allocate(JSContext* cx) {
   static_assert(!mozilla::IsConvertible<T*, JSObject*>::value,
                 "must not be JSObject derived");
   static_assert(
--- a/js/src/gc/Allocator.h
+++ b/js/src/gc/Allocator.h
@@ -12,59 +12,54 @@
 #include "js/RootingAPI.h"
 
 class JSFatInlineString;
 
 namespace js {
 
 struct Class;
 
-// Allocate a new GC thing that's not a JSObject or a string.
-//
-// After a successful allocation the caller must fully initialize the thing
-// before calling any function that can potentially trigger GC. This will ensure
-// that GC tracing never sees junk values stored in the partially initialized
-// thing.
+// Allocate a new GC thing. After a successful allocation the caller must
+// fully initialize the thing before calling any function that can potentially
+// trigger GC. This will ensure that GC tracing never sees junk values stored
+// in the partially initialized thing.
+
 template <typename T, AllowGC allowGC = CanGC>
 T* Allocate(JSContext* cx);
 
-// Allocate a JSObject.
-//
-// A longer signature that includes additional information in support of various
-// optimizations. If dynamic slots are requested they will be allocated and the
-// pointer stored directly in |NativeObject::slots_|.
-template <AllowGC allowGC = CanGC>
-JSObject* AllocateObject(JSContext* cx, gc::AllocKind kind, size_t nDynamicSlots,
-                         gc::InitialHeap heap, const Class* clasp);
+// Use for JSObject. A longer signature that includes additional information in
+// support of various optimizations. If dynamic slots are requested they will be
+// allocated and the pointer stored directly in |NativeObject::slots_|.
+template <typename, AllowGC allowGC = CanGC>
+JSObject* Allocate(JSContext* cx, gc::AllocKind kind, size_t nDynamicSlots,
+                   gc::InitialHeap heap, const Class* clasp);
 
 // Internal function used for nursery-allocatable strings.
 template <typename StringAllocT, AllowGC allowGC = CanGC>
-StringAllocT* AllocateStringImpl(JSContext* cx, gc::InitialHeap heap);
+StringAllocT* AllocateString(JSContext* cx, gc::InitialHeap heap);
 
-// Allocate a string.
-//
 // Use for nursery-allocatable strings. Returns a value cast to the correct
 // type.
 template <typename StringT, AllowGC allowGC = CanGC>
-StringT* AllocateString(JSContext* cx, gc::InitialHeap heap) {
-  return static_cast<StringT*>(AllocateStringImpl<JSString, allowGC>(cx, heap));
+StringT* Allocate(JSContext* cx, gc::InitialHeap heap) {
+  return static_cast<StringT*>(js::AllocateString<JSString, allowGC>(cx, heap));
 }
 
 // Specialization for JSFatInlineString that must use a different allocation
 // type. Note that we have to explicitly specialize for both values of AllowGC
 // because partial function specialization is not allowed.
 template <>
-inline JSFatInlineString* AllocateString<JSFatInlineString, CanGC>(
+inline JSFatInlineString* Allocate<JSFatInlineString, CanGC>(
     JSContext* cx, gc::InitialHeap heap) {
   return static_cast<JSFatInlineString*>(
-      js::AllocateStringImpl<JSFatInlineString, CanGC>(cx, heap));
+      js::AllocateString<JSFatInlineString, CanGC>(cx, heap));
 }
 
 template <>
-inline JSFatInlineString* AllocateString<JSFatInlineString, NoGC>(
+inline JSFatInlineString* Allocate<JSFatInlineString, NoGC>(
     JSContext* cx, gc::InitialHeap heap) {
   return static_cast<JSFatInlineString*>(
-      js::AllocateStringImpl<JSFatInlineString, NoGC>(cx, heap));
+      js::AllocateString<JSFatInlineString, NoGC>(cx, heap));
 }
 
 }  // namespace js
 
 #endif  // gc_Allocator_h
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -2397,22 +2397,22 @@ void CreateDependentString::generate(Mac
     masm.PopRegsInMask(regsToSave);
   }
 
   masm.bind(&done);
 }
 
 static void* AllocateString(JSContext* cx) {
   AutoUnsafeCallWithABI unsafe;
-  return js::AllocateString<JSString, NoGC>(cx, js::gc::TenuredHeap);
+  return js::Allocate<JSString, NoGC>(cx, js::gc::TenuredHeap);
 }
 
 static void* AllocateFatInlineString(JSContext* cx) {
   AutoUnsafeCallWithABI unsafe;
-  return js::AllocateString<JSFatInlineString, NoGC>(cx, js::gc::TenuredHeap);
+  return js::Allocate<JSFatInlineString, NoGC>(cx, js::gc::TenuredHeap);
 }
 
 void CreateDependentString::generateFallback(MacroAssembler& masm) {
   JitSpew(JitSpew_Codegen,
           "# Emitting CreateDependentString fallback (encoding=%s)",
           (encoding_ == CharEncoding::Latin1 ? "Latin-1" : "Two-Byte"));
 
   LiveRegisterSet regsToSave(RegisterSet::Volatile());
@@ -2438,18 +2438,18 @@ void CreateDependentString::generateFall
 
     masm.jump(&joins_[kind]);
   }
 }
 
 static void* CreateMatchResultFallbackFunc(JSContext* cx, gc::AllocKind kind,
                                            size_t nDynamicSlots) {
   AutoUnsafeCallWithABI unsafe;
-  return js::AllocateObject<NoGC>(cx, kind, nDynamicSlots, gc::DefaultHeap,
-                                  &ArrayObject::class_);
+  return js::Allocate<JSObject, NoGC>(cx, kind, nDynamicSlots, gc::DefaultHeap,
+                                      &ArrayObject::class_);
 }
 
 static void CreateMatchResultFallback(MacroAssembler& masm, Register object,
                                       Register temp1, Register temp2,
                                       const TemplateObject& templateObject,
                                       Label* fail) {
   JitSpew(JitSpew_Codegen, "# Emitting CreateMatchResult fallback");
 
--- a/js/src/vm/ArrayObject-inl.h
+++ b/js/src/vm/ArrayObject-inl.h
@@ -45,17 +45,17 @@ inline void ArrayObject::setLength(JSCon
   MOZ_ASSERT_IF(group->shouldPreTenureDontCheckGeneration(),
                 heap == gc::TenuredHeap);
 
   // Arrays can use their fixed slots to store elements, so can't have shapes
   // which allow named properties to be stored in the fixed slots.
   MOZ_ASSERT(shape->numFixedSlots() == 0);
 
   size_t nDynamicSlots = dynamicSlotsCount(0, shape->slotSpan(), clasp);
-  JSObject* obj = js::AllocateObject(cx, kind, nDynamicSlots, heap, clasp);
+  JSObject* obj = js::Allocate<JSObject>(cx, kind, nDynamicSlots, heap, clasp);
   if (!obj) {
     return nullptr;
   }
 
   ArrayObject* aobj = static_cast<ArrayObject*>(obj);
   aobj->initGroup(group);
   aobj->initShape(shape);
   // NOTE: Dynamic slots are created internally by Allocate<JSObject>.
--- a/js/src/vm/Caches-inl.h
+++ b/js/src/vm/Caches-inl.h
@@ -68,18 +68,18 @@ inline NativeObject* NewObjectCache::new
     }
   }
 
   if (cx->runtime()->gc.upcomingZealousGC()) {
     return nullptr;
   }
 
   NativeObject* obj = static_cast<NativeObject*>(
-      AllocateObject<NoGC>(cx, entry->kind, /* nDynamicSlots = */ 0,
-                           heap, group->clasp()));
+      Allocate<JSObject, NoGC>(cx, entry->kind,
+                               /* nDynamicSlots = */ 0, heap, group->clasp()));
   if (!obj) {
     return nullptr;
   }
 
   copyCachedToObject(obj, templateObj, entry->kind);
 
   if (group->clasp()->shouldDelayMetadataBuilder()) {
     cx->realm()->setObjectPendingMetadata(cx, obj);
--- a/js/src/vm/JSFunction-inl.h
+++ b/js/src/vm/JSFunction-inl.h
@@ -108,17 +108,18 @@ inline JSFunction* CloneFunctionObjectIf
 
   const js::Class* clasp = group->clasp();
   MOZ_ASSERT(clasp->isJSFunction());
 
   static constexpr size_t NumDynamicSlots = 0;
   MOZ_ASSERT(dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan(),
                                clasp) == NumDynamicSlots);
 
-  JSObject* obj = js::AllocateObject(cx, kind, NumDynamicSlots, heap, clasp);
+  JSObject* obj =
+      js::Allocate<JSObject>(cx, kind, NumDynamicSlots, heap, clasp);
   if (!obj) {
     return cx->alreadyReportedOOM();
   }
 
   NativeObject* nobj = static_cast<NativeObject*>(obj);
   nobj->initGroup(group);
   nobj->initShape(shape);
 
--- a/js/src/vm/NativeObject-inl.h
+++ b/js/src/vm/NativeObject-inl.h
@@ -483,17 +483,17 @@ inline bool NativeObject::isInWholeCellB
 
   const js::Class* clasp = group->clasp();
   MOZ_ASSERT(clasp->isNative());
   MOZ_ASSERT(!clasp->isJSFunction(), "should use JSFunction::create");
 
   size_t nDynamicSlots =
       dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan(), clasp);
 
-  JSObject* obj = js::AllocateObject(cx, kind, nDynamicSlots, heap, clasp);
+  JSObject* obj = js::Allocate<JSObject>(cx, kind, nDynamicSlots, heap, clasp);
   if (!obj) {
     return cx->alreadyReportedOOM();
   }
 
   NativeObject* nobj = static_cast<NativeObject*>(obj);
   nobj->initGroup(group);
   nobj->initShape(shape);
   // NOTE: Dynamic slots are created internally by Allocate<JSObject>.
--- a/js/src/vm/ProxyObject.cpp
+++ b/js/src/vm/ProxyObject.cpp
@@ -182,18 +182,18 @@ void ProxyObject::nuke() {
 
     MOZ_ASSERT(group->realm() == realm);
     realm->newProxyCache.add(group, shape);
   }
 
   gc::InitialHeap heap = GetInitialHeap(newKind, group);
   debugCheckNewObject(group, shape, allocKind, heap);
 
-  JSObject* obj = js::AllocateObject(cx, allocKind, /* nDynamicSlots = */ 0,
-                                     heap, clasp);
+  JSObject* obj = js::Allocate<JSObject>(cx, allocKind, /* nDynamicSlots = */ 0,
+                                         heap, clasp);
   if (!obj) {
     return cx->alreadyReportedOOM();
   }
 
   ProxyObject* pobj = static_cast<ProxyObject*>(obj);
   pobj->initGroup(group);
   pobj->initShape(shape);
 
--- a/js/src/vm/StringType-inl.h
+++ b/js/src/vm/StringType-inl.h
@@ -154,17 +154,17 @@ template <js::AllowGC allowGC>
 MOZ_ALWAYS_INLINE JSRope* JSRope::new_(
     JSContext* cx,
     typename js::MaybeRooted<JSString*, allowGC>::HandleType left,
     typename js::MaybeRooted<JSString*, allowGC>::HandleType right,
     size_t length, js::gc::InitialHeap heap) {
   if (!validateLength(cx, length)) {
     return nullptr;
   }
-  JSRope* str = js::AllocateString<JSRope, allowGC>(cx, heap);
+  JSRope* str = js::Allocate<JSRope, allowGC>(cx, heap);
   if (!str) {
     return nullptr;
   }
   str->init(cx, left, right, length);
   return str;
 }
 
 MOZ_ALWAYS_INLINE void JSDependentString::init(JSContext* cx,
@@ -215,25 +215,25 @@ MOZ_ALWAYS_INLINE JSLinearString* JSDepe
                : js::NewInlineString<char16_t>(cx, base, start, length);
   }
 
   if (baseArg->isExternal() && !baseArg->ensureFlat(cx)) {
     return nullptr;
   }
 
   JSDependentString* str =
-      js::AllocateString<JSDependentString, js::NoGC>(cx, js::gc::DefaultHeap);
+      js::Allocate<JSDependentString, js::NoGC>(cx, js::gc::DefaultHeap);
   if (str) {
     str->init(cx, baseArg, start, length);
     return str;
   }
 
   js::RootedLinearString base(cx, baseArg);
 
-  str = js::AllocateString<JSDependentString>(cx, js::gc::DefaultHeap);
+  str = js::Allocate<JSDependentString>(cx, js::gc::DefaultHeap);
   if (!str) {
     return nullptr;
   }
   str->init(cx, base, start, length);
   return str;
 }
 
 MOZ_ALWAYS_INLINE void JSFlatString::init(const char16_t* chars,
@@ -257,17 +257,17 @@ MOZ_ALWAYS_INLINE JSFlatString* JSFlatSt
   if (!validateLength(cx, length)) {
     return nullptr;
   }
 
   JSFlatString* str;
   if (cx->zone()->isAtomsZone()) {
     str = js::Allocate<js::NormalAtom, allowGC>(cx);
   } else {
-    str = js::AllocateString<JSFlatString, allowGC>(cx, js::gc::DefaultHeap);
+    str = js::Allocate<JSFlatString, allowGC>(cx, js::gc::DefaultHeap);
   }
   if (!str) {
     return nullptr;
   }
 
   if (!str->isTenured()) {
     // The chars pointer is only considered to be handed over to this
     // function on a successful return. If the following registration
@@ -303,26 +303,26 @@ inline js::PropertyName* JSFlatString::t
 }
 
 template <js::AllowGC allowGC>
 MOZ_ALWAYS_INLINE JSThinInlineString* JSThinInlineString::new_(JSContext* cx) {
   if (cx->zone()->isAtomsZone()) {
     return (JSThinInlineString*)(js::Allocate<js::NormalAtom, allowGC>(cx));
   }
 
-  return js::AllocateString<JSThinInlineString, allowGC>(cx, js::gc::DefaultHeap);
+  return js::Allocate<JSThinInlineString, allowGC>(cx, js::gc::DefaultHeap);
 }
 
 template <js::AllowGC allowGC>
 MOZ_ALWAYS_INLINE JSFatInlineString* JSFatInlineString::new_(JSContext* cx) {
   if (cx->zone()->isAtomsZone()) {
     return (JSFatInlineString*)(js::Allocate<js::FatInlineAtom, allowGC>(cx));
   }
 
-  return js::AllocateString<JSFatInlineString, allowGC>(cx, js::gc::DefaultHeap);
+  return js::Allocate<JSFatInlineString, allowGC>(cx, js::gc::DefaultHeap);
 }
 
 template <>
 MOZ_ALWAYS_INLINE JS::Latin1Char* JSThinInlineString::init<JS::Latin1Char>(
     size_t length) {
   MOZ_ASSERT(lengthFits<JS::Latin1Char>(length));
   setLengthAndFlags(length, INIT_THIN_INLINE_FLAGS | LATIN1_CHARS_BIT);
   return d.inlineStorageLatin1;
--- a/js/src/vm/UnboxedObject.cpp
+++ b/js/src/vm/UnboxedObject.cpp
@@ -841,17 +841,17 @@ NativeObject* UnboxedPlainObject::conver
   MOZ_ASSERT(clasp == &UnboxedPlainObject::class_);
 
   MOZ_ASSERT(CanBeFinalizedInBackground(kind, clasp));
   kind = GetBackgroundAllocKind(kind);
 
   debugCheckNewObject(group, /* shape = */ nullptr, kind, heap);
 
   JSObject* obj =
-      js::AllocateObject(cx, kind, /* nDynamicSlots = */ 0, heap, clasp);
+      js::Allocate<JSObject>(cx, kind, /* nDynamicSlots = */ 0, heap, clasp);
   if (!obj) {
     return cx->alreadyReportedOOM();
   }
 
   UnboxedObject* uobj = static_cast<UnboxedObject*>(obj);
   uobj->initGroup(group);
 
   MOZ_ASSERT(clasp->shouldDelayMetadataBuilder());