Bug 839376 (part 7) - Fix seven more easy rooting hazards. r=sfink.
authorNicholas Nethercote <nnethercote@mozilla.com>
Tue, 12 Feb 2013 14:59:33 -0800
changeset 131575 e650f1bab42bb3aa17ca613ed41b154e4974edfd
parent 131574 ba8f0f70166643d4dc840a45926335c053a907f8
child 131576 edea345c7c6b593d72cc7c1819c09d84256a47c6
push id2323
push userbbajaj@mozilla.com
push dateMon, 01 Apr 2013 19:47:02 +0000
treeherdermozilla-beta@7712be144d91 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs839376
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 839376 (part 7) - Fix seven more easy rooting hazards. r=sfink.
js/src/jsobj.cpp
js/src/vm/ObjectImpl.cpp
js/src/vm/ScopeObject.cpp
js/src/vm/Shape.cpp
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -2899,17 +2899,17 @@ js_GetClassObject(JSContext *cx, RawObje
     RootedId name(cx, NameToId(ClassName(key, cx)));
     AutoResolving resolving(cx, global, name);
     if (resolving.alreadyStarted()) {
         /* Already caching id in global -- suppress recursion. */
         objp.set(NULL);
         return true;
     }
 
-    JSObject *cobj = NULL;
+    RootedObject cobj(cx, NULL);
     if (JSClassInitializerOp init = lazy_prototype_init[key]) {
         if (!init(cx, global))
             return false;
         v = global->getReservedSlot(key);
         if (v.isObject())
             cobj = &v.toObject();
     }
 
--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -527,21 +527,18 @@ js::GetOwnProperty(JSContext *cx, Handle
 
     Rooted<PropertyId> pid(cx, pid_);
 
     if (static_cast<JSObject *>(obj.get())->isProxy()) {
         MOZ_NOT_REACHED("NYI: proxy [[GetOwnProperty]]");
         return false;
     }
 
-    /* |shape| is always set /after/ a GC. */
-    UnrootedShape shape = obj->nativeLookup(cx, pid);
+    RootedShape shape(cx, obj->nativeLookup(cx, pid));
     if (!shape) {
-        DropUnrooted(shape);
-
         /* Not found: attempt to resolve it. */
         Class *clasp = obj->getClass();
         JSResolveOp resolve = clasp->resolve;
         if (resolve != JS_ResolveStub) {
             Rooted<jsid> id(cx, pid.get().asId());
             Rooted<JSObject*> robj(cx, static_cast<JSObject*>(obj.get()));
             if (clasp->flags & JSCLASS_NEW_RESOLVE) {
                 Rooted<JSObject*> obj2(cx, NULL);
@@ -684,16 +681,17 @@ js::GetProperty(JSContext *cx, Handle<Ob
 bool
 js::GetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> receiver, uint32_t index,
                unsigned resolveFlags, Value *vp)
 {
     NEW_OBJECT_REPRESENTATION_ONLY();
 
     Rooted<ObjectImpl*> current(cx, obj);
 
+    RootedValue getter(cx);
     do {
         MOZ_ASSERT(current);
 
         if (Downcast(current)->isProxy()) {
             MOZ_NOT_REACHED("NYI: proxy [[GetP]]");
             return false;
         }
 
@@ -714,28 +712,28 @@ js::GetElement(JSContext *cx, Handle<Obj
         /* If it's a data property, return the value. */
         if (desc.isDataDescriptor()) {
             *vp = desc.value();
             return true;
         }
 
         /* If it's an accessor property, call its [[Get]] with the receiver. */
         if (desc.isAccessorDescriptor()) {
-            Value get = desc.getterValue();
-            if (get.isUndefined()) {
+            getter = desc.getterValue();
+            if (getter.isUndefined()) {
                 vp->setUndefined();
                 return true;
             }
 
             InvokeArgsGuard args;
             if (!cx->stack.pushInvokeArgs(cx, 0, &args))
                 return false;
 
-            /* Push get, receiver, and no args. */
-            args.setCallee(get);
+            /* Push getter, receiver, and no args. */
+            args.setCallee(getter);
             args.setThis(ObjectValue(*current));
 
             bool ok = Invoke(cx, args);
             *vp = args.rval();
             return ok;
         }
 
         /* Otherwise it's a PropertyOp-based property.  XXX handle this! */
@@ -915,16 +913,17 @@ ArrayBufferElementsHeader::setElement(JS
 
 bool
 js::SetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> receiver,
                uint32_t index, const Value &v, unsigned resolveFlags, bool *succeeded)
 {
     NEW_OBJECT_REPRESENTATION_ONLY();
 
     Rooted<ObjectImpl*> current(cx, obj);
+    RootedValue setter(cx);
 
     MOZ_ASSERT(receiver);
 
     do {
         MOZ_ASSERT(current);
 
         if (Downcast(current)->isProxy()) {
             MOZ_NOT_REACHED("NYI: proxy [[SetP]]");
@@ -948,17 +947,17 @@ js::SetElement(JSContext *cx, Handle<Obj
                                          succeeded);
                 }
 
                 PropDesc newDesc;
                 return DefineElement(cx, receiver, index, newDesc, false, resolveFlags, succeeded);
             }
 
             if (ownDesc.isAccessorDescriptor()) {
-                Value setter = ownDesc.setterValue();
+                setter = ownDesc.setterValue();
                 if (setter.isUndefined()) {
                     *succeeded = false;
                     return true;
                 }
 
                 InvokeArgsGuard args;
                 if (!cx->stack.pushInvokeArgs(cx, 1, &args))
                     return false;
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -1405,33 +1405,32 @@ class DebugScopeProxy : public BaseProxy
             return Throw(cx, id, JSMSG_CANT_REDEFINE_PROP);
 
         return JS_DefinePropertyById(cx, scope, id, desc->value, desc->getter, desc->setter,
                                      desc->attrs);
     }
 
     bool getScopePropertyNames(JSContext *cx, JSObject *proxy, AutoIdVector &props, unsigned flags)
     {
-        ScopeObject &scope = proxy->asDebugScope().scope();
+        Rooted<ScopeObject*> scope(cx, &proxy->asDebugScope().scope());
 
-        if (isMissingArgumentsBinding(scope)) {
+        if (isMissingArgumentsBinding(*scope)) {
             if (!props.append(NameToId(cx->names().arguments)))
                 return false;
         }
 
-        RootedObject rootedScope(cx, &scope);
-        if (!GetPropertyNames(cx, rootedScope, flags, &props))
+        if (!GetPropertyNames(cx, scope, flags, &props))
             return false;
 
         /*
          * Function scopes are optimized to not contain unaliased variables so
          * they must be manually appended here.
          */
-        if (scope.isCall() && !scope.asCall().isForEval()) {
-            RootedScript script(cx, scope.asCall().callee().nonLazyScript());
+        if (scope->isCall() && !scope->asCall().isForEval()) {
+            RootedScript script(cx, scope->asCall().callee().nonLazyScript());
             for (BindingIter bi(script); bi; bi++) {
                 if (!bi->aliased() && !props.append(NameToId(bi->name())))
                     return false;
             }
         }
 
         return true;
     }
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -509,37 +509,37 @@ JSObject::addPropertyInternal(JSContext 
             spp = table->search(id, true);
             JS_ASSERT(!SHAPE_FETCH(spp));
         }
     }
 
     JS_ASSERT(!!table == !!spp);
 
     /* Find or create a property tree node labeled by our arguments. */
-    UnrootedShape shape;
+    RootedShape shape(cx);
     {
         RootedShape last(cx, obj->lastProperty());
 
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
 
-        UnrootedUnownedBaseShape nbase;
+        Rooted<UnownedBaseShape*> nbase(cx);
         if (last->base()->matchesGetterSetter(getter, setter) && !indexed) {
             nbase = last->base()->unowned();
         } else {
             StackBaseShape base(last->base());
             base.updateGetterSetter(attrs, getter, setter);
             if (indexed)
                 base.flags |= BaseShape::INDEXED;
             nbase = BaseShape::getUnowned(cx, base);
             if (!nbase)
                 return UnrootedShape(NULL);
         }
 
-        StackShape child(DropUnrooted(nbase), id, slot, obj->numFixedSlots(), attrs, flags, shortid);
+        StackShape child(nbase, id, slot, obj->numFixedSlots(), attrs, flags, shortid);
         shape = getChildProperty(cx, obj, last, child);
     }
 
     if (shape) {
         JS_ASSERT(shape == obj->lastProperty());
 
         if (table) {
             /* Store the tree node pointer in the table entry for id. */