Bug 1480521 - Backport fixes from Bug 1479900. r=sfink, a=IanN CLOSED TREE DONTBUILD SEAMONKEY_2_49_ESR_RELBRANCH
authorTed Campbell <tcampbell@mozilla.com>
Wed, 22 Aug 2018 09:46:21 -0400
branchSEAMONKEY_2_49_ESR_RELBRANCH
changeset 357541 14da0f87d12c12f6ef9f8e82128d6ce500a2bba2
parent 357540 ad03f53f55099a25dcc19a59844623b3adb95932
child 357542 d9407a1c48594c6ed20e7cbb4f8c24854afe0484
push id7834
push userfrgrahl@gmx.net
push dateSun, 13 Jan 2019 12:17:02 +0000
treeherdermozilla-esr52@6e4ad8a8f2e8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink, IanN
bugs1480521, 1479900
milestone52.9.1
Bug 1480521 - Backport fixes from Bug 1479900. r=sfink, a=IanN CLOSED TREE DONTBUILD mozilla-esr52 SEAMONKEY_2_49_ESR_RELBRANCH
js/src/jsfriendapi.h
js/src/vm/Shape.h
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -562,17 +562,18 @@ struct ObjectGroup {
 struct BaseShape {
     const js::Class* clasp_;
     JSObject* parent;
 };
 
 class Shape {
 public:
     shadow::BaseShape* base;
-    jsid              _1;
+    void*             _1;
+    jsid              _2;
     uint32_t          slotInfo;
 
     static const uint32_t FIXED_SLOTS_SHIFT = 27;
 };
 
 /**
  * This layout is shared by all native objects. For non-native objects, the
  * group may always be accessed safely, and other members may be as well,
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -602,16 +602,17 @@ class Shape : public gc::TenuredCell
     friend class TenuringTracer;
     friend struct StackBaseShape;
     friend struct StackShape;
     friend class JS::ubi::Concrete<Shape>;
     friend class js::gc::RelocationOverlay;
 
   protected:
     GCPtrBaseShape base_;
+    GCPtrShape parent;
     PreBarrieredId propid_;
 
     enum SlotInfo : uint32_t
     {
         /* Number of fixed slots in objects with this shape. */
         // FIXED_SLOTS_MAX is the biggest count of fixed slots a Shape can store
         FIXED_SLOTS_MAX        = 0x1f,
         FIXED_SLOTS_SHIFT      = 27,
@@ -635,17 +636,16 @@ class Shape : public gc::TenuredCell
          */
         SLOT_MASK              = JS_BIT(24) - 1
     };
 
     uint32_t            slotInfo;       /* mask of above info */
     uint8_t             attrs;          /* attributes, see jsapi.h JSPROP_* */
     uint8_t             flags;          /* flags, see below for defines */
 
-    GCPtrShape   parent;          /* parent node, reverse for..in order */
     /* kids is valid when !inDictionary(), listp is valid when inDictionary(). */
     union {
         KidsPointer kids;         /* null, single child, or a tagged ptr
                                      to many-kids data structure */
         GCPtrShape* listp;        /* dictionary list starting at shape_
                                      has a double-indirect back pointer,
                                      either to the next shape's parent if not
                                      last, else to obj->shape_ */
@@ -1398,21 +1398,22 @@ class HandleBase<StackShape> : public St
 template <>
 class MutableHandleBase<StackShape>
   : public MutableStackShapeOperations<JS::MutableHandle<StackShape>>
 {};
 
 inline
 Shape::Shape(const StackShape& other, uint32_t nfixed)
   : base_(other.base),
+    parent(nullptr),
     propid_(other.propid),
     slotInfo(other.maybeSlot() | (nfixed << FIXED_SLOTS_SHIFT)),
     attrs(other.attrs),
-    flags(other.flags),
-    parent(nullptr)
+    flags(other.flags)
+
 {
 #ifdef DEBUG
     gc::AllocKind allocKind = getAllocKind();
     MOZ_ASSERT_IF(other.isAccessorShape(), allocKind == gc::AllocKind::ACCESSOR_SHAPE);
     MOZ_ASSERT_IF(allocKind == gc::AllocKind::SHAPE, !other.isAccessorShape());
 #endif
 
     MOZ_ASSERT_IF(attrs & (JSPROP_GETTER | JSPROP_SETTER), attrs & JSPROP_SHARED);
@@ -1459,21 +1460,21 @@ AccessorShape::AccessorShape(const Stack
 {
     MOZ_ASSERT(getAllocKind() == gc::AllocKind::ACCESSOR_SHAPE);
     GetterSetterWriteBarrierPost(this);
 }
 
 inline
 Shape::Shape(UnownedBaseShape* base, uint32_t nfixed)
   : base_(base),
+    parent(nullptr),
     propid_(JSID_EMPTY),
     slotInfo(SHAPE_INVALID_SLOT | (nfixed << FIXED_SLOTS_SHIFT)),
     attrs(JSPROP_SHARED),
-    flags(0),
-    parent(nullptr)
+    flags(0)
 {
     MOZ_ASSERT(base);
     kids.setNull();
 }
 
 inline GetterOp
 Shape::getter() const
 {