Bug 1394831 part 10 - Simplify addDataProperty's slot argument. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Wed, 08 Nov 2017 15:57:12 +0100
changeset 444010 9d8e2a8c4c03d70aa8aa841d8519a7e31615c5ef
parent 444009 aa132747394e61e607ce2e3bea248c1e66011aea
child 444011 b44bda5764ca8615351259095b33a96f4c07a384
push id1618
push userCallek@gmail.com
push dateThu, 11 Jan 2018 17:45:48 +0000
treeherdermozilla-release@882ca853e05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1394831
milestone58.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1394831 part 10 - Simplify addDataProperty's slot argument. r=bhackett
js/src/jit/IonAnalysis.cpp
js/src/vm/NativeObject.cpp
js/src/vm/Shape.cpp
js/src/vm/UnboxedObject.cpp
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -4075,17 +4075,17 @@ AnalyzePoppedThis(JSContext* cx, ObjectG
             // The prototype chain already contains a getter/setter for this
             // property, or type information is too imprecise.
             return true;
         }
 
         // Add the property to the object, being careful not to update type information.
         DebugOnly<unsigned> slotSpan = baseobj->slotSpan();
         MOZ_ASSERT(!baseobj->containsPure(id));
-        if (!NativeObject::addDataProperty(cx, baseobj, id, baseobj->slotSpan(), JSPROP_ENUMERATE))
+        if (!NativeObject::addDataProperty(cx, baseobj, id, SHAPE_INVALID_SLOT, JSPROP_ENUMERATE))
             return false;
         MOZ_ASSERT(baseobj->slotSpan() != slotSpan);
         MOZ_ASSERT(!baseobj->inDictionaryMode());
 
         Vector<MResumePoint*> callerResumePoints(cx);
         for (MResumePoint* rp = ins->block()->callerResumePoint();
              rp;
              rp = rp->block()->callerResumePoint())
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -476,40 +476,38 @@ NativeObject::sparsifyDenseElement(JSCon
     if (!obj->maybeCopyElementsForWrite(cx))
         return false;
 
     RootedValue value(cx, obj->getDenseElement(index));
     MOZ_ASSERT(!value.isMagic(JS_ELEMENTS_HOLE));
 
     removeDenseElementForSparseIndex(cx, obj, index);
 
-    uint32_t slot = obj->slotSpan();
-
     RootedId id(cx, INT_TO_JSID(index));
 
     AutoKeepShapeTables keep(cx);
     ShapeTable::Entry* entry = nullptr;
     if (obj->inDictionaryMode()) {
         ShapeTable* table = obj->lastProperty()->ensureTableForDictionary(cx, keep);
         if (!table)
             return false;
         entry = &table->search<MaybeAdding::Adding>(id, keep);
     }
 
     // NOTE: We don't use addDataProperty because we don't want the
     // extensibility check if we're, for example, sparsifying frozen objects..
-    if (!addDataPropertyInternal(cx, obj, id, slot,
-                                 obj->getElementsHeader()->elementAttributes(),
-                                 entry, keep)) {
+    Shape* shape = addDataPropertyInternal(cx, obj, id, SHAPE_INVALID_SLOT,
+                                           obj->getElementsHeader()->elementAttributes(),
+                                           entry, keep);
+    if (!shape) {
         obj->setDenseElementUnchecked(index, value);
         return false;
     }
 
-    MOZ_ASSERT(slot == obj->slotSpan() - 1);
-    obj->initSlot(slot, value);
+    obj->initSlot(shape->slot(), value);
 
     return true;
 }
 
 /* static */ bool
 NativeObject::sparsifyDenseElements(JSContext* cx, HandleNativeObject obj)
 {
     if (!obj->maybeCopyElementsForWrite(cx))
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -544,27 +544,27 @@ NativeObject::addAccessorPropertyInterna
 /* static */ Shape*
 NativeObject::addDataPropertyInternal(JSContext* cx,
                                       HandleNativeObject obj, HandleId id,
                                       uint32_t slot, unsigned attrs,
                                       ShapeTable::Entry* entry, const AutoKeepShapeTables& keep)
 {
     AutoCheckShapeConsistency check(obj);
 
+    /* The slot, if any, must be a reserved slot. */
+    MOZ_ASSERT(slot == SHAPE_INVALID_SLOT ||
+               slot < JSCLASS_RESERVED_SLOTS(obj->getClass()));
+
     /*
      * The code below deals with either converting obj to dictionary mode or
      * growing an object that's already in dictionary mode.
      */
     ShapeTable* table = nullptr;
     if (!obj->inDictionaryMode()) {
-        bool stableSlot =
-            (slot == SHAPE_INVALID_SLOT) ||
-            obj->lastProperty()->hasMissingSlot() ||
-            (slot == obj->lastProperty()->maybeSlot() + 1);
-        if (!stableSlot || ShouldConvertToDictionary(obj)) {
+        if (ShouldConvertToDictionary(obj)) {
             if (!toDictionaryMode(cx, obj))
                 return nullptr;
             table = obj->lastProperty()->maybeTable(keep);
             entry = &table->search<MaybeAdding::Adding>(id, keep);
         }
     } else {
         table = obj->lastProperty()->ensureTableForDictionary(cx, keep);
         if (!table)
--- a/js/src/vm/UnboxedObject.cpp
+++ b/js/src/vm/UnboxedObject.cpp
@@ -393,18 +393,20 @@ MakeReplacementTemplateObject(JSContext*
                                                                  TenuredObject));
     if (!obj)
         return nullptr;
 
     RootedId id(cx);
     for (size_t i = 0; i < layout.properties().length(); i++) {
         const UnboxedLayout::Property& property = layout.properties()[i];
         id = NameToId(property.name);
-        if (!NativeObject::addDataProperty(cx, obj, id, i, JSPROP_ENUMERATE))
+        Shape* shape = NativeObject::addDataProperty(cx, obj, id, SHAPE_INVALID_SLOT, JSPROP_ENUMERATE);
+        if (!shape)
             return nullptr;
+        MOZ_ASSERT(shape->slot() == i);
         MOZ_ASSERT(obj->slotSpan() == i + 1);
         MOZ_ASSERT(!obj->inDictionaryMode());
     }
 
     return obj;
 }
 
 /* static */ bool