Backed out changeset 208bcb7879c0 (bug 995982) for mochitest-1 assertions on a CLOSED TREE

js/src/gc/Nursery.cpp

@@ -410,12 +410,6 @@ js::Nursery::setElementsForwardingPointer(ObjectElements *oldHeader, ObjectEleme
     *reinterpret_cast<HeapSlot **>(oldHeader->elements()) = newHeader->elements();
 }
 
-void
-js::Nursery::setTypedArrayElementsForwardingPointer(void *oldData, void *newData)
-{
-    *reinterpret_cast<void **>(oldData) = newData;
-}
-
 #ifdef DEBUG
 static bool IsWriteableAddress(void *ptr)
 {
@@ -572,15 +566,8 @@ js::Nursery::moveObjectToTenured(JSObject *dst, JSObject *src, AllocKind dstKind
     tenuredSize += moveSlotsToTenured(dst, src, dstKind);
     tenuredSize += moveElementsToTenured(dst, src, dstKind);
 
-    if (src->is<TypedArrayObject>()) {
-        void *oldData = dst->getPrivate();
-        JS_ASSERT(isInside(oldData) == (oldData == src->fixedData(TypedArrayObject::FIXED_DATA_START)));
-        if (isInside(oldData)) {
-            void *newData = dst->fixedData(TypedArrayObject::FIXED_DATA_START);
-            dst->setPrivate(newData);
-            setTypedArrayElementsForwardingPointer(oldData, newData);
-        }
-    }
+    if (src->is<TypedArrayObject>())
+        dst->setPrivate(dst->fixedData(TypedArrayObject::FIXED_DATA_START));
 
     /* The shape's list head may point into the old object. */
     if (&src->shape_ == dst->shape_->listp)

js/src/gc/Nursery.h

@@ -276,7 +276,6 @@ class Nursery
     void setSlotsForwardingPointer(HeapSlot *oldSlots, HeapSlot *newSlots, uint32_t nslots);
     void setElementsForwardingPointer(ObjectElements *oldHeader, ObjectElements *newHeader,
                                       uint32_t nelems);
-    void setTypedArrayElementsForwardingPointer(void *oldData, void *newData);
 
     /* Free malloced pointers owned by freed things in the nursery. */
     void freeHugeSlots(JSRuntime *rt);

js/src/vm/TypedArrayObject.h

@@ -51,11 +51,7 @@ class TypedArrayObject : public ArrayBufferViewObject
     AllocKindForLazyBuffer(size_t nbytes)
     {
         JS_ASSERT(nbytes <= INLINE_BUFFER_LIMIT);
-
-        // Make sure there is space for at least one slot, for forwarding
-        // pointers during nursery collection.
-        int dataSlots = Max<int>(1, (int) (nbytes - 1) / sizeof(Value) + 1);
-
+        int dataSlots = (nbytes - 1) / sizeof(Value) + 1;
         JS_ASSERT(int(nbytes) <= dataSlots * int(sizeof(Value)));
         return gc::GetGCObjectKind(FIXED_DATA_START + dataSlots);
     }