Bug 1259578 - Use GC infrastructure to allocate proxy's malloced blob; r=jonco

--HG--
extra : rebase_source : ed7051ff26fdebc7ebbfbe693880dacee51366fa

js/public/Proxy.h

@@ -59,7 +59,7 @@ class JS_FRIEND_API(Wrapper);
  *
  * ### Proxies and internal methods
  *
- * ES2016 specifies 13 internal methods. The runtime  semantics of just
+ * ES2016 specifies 13 internal methods. The runtime semantics of just
  * about everything a script can do to an object is specified in terms
  * of these internal methods. For example:
  *

js/src/gc/Allocator.cpp

@@ -110,7 +110,7 @@ js::Allocate(ExclusiveContext* cx, AllocKind kind, size_t nDynamicSlots, Initial
     static_assert(sizeof(JSObject_Slots0) >= CellSize,
                   "All allocations must be at least the allocator-imposed minimum size.");
 
-    MOZ_ASSERT_IF(nDynamicSlots != 0, clasp->isNative());
+    MOZ_ASSERT_IF(nDynamicSlots != 0, clasp->isNative() || clasp->isProxy());
 
     // Off-main-thread alloc cannot trigger GC or make runtime assertions.
     if (!cx->isJSContext())

js/src/jsobjinlines.h

@@ -337,8 +337,16 @@ JSObject::create(js::ExclusiveContext* cx, js::gc::AllocKind kind, js::gc::Initi
     MOZ_ASSERT_IF(!group->clasp()->isNative(), shape->slotSpan() == 0);
 
     const js::Class* clasp = group->clasp();
-    size_t nDynamicSlots =
-        js::NativeObject::dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan(), clasp);
+
+    size_t nDynamicSlots = 0;
+    if (group->clasp()->isNative()) {
+        nDynamicSlots = js::NativeObject::dynamicSlotsCount(shape->numFixedSlots(),
+                                                            shape->slotSpan(), clasp);
+    } else if (group->clasp()->isProxy()) {
+        // Proxy objects overlay the |slots| field with a ProxyValueArray.
+        MOZ_ASSERT(sizeof(js::ProxyValueArray) % sizeof(js::HeapSlot) == 0);
+        nDynamicSlots = sizeof(js::ProxyValueArray) / sizeof(js::HeapSlot);
+    }
 
     JSObject* obj = js::Allocate<JSObject>(cx, kind, nDynamicSlots, heap, clasp);
     if (!obj)

js/src/vm/ProxyObject.cpp

@@ -42,27 +42,17 @@ ProxyObject::New(JSContext* cx, const BaseProxyHandler* handler, HandleValue pri
     if (handler->finalizeInBackground(priv))
         allocKind = GetBackgroundAllocKind(allocKind);
 
-    ProxyValueArray* values = cx->zone()->new_<ProxyValueArray>();
-    if (!values) {
-        ReportOutOfMemory(cx);
-        return nullptr;
-    }
-
     AutoSetNewObjectMetadata metadata(cx);
     // Note: this will initialize the object's |data| to strange values, but we
     // will immediately overwrite those below.
     RootedObject obj(cx, NewObjectWithGivenTaggedProto(cx, clasp, proto, allocKind,
                                                        newKind));
-    if (!obj) {
-        js_free(values);
+    if (!obj)
         return nullptr;
-    }
 
     Rooted<ProxyObject*> proxy(cx, &obj->as<ProxyObject>());
-
-    proxy->data.values = values;
+    new (proxy->data.values) ProxyValueArray;
     proxy->data.handler = handler;
-
     proxy->setCrossCompartmentPrivate(priv);
 
     /* Don't track types of properties of non-DOM and non-singleton proxies. */