Backout 7959ffacd30f (Bug 1176090) for being on top of a regression.

--HG--
extra : rebase_source : d1705d445efcf914bc92fb6bfb2cf501ee823538

js/src/asmjs/AsmJSModule.h

@@ -851,7 +851,7 @@ class AsmJSModule
     uint8_t *                             interruptExit_;
     uint8_t *                             outOfBoundsExit_;
     StaticLinkData                        staticLinkData_;
-    HeapPtrArrayBufferObjectMaybeShared   maybeHeap_;
+    RelocatablePtrArrayBufferObjectMaybeShared maybeHeap_;
     AsmJSModule **                        prevLinked_;
     AsmJSModule *                         nextLinked_;
     bool                                  dynamicallyLinked_;

js/src/builtin/MapObject.cpp

@@ -1199,7 +1199,7 @@ MapObject::set(JSContext* cx, HandleObject obj, HandleValue k, HandleValue v)
     if (!key.setValue(cx, k))
         return false;
 
-    HeapValue rval(v);
+    RelocatableValue rval(v);
     if (!map->put(key, rval)) {
         ReportOutOfMemory(cx);
         return false;
@@ -1294,7 +1294,7 @@ MapObject::construct(JSContext* cx, unsigned argc, Value* vp)
                 if (!hkey.setValue(cx, key))
                     return false;
 
-                HeapValue rval(val);
+                RelocatableValue rval(val);
                 if (!map->put(hkey, rval)) {
                     ReportOutOfMemory(cx);
                     return false;
@@ -1451,7 +1451,7 @@ MapObject::set_impl(JSContext* cx, CallArgs args)
 
     ValueMap& map = extract(args);
     ARG0_KEY(cx, args, key);
-    HeapValue rval(args.get(1));
+    RelocatableValue rval(args.get(1));
     if (!map.put(key, rval)) {
         ReportOutOfMemory(cx);
         return false;
@@ -1472,14 +1472,14 @@ bool
 MapObject::delete_impl(JSContext* cx, CallArgs args)
 {
     // MapObject::mark does not mark deleted entries. Incremental GC therefore
-    // requires that no HeapValue objects pointing to heap values be left alive
-    // in the ValueMap.
+    // requires that no RelocatableValue objects pointing to heap values be
+    // left alive in the ValueMap.
     //
     // OrderedHashMap::remove() doesn't destroy the removed entry. It merely
     // calls OrderedHashMap::MapOps::makeEmpty. But that is sufficient, because
     // makeEmpty clears the value by doing e->value = Value(), and in the case
-    // of a ValueMap, Value() means HeapValue(), which is the same as
-    // HeapValue(UndefinedValue()).
+    // of a ValueMap, Value() means RelocatableValue(), which is the same as
+    // RelocatableValue(UndefinedValue()).
     MOZ_ASSERT(MapObject::is(args.thisv()));
 
     ValueMap& map = extract(args);

js/src/builtin/MapObject.h

@@ -77,7 +77,7 @@ template <class T, class OrderedHashPolicy, class AllocPolicy>
 class OrderedHashSet;
 
 typedef OrderedHashMap<HashableValue,
-                       HeapValue,
+                       RelocatableValue,
                        HashableValue::Hasher,
                        RuntimeAllocPolicy> ValueMap;
 

js/src/gc/Barrier.h

@@ -133,13 +133,15 @@
  * the init naming idiom in many places to signify that a field is being
  * assigned for the first time.
  *
- * This file implements three classes, illustrated here:
+ * This file implements four classes, illustrated here:
  *
- * BarrieredBase         abstract base class which provides common operations
- *    |  |
- *    | PreBarriered     provides pre-barriers only
- *    |
- *   HeapPtr             provides pre- and post-barriers
+ * BarrieredBase          abstract base class which provides common operations
+ *  |  |  |
+ *  |  | PreBarriered     provides pre-barriers only
+ *  |  |
+ *  | HeapPtr             provides pre- and post-barriers
+ *  |
+ * RelocatablePtr         provides pre- and post-barriers and is relocatable
  *
  * The implementation of the barrier logic is implemented on T::writeBarrier.*,
  * via:
@@ -152,7 +154,7 @@
  *      -> InternalGCMethods<T*>::preBarrier
  *          -> T::writeBarrierPre
  *
- * HeapPtr<T>::post
+ * HeapPtr<T>::post and RelocatablePtr<T>::post
  *  -> InternalGCMethods<T*>::postBarrier
  *      -> T::writeBarrierPost
  *  -> InternalGCMethods<Value>::postBarrier
@@ -346,10 +348,10 @@ class BarrieredBaseMixins<JS::Value> : public ValueOperations<BarrieredBase<JS::
 };
 
 /*
- * PreBarriered only automatically handles pre-barriers. Post-barriers must be
- * manually implemented when using this class. HeapPtr should be used in all
- * cases that do not require explicit low-level control of moving behavior,
- * e.g. for HashMap keys.
+ * PreBarriered only automatically handles pre-barriers. Post-barriers must
+ * be manually implemented when using this class. HeapPtr and RelocatablePtr
+ * should be used in all cases that do not require explicit low-level control
+ * of moving behavior, e.g. for HashMap keys.
  */
 template <class T>
 class PreBarriered : public BarrieredBase<T>
@@ -447,6 +449,13 @@ class HeapPtr : public BarrieredBase<T>
     }
 };
 
+/*
+ * This name is kept so that complete conversion to HeapPtr can be done
+ * incrementally.
+ */
+template <typename T>
+using RelocatablePtr = HeapPtr<T>;
+
 /*
  * This is a hack for RegExpStatics::updateFromMatch. It allows us to do two
  * barriers with only one branch to check if we're in an incremental GC.
@@ -454,8 +463,8 @@ class HeapPtr : public BarrieredBase<T>
 template <class T1, class T2>
 static inline void
 BarrieredSetPair(Zone* zone,
-                 HeapPtr<T1*>& v1, T1* val1,
-                 HeapPtr<T2*>& v2, T2* val2)
+                 RelocatablePtr<T1*>& v1, T1* val1,
+                 RelocatablePtr<T2*>& v2, T2* val2)
 {
     if (T1::needWriteBarrierPre(zone)) {
         v1.pre();
@@ -606,6 +615,20 @@ typedef PreBarriered<jit::JitCode*> PreBarrieredJitCode;
 typedef PreBarriered<JSString*> PreBarrieredString;
 typedef PreBarriered<JSAtom*> PreBarrieredAtom;
 
+typedef RelocatablePtr<JSObject*> RelocatablePtrObject;
+typedef RelocatablePtr<JSFunction*> RelocatablePtrFunction;
+typedef RelocatablePtr<PlainObject*> RelocatablePtrPlainObject;
+typedef RelocatablePtr<JSScript*> RelocatablePtrScript;
+typedef RelocatablePtr<NativeObject*> RelocatablePtrNativeObject;
+typedef RelocatablePtr<NestedScopeObject*> RelocatablePtrNestedScopeObject;
+typedef RelocatablePtr<Shape*> RelocatablePtrShape;
+typedef RelocatablePtr<ObjectGroup*> RelocatablePtrObjectGroup;
+typedef RelocatablePtr<jit::JitCode*> RelocatablePtrJitCode;
+typedef RelocatablePtr<JSLinearString*> RelocatablePtrLinearString;
+typedef RelocatablePtr<JSString*> RelocatablePtrString;
+typedef RelocatablePtr<JSAtom*> RelocatablePtrAtom;
+typedef RelocatablePtr<ArrayBufferObjectMaybeShared*> RelocatablePtrArrayBufferObjectMaybeShared;
+
 typedef HeapPtr<NativeObject*> HeapPtrNativeObject;
 typedef HeapPtr<ArrayObject*> HeapPtrArrayObject;
 typedef HeapPtr<ArrayBufferObjectMaybeShared*> HeapPtrArrayBufferObjectMaybeShared;
@@ -626,9 +649,11 @@ typedef HeapPtr<jit::JitCode*> HeapPtrJitCode;
 typedef HeapPtr<ObjectGroup*> HeapPtrObjectGroup;
 
 typedef PreBarriered<Value> PreBarrieredValue;
+typedef RelocatablePtr<Value> RelocatableValue;
 typedef HeapPtr<Value> HeapValue;
 
 typedef PreBarriered<jsid> PreBarrieredId;
+typedef RelocatablePtr<jsid> RelocatableId;
 typedef HeapPtr<jsid> HeapId;
 
 typedef ImmutableTenuredPtr<PropertyName*> ImmutablePropertyNamePtr;
@@ -651,7 +676,7 @@ typedef ReadBarriered<Value> ReadBarrieredValue;
 
 // A pre- and post-barriered Value that is specialized to be aware that it
 // resides in a slots or elements vector. This allows it to be relocated in
-// memory, but with substantially less overhead than a HeapPtr.
+// memory, but with substantially less overhead than a RelocatablePtr.
 class HeapSlot : public BarrieredBase<Value>
 {
   public:

js/src/gdb/tests/test-Root.cpp

@@ -41,17 +41,21 @@ FRAGMENT(Root, barriers) {
   JSObject* obj = JS_NewPlainObject(cx);
   js::PreBarriered<JSObject*> prebarriered(obj);
   js::HeapPtr<JSObject*> heapptr(obj);
+  js::RelocatablePtr<JSObject*> relocatable(obj);
 
   JS::Value val = JS::ObjectValue(*obj);
   js::PreBarrieredValue prebarrieredValue(JS::ObjectValue(*obj));
   js::HeapValue heapValue(JS::ObjectValue(*obj));
+  js::RelocatableValue relocatableValue(JS::ObjectValue(*obj));
 
   breakpoint();
 
   (void) prebarriered;
   (void) heapptr;
+  (void) relocatable;
   (void) val;
   (void) prebarrieredValue;
   (void) heapValue;
+  (void) relocatableValue;
 }
 

js/src/jit/BaselineJIT.h

@@ -119,11 +119,11 @@ struct BaselineScript
 
   private:
     // Code pointer containing the actual method.
-    HeapPtrJitCode method_;
+    RelocatablePtrJitCode method_;
 
     // For heavyweight scripts, template objects to use for the call object and
     // decl env object (linked via the call object's enclosing scope).
-    HeapPtrObject templateScope_;
+    RelocatablePtrObject templateScope_;
 
     // Allocated space for fallback stubs.
     FallbackICStubSpace fallbackStubSpace_;

js/src/jit/JitFrameIterator.h

@@ -316,7 +316,7 @@ class JitProfilingFrameIterator
 class RInstructionResults
 {
     // Vector of results of recover instructions.
-    typedef mozilla::Vector<HeapValue, 1, SystemAllocPolicy> Values;
+    typedef mozilla::Vector<RelocatableValue, 1, SystemAllocPolicy> Values;
     mozilla::UniquePtr<Values, JS::DeletePolicy<Values> > results_;
 
     // The frame pointer is used as a key to check if the current frame already
@@ -341,7 +341,7 @@ class RInstructionResults
 
     JitFrameLayout* frame() const;
 
-    HeapValue& operator[](size_t index);
+    RelocatableValue& operator[](size_t index);
 
     void trace(JSTracer* trc);
 };

js/src/jit/JitFrames.cpp

@@ -1745,7 +1745,7 @@ RInstructionResults::frame() const
     return fp_;
 }
 
-HeapValue&
+RelocatableValue&
 RInstructionResults::operator [](size_t index)
 {
     return (*results_)[index];

js/src/jsapi-tests/testGCStoreBufferRemoval.cpp

@@ -32,54 +32,54 @@ BEGIN_TEST(testGCStoreBufferRemoval)
     // Hide the horrors herein from the static rooting analysis.
     AutoIgnoreRootingHazards ignore;
 
-    // Test removal of store buffer entries added by HeapPtr<T>.
+    // Test removal of store buffer entries added by RelocatablePtr<T>.
     {
         JSObject* badObject = reinterpret_cast<JSObject*>(1);
         JSObject* punnedPtr = nullptr;
-        HeapPtrObject* relocPtr =
-            reinterpret_cast<HeapPtrObject*>(&punnedPtr);
-        new (relocPtr) HeapPtrObject;
+        RelocatablePtrObject* relocPtr =
+            reinterpret_cast<RelocatablePtrObject*>(&punnedPtr);
+        new (relocPtr) RelocatablePtrObject;
         *relocPtr = NurseryObject();
-        relocPtr->~HeapPtrObject();
+        relocPtr->~RelocatablePtrObject();
         punnedPtr = badObject;
         JS_GC(cx->runtime());
 
-        new (relocPtr) HeapPtrObject;
+        new (relocPtr) RelocatablePtrObject;
         *relocPtr = NurseryObject();
         *relocPtr = tenuredObject;
-        relocPtr->~HeapPtrObject();
+        relocPtr->~RelocatablePtrObject();
         punnedPtr = badObject;
         JS_GC(cx->runtime());
 
-        new (relocPtr) HeapPtrObject;
+        new (relocPtr) RelocatablePtrObject;
         *relocPtr = NurseryObject();
         *relocPtr = nullptr;
-        relocPtr->~HeapPtrObject();
+        relocPtr->~RelocatablePtrObject();
         punnedPtr = badObject;
         JS_GC(cx->runtime());
     }
 
-    // Test removal of store buffer entries added by HeapValue.
+    // Test removal of store buffer entries added by RelocatableValue.
     {
         Value punnedValue;
-        HeapValue* relocValue = reinterpret_cast<HeapValue*>(&punnedValue);
-        new (relocValue) HeapValue;
+        RelocatableValue* relocValue = reinterpret_cast<RelocatableValue*>(&punnedValue);
+        new (relocValue) RelocatableValue;
         *relocValue = ObjectValue(*NurseryObject());
-        relocValue->~HeapValue();
+        relocValue->~RelocatableValue();
         punnedValue = ObjectValueCrashOnTouch();
         JS_GC(cx->runtime());
 
-        new (relocValue) HeapValue;
+        new (relocValue) RelocatableValue;
         *relocValue = ObjectValue(*NurseryObject());
         *relocValue = ObjectValue(*tenuredObject);
-        relocValue->~HeapValue();
+        relocValue->~RelocatableValue();
         punnedValue = ObjectValueCrashOnTouch();
         JS_GC(cx->runtime());
 
-        new (relocValue) HeapValue;
+        new (relocValue) RelocatableValue;
         *relocValue = ObjectValue(*NurseryObject());
         *relocValue = NullValue();
-        relocValue->~HeapValue();
+        relocValue->~RelocatableValue();
         punnedValue = ObjectValueCrashOnTouch();
         JS_GC(cx->runtime());
     }

js/src/jsscript.h

@@ -214,7 +214,7 @@ class Bindings
     friend class BindingIter;
     friend class AliasedFormalIter;
 
-    HeapPtrShape callObjShape_;
+    RelocatablePtrShape callObjShape_;
     uintptr_t bindingArrayAndFlag_;
     uint16_t numArgs_;
     uint16_t numBlockScoped_;

js/src/vm/Debugger.cpp

@@ -2486,7 +2486,7 @@ Debugger::trace(JSTracer* trc)
      * frames.)
      */
     for (FrameMap::Range r = frames.all(); !r.empty(); r.popFront()) {
-        HeapPtrNativeObject& frameobj = r.front().value();
+        RelocatablePtrNativeObject& frameobj = r.front().value();
         MOZ_ASSERT(MaybeForwarded(frameobj.get())->getPrivate());
         TraceEdge(trc, &frameobj, "live Debugger.Frame");
     }

js/src/vm/Debugger.h

@@ -64,11 +64,11 @@ typedef HashSet<ReadBarrieredGlobalObject,
  * created.
  */
 template <class UnbarrieredKey, bool InvisibleKeysOk=false>
-class DebuggerWeakMap : private WeakMap<PreBarriered<UnbarrieredKey>, HeapPtrObject>
+class DebuggerWeakMap : private WeakMap<PreBarriered<UnbarrieredKey>, RelocatablePtrObject>
 {
   private:
     typedef PreBarriered<UnbarrieredKey> Key;
-    typedef HeapPtrObject Value;
+    typedef RelocatablePtrObject Value;
 
     typedef HashMap<JS::Zone*,
                     uintptr_t,
@@ -286,10 +286,10 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
         static AllocationSite* create(JSContext* cx, HandleObject frame, double when,
                                       HandleObject obj);
 
-        HeapPtrObject frame;
+        RelocatablePtrObject frame;
         double when;
         const char* className;
-        HeapPtrAtom ctorName;
+        RelocatablePtrAtom ctorName;
     };
     typedef mozilla::LinkedList<AllocationSite> AllocationSiteList;
 
@@ -362,7 +362,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
      * has to be different.
      */
     typedef HashMap<AbstractFramePtr,
-                    HeapPtrNativeObject,
+                    RelocatablePtrNativeObject,
                     DefaultHasher<AbstractFramePtr>,
                     RuntimeAllocPolicy> FrameMap;
     FrameMap frames;

js/src/vm/DebuggerMemory.cpp

@@ -218,9 +218,9 @@ DebuggerMemory::drainAllocationsLog(JSContext* cx, unsigned argc, Value* vp)
 
         result->setDenseElement(i, ObjectValue(*obj));
 
-        // Pop the front queue entry, and delete it immediately, so that the GC
-        // sees the AllocationSite's HeapPtr barriers run atomically with the
-        // change to the graph (the queue link).
+        // Pop the front queue entry, and delete it immediately, so that
+        // the GC sees the AllocationSite's RelocatablePtr barriers run
+        // atomically with the change to the graph (the queue link).
         MOZ_ALWAYS_TRUE(dbg->allocationsLog.popFirst() == allocSite);
         js_delete(allocSite);
     }

js/src/vm/RegExpObject.h

@@ -120,7 +120,7 @@ class RegExpShared
 
     struct RegExpCompilation
     {
-        HeapPtrJitCode jitCode;
+        RelocatablePtrJitCode jitCode;
         uint8_t* byteCode;
 
         RegExpCompilation() : byteCode(nullptr) {}
@@ -132,7 +132,7 @@ class RegExpShared
     };
 
     /* Source to the RegExp, for lazy compilation. */
-    HeapPtrAtom        source;
+    RelocatablePtrAtom source;
 
     RegExpFlag         flags;
     size_t             parenCount;

js/src/vm/RegExpStatics.h

@@ -21,19 +21,19 @@ class RegExpStatics
 {
     /* The latest RegExp output, set after execution. */
     VectorMatchPairs        matches;
-    HeapPtrLinearString     matchesInput;
+    RelocatablePtrLinearString matchesInput;
 
     /*
      * The previous RegExp input, used to resolve lazy state.
      * A raw RegExpShared cannot be stored because it may be in
      * a different compartment via evalcx().
      */
-    HeapPtrAtom             lazySource;
+    RelocatablePtrAtom      lazySource;
     RegExpFlag              lazyFlags;
     size_t                  lazyIndex;
 
     /* The latest RegExp input, set before execution. */
-    HeapPtrString           pendingInput;
+    RelocatablePtrString    pendingInput;
     RegExpFlag              flags;
 
     /*

js/src/vm/ScopeObject.h

@@ -868,7 +868,7 @@ class LiveScopeVal
     friend class MissingScopeKey;
 
     AbstractFramePtr frame_;
-    HeapPtrObject staticScope_;
+    RelocatablePtrObject staticScope_;
 
     void sweep();
     static void staticAsserts();

js/src/vm/TypeInference.h

@@ -804,7 +804,7 @@ class PreliminaryObjectArray
 
 class PreliminaryObjectArrayWithTemplate : public PreliminaryObjectArray
 {
-    HeapPtrShape shape_;
+    RelocatablePtrShape shape_;
 
   public:
     explicit PreliminaryObjectArrayWithTemplate(Shape* shape)
@@ -881,7 +881,7 @@ class TypeNewScript
 
   private:
     // Scripted function which this information was computed for.
-    HeapPtrFunction function_;
+    RelocatablePtrFunction function_;
 
     // Any preliminary objects with the type. The analyses are not performed
     // until this array is cleared.
@@ -893,7 +893,7 @@ class TypeNewScript
     // allocation kind to use. This is null if the new objects have an unboxed
     // layout, in which case the UnboxedLayout provides the initial structure
     // of the object.
-    HeapPtrPlainObject templateObject_;
+    RelocatablePtrPlainObject templateObject_;
 
     // Order in which definite properties become initialized. We need this in
     // case the definite properties are invalidated (such as by adding a setter
@@ -910,11 +910,11 @@ class TypeNewScript
     // shape contains all such additional properties (plus the definite
     // properties). When an object of this group acquires this shape, it is
     // fully initialized and its group can be changed to initializedGroup.
-    HeapPtrShape initializedShape_;
+    RelocatablePtrShape initializedShape_;
 
     // Group with definite properties set for all properties found by
     // both the definite and acquired properties analyses.
-    HeapPtrObjectGroup initializedGroup_;
+    RelocatablePtrObjectGroup initializedGroup_;
 
   public:
     TypeNewScript() { mozilla::PodZero(this); }

js/src/vm/WeakMapObject.h

@@ -12,11 +12,11 @@
 
 namespace js {
 
-class ObjectValueMap : public WeakMap<PreBarrieredObject, HeapValue>
+class ObjectValueMap : public WeakMap<PreBarrieredObject, RelocatableValue>
 {
   public:
     ObjectValueMap(JSContext* cx, JSObject* obj)
-      : WeakMap<PreBarrieredObject, HeapValue>(cx, obj) {}
+      : WeakMap<PreBarrieredObject, RelocatableValue>(cx, obj) {}
 
     virtual bool findZoneEdges();
 };