From 203f1d029f09b1d419bef99a6e7a404b41705739 Mon Sep 17 00:00:00 2001 From: Terrence Cole Date: Wed, 24 Jun 2015 16:20:31 -0700 Subject: [PATCH] Backout 7959ffacd30f (Bug 1176090) for being on top of a regression. --HG-- extra : rebase_source : d1705d445efcf914bc92fb6bfb2cf501ee823538 --- js/src/asmjs/AsmJSModule.h | 2 +- js/src/builtin/MapObject.cpp | 14 ++--- js/src/builtin/MapObject.h | 2 +- js/src/gc/Barrier.h | 53 ++++++++++++++----- js/src/gdb/tests/test-Root.cpp | 4 ++ js/src/jit/BaselineJIT.h | 4 +- js/src/jit/JitFrameIterator.h | 4 +- js/src/jit/JitFrames.cpp | 2 +- .../jsapi-tests/testGCStoreBufferRemoval.cpp | 34 ++++++------ js/src/jsscript.h | 2 +- js/src/vm/Debugger.cpp | 2 +- js/src/vm/Debugger.h | 10 ++-- js/src/vm/DebuggerMemory.cpp | 6 +-- js/src/vm/RegExpObject.h | 4 +- js/src/vm/RegExpStatics.h | 6 +-- js/src/vm/ScopeObject.h | 2 +- js/src/vm/TypeInference.h | 10 ++-- js/src/vm/WeakMapObject.h | 4 +- 18 files changed, 97 insertions(+), 68 deletions(-) diff --git a/js/src/asmjs/AsmJSModule.h b/js/src/asmjs/AsmJSModule.h index a1cff5cd65ee..ed573143296b 100644 --- a/js/src/asmjs/AsmJSModule.h +++ b/js/src/asmjs/AsmJSModule.h @@ -851,7 +851,7 @@ class AsmJSModule uint8_t * interruptExit_; uint8_t * outOfBoundsExit_; StaticLinkData staticLinkData_; - HeapPtrArrayBufferObjectMaybeShared maybeHeap_; + RelocatablePtrArrayBufferObjectMaybeShared maybeHeap_; AsmJSModule ** prevLinked_; AsmJSModule * nextLinked_; bool dynamicallyLinked_; diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp index 617926b30eda..1b2308eb9152 100644 --- a/js/src/builtin/MapObject.cpp +++ b/js/src/builtin/MapObject.cpp @@ -1199,7 +1199,7 @@ MapObject::set(JSContext* cx, HandleObject obj, HandleValue k, HandleValue v) if (!key.setValue(cx, k)) return false; - HeapValue rval(v); + RelocatableValue rval(v); if (!map->put(key, rval)) { ReportOutOfMemory(cx); return false; @@ -1294,7 +1294,7 @@ MapObject::construct(JSContext* cx, unsigned argc, Value* vp) if (!hkey.setValue(cx, key)) return false; - HeapValue rval(val); + RelocatableValue rval(val); if (!map->put(hkey, rval)) { ReportOutOfMemory(cx); return false; @@ -1451,7 +1451,7 @@ MapObject::set_impl(JSContext* cx, CallArgs args) ValueMap& map = extract(args); ARG0_KEY(cx, args, key); - HeapValue rval(args.get(1)); + RelocatableValue rval(args.get(1)); if (!map.put(key, rval)) { ReportOutOfMemory(cx); return false; @@ -1472,14 +1472,14 @@ bool MapObject::delete_impl(JSContext* cx, CallArgs args) { // MapObject::mark does not mark deleted entries. Incremental GC therefore - // requires that no HeapValue objects pointing to heap values be left alive - // in the ValueMap. + // requires that no RelocatableValue objects pointing to heap values be + // left alive in the ValueMap. // // OrderedHashMap::remove() doesn't destroy the removed entry. It merely // calls OrderedHashMap::MapOps::makeEmpty. But that is sufficient, because // makeEmpty clears the value by doing e->value = Value(), and in the case - // of a ValueMap, Value() means HeapValue(), which is the same as - // HeapValue(UndefinedValue()). + // of a ValueMap, Value() means RelocatableValue(), which is the same as + // RelocatableValue(UndefinedValue()). MOZ_ASSERT(MapObject::is(args.thisv())); ValueMap& map = extract(args); diff --git a/js/src/builtin/MapObject.h b/js/src/builtin/MapObject.h index 2e96d23d46d1..abf1b6ffe42d 100644 --- a/js/src/builtin/MapObject.h +++ b/js/src/builtin/MapObject.h @@ -77,7 +77,7 @@ template class OrderedHashSet; typedef OrderedHashMap ValueMap; diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h index c4cd8e2f42c2..9a135784eab2 100644 --- a/js/src/gc/Barrier.h +++ b/js/src/gc/Barrier.h @@ -133,13 +133,15 @@ * the init naming idiom in many places to signify that a field is being * assigned for the first time. * - * This file implements three classes, illustrated here: + * This file implements four classes, illustrated here: * - * BarrieredBase abstract base class which provides common operations - * | | - * | PreBarriered provides pre-barriers only - * | - * HeapPtr provides pre- and post-barriers + * BarrieredBase abstract base class which provides common operations + * | | | + * | | PreBarriered provides pre-barriers only + * | | + * | HeapPtr provides pre- and post-barriers + * | + * RelocatablePtr provides pre- and post-barriers and is relocatable * * The implementation of the barrier logic is implemented on T::writeBarrier.*, * via: @@ -152,7 +154,7 @@ * -> InternalGCMethods::preBarrier * -> T::writeBarrierPre * - * HeapPtr::post + * HeapPtr::post and RelocatablePtr::post * -> InternalGCMethods::postBarrier * -> T::writeBarrierPost * -> InternalGCMethods::postBarrier @@ -346,10 +348,10 @@ class BarrieredBaseMixins : public ValueOperations class PreBarriered : public BarrieredBase @@ -447,6 +449,13 @@ class HeapPtr : public BarrieredBase } }; +/* + * This name is kept so that complete conversion to HeapPtr can be done + * incrementally. + */ +template +using RelocatablePtr = HeapPtr; + /* * This is a hack for RegExpStatics::updateFromMatch. It allows us to do two * barriers with only one branch to check if we're in an incremental GC. @@ -454,8 +463,8 @@ class HeapPtr : public BarrieredBase template static inline void BarrieredSetPair(Zone* zone, - HeapPtr& v1, T1* val1, - HeapPtr& v2, T2* val2) + RelocatablePtr& v1, T1* val1, + RelocatablePtr& v2, T2* val2) { if (T1::needWriteBarrierPre(zone)) { v1.pre(); @@ -606,6 +615,20 @@ typedef PreBarriered PreBarrieredJitCode; typedef PreBarriered PreBarrieredString; typedef PreBarriered PreBarrieredAtom; +typedef RelocatablePtr RelocatablePtrObject; +typedef RelocatablePtr RelocatablePtrFunction; +typedef RelocatablePtr RelocatablePtrPlainObject; +typedef RelocatablePtr RelocatablePtrScript; +typedef RelocatablePtr RelocatablePtrNativeObject; +typedef RelocatablePtr RelocatablePtrNestedScopeObject; +typedef RelocatablePtr RelocatablePtrShape; +typedef RelocatablePtr RelocatablePtrObjectGroup; +typedef RelocatablePtr RelocatablePtrJitCode; +typedef RelocatablePtr RelocatablePtrLinearString; +typedef RelocatablePtr RelocatablePtrString; +typedef RelocatablePtr RelocatablePtrAtom; +typedef RelocatablePtr RelocatablePtrArrayBufferObjectMaybeShared; + typedef HeapPtr HeapPtrNativeObject; typedef HeapPtr HeapPtrArrayObject; typedef HeapPtr HeapPtrArrayBufferObjectMaybeShared; @@ -626,9 +649,11 @@ typedef HeapPtr HeapPtrJitCode; typedef HeapPtr HeapPtrObjectGroup; typedef PreBarriered PreBarrieredValue; +typedef RelocatablePtr RelocatableValue; typedef HeapPtr HeapValue; typedef PreBarriered PreBarrieredId; +typedef RelocatablePtr RelocatableId; typedef HeapPtr HeapId; typedef ImmutableTenuredPtr ImmutablePropertyNamePtr; @@ -651,7 +676,7 @@ typedef ReadBarriered ReadBarrieredValue; // A pre- and post-barriered Value that is specialized to be aware that it // resides in a slots or elements vector. This allows it to be relocated in -// memory, but with substantially less overhead than a HeapPtr. +// memory, but with substantially less overhead than a RelocatablePtr. class HeapSlot : public BarrieredBase { public: diff --git a/js/src/gdb/tests/test-Root.cpp b/js/src/gdb/tests/test-Root.cpp index f5561039a6f5..d877418587db 100644 --- a/js/src/gdb/tests/test-Root.cpp +++ b/js/src/gdb/tests/test-Root.cpp @@ -41,17 +41,21 @@ FRAGMENT(Root, barriers) { JSObject* obj = JS_NewPlainObject(cx); js::PreBarriered prebarriered(obj); js::HeapPtr heapptr(obj); + js::RelocatablePtr relocatable(obj); JS::Value val = JS::ObjectValue(*obj); js::PreBarrieredValue prebarrieredValue(JS::ObjectValue(*obj)); js::HeapValue heapValue(JS::ObjectValue(*obj)); + js::RelocatableValue relocatableValue(JS::ObjectValue(*obj)); breakpoint(); (void) prebarriered; (void) heapptr; + (void) relocatable; (void) val; (void) prebarrieredValue; (void) heapValue; + (void) relocatableValue; } diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h index 9199e0b7f9f1..8bb3a97cf563 100644 --- a/js/src/jit/BaselineJIT.h +++ b/js/src/jit/BaselineJIT.h @@ -119,11 +119,11 @@ struct BaselineScript private: // Code pointer containing the actual method. - HeapPtrJitCode method_; + RelocatablePtrJitCode method_; // For heavyweight scripts, template objects to use for the call object and // decl env object (linked via the call object's enclosing scope). - HeapPtrObject templateScope_; + RelocatablePtrObject templateScope_; // Allocated space for fallback stubs. FallbackICStubSpace fallbackStubSpace_; diff --git a/js/src/jit/JitFrameIterator.h b/js/src/jit/JitFrameIterator.h index 35b4e0490801..1358c5687ad1 100644 --- a/js/src/jit/JitFrameIterator.h +++ b/js/src/jit/JitFrameIterator.h @@ -316,7 +316,7 @@ class JitProfilingFrameIterator class RInstructionResults { // Vector of results of recover instructions. - typedef mozilla::Vector Values; + typedef mozilla::Vector Values; mozilla::UniquePtr > results_; // The frame pointer is used as a key to check if the current frame already @@ -341,7 +341,7 @@ class RInstructionResults JitFrameLayout* frame() const; - HeapValue& operator[](size_t index); + RelocatableValue& operator[](size_t index); void trace(JSTracer* trc); }; diff --git a/js/src/jit/JitFrames.cpp b/js/src/jit/JitFrames.cpp index 54b7a3ccd6c2..d59953dd2684 100644 --- a/js/src/jit/JitFrames.cpp +++ b/js/src/jit/JitFrames.cpp @@ -1745,7 +1745,7 @@ RInstructionResults::frame() const return fp_; } -HeapValue& +RelocatableValue& RInstructionResults::operator [](size_t index) { return (*results_)[index]; diff --git a/js/src/jsapi-tests/testGCStoreBufferRemoval.cpp b/js/src/jsapi-tests/testGCStoreBufferRemoval.cpp index 6d866b3d03ee..5d0412884f2a 100644 --- a/js/src/jsapi-tests/testGCStoreBufferRemoval.cpp +++ b/js/src/jsapi-tests/testGCStoreBufferRemoval.cpp @@ -32,54 +32,54 @@ BEGIN_TEST(testGCStoreBufferRemoval) // Hide the horrors herein from the static rooting analysis. AutoIgnoreRootingHazards ignore; - // Test removal of store buffer entries added by HeapPtr. + // Test removal of store buffer entries added by RelocatablePtr. { JSObject* badObject = reinterpret_cast(1); JSObject* punnedPtr = nullptr; - HeapPtrObject* relocPtr = - reinterpret_cast(&punnedPtr); - new (relocPtr) HeapPtrObject; + RelocatablePtrObject* relocPtr = + reinterpret_cast(&punnedPtr); + new (relocPtr) RelocatablePtrObject; *relocPtr = NurseryObject(); - relocPtr->~HeapPtrObject(); + relocPtr->~RelocatablePtrObject(); punnedPtr = badObject; JS_GC(cx->runtime()); - new (relocPtr) HeapPtrObject; + new (relocPtr) RelocatablePtrObject; *relocPtr = NurseryObject(); *relocPtr = tenuredObject; - relocPtr->~HeapPtrObject(); + relocPtr->~RelocatablePtrObject(); punnedPtr = badObject; JS_GC(cx->runtime()); - new (relocPtr) HeapPtrObject; + new (relocPtr) RelocatablePtrObject; *relocPtr = NurseryObject(); *relocPtr = nullptr; - relocPtr->~HeapPtrObject(); + relocPtr->~RelocatablePtrObject(); punnedPtr = badObject; JS_GC(cx->runtime()); } - // Test removal of store buffer entries added by HeapValue. + // Test removal of store buffer entries added by RelocatableValue. { Value punnedValue; - HeapValue* relocValue = reinterpret_cast(&punnedValue); - new (relocValue) HeapValue; + RelocatableValue* relocValue = reinterpret_cast(&punnedValue); + new (relocValue) RelocatableValue; *relocValue = ObjectValue(*NurseryObject()); - relocValue->~HeapValue(); + relocValue->~RelocatableValue(); punnedValue = ObjectValueCrashOnTouch(); JS_GC(cx->runtime()); - new (relocValue) HeapValue; + new (relocValue) RelocatableValue; *relocValue = ObjectValue(*NurseryObject()); *relocValue = ObjectValue(*tenuredObject); - relocValue->~HeapValue(); + relocValue->~RelocatableValue(); punnedValue = ObjectValueCrashOnTouch(); JS_GC(cx->runtime()); - new (relocValue) HeapValue; + new (relocValue) RelocatableValue; *relocValue = ObjectValue(*NurseryObject()); *relocValue = NullValue(); - relocValue->~HeapValue(); + relocValue->~RelocatableValue(); punnedValue = ObjectValueCrashOnTouch(); JS_GC(cx->runtime()); } diff --git a/js/src/jsscript.h b/js/src/jsscript.h index b22f9ce90980..0f48982970f6 100644 --- a/js/src/jsscript.h +++ b/js/src/jsscript.h @@ -214,7 +214,7 @@ class Bindings friend class BindingIter; friend class AliasedFormalIter; - HeapPtrShape callObjShape_; + RelocatablePtrShape callObjShape_; uintptr_t bindingArrayAndFlag_; uint16_t numArgs_; uint16_t numBlockScoped_; diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp index b8e6b9a9b87b..448f9769ca7a 100644 --- a/js/src/vm/Debugger.cpp +++ b/js/src/vm/Debugger.cpp @@ -2486,7 +2486,7 @@ Debugger::trace(JSTracer* trc) * frames.) */ for (FrameMap::Range r = frames.all(); !r.empty(); r.popFront()) { - HeapPtrNativeObject& frameobj = r.front().value(); + RelocatablePtrNativeObject& frameobj = r.front().value(); MOZ_ASSERT(MaybeForwarded(frameobj.get())->getPrivate()); TraceEdge(trc, &frameobj, "live Debugger.Frame"); } diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h index 7345746471e9..93c0ccd5c54b 100644 --- a/js/src/vm/Debugger.h +++ b/js/src/vm/Debugger.h @@ -64,11 +64,11 @@ typedef HashSet -class DebuggerWeakMap : private WeakMap, HeapPtrObject> +class DebuggerWeakMap : private WeakMap, RelocatablePtrObject> { private: typedef PreBarriered Key; - typedef HeapPtrObject Value; + typedef RelocatablePtrObject Value; typedef HashMap static AllocationSite* create(JSContext* cx, HandleObject frame, double when, HandleObject obj); - HeapPtrObject frame; + RelocatablePtrObject frame; double when; const char* className; - HeapPtrAtom ctorName; + RelocatablePtrAtom ctorName; }; typedef mozilla::LinkedList AllocationSiteList; @@ -362,7 +362,7 @@ class Debugger : private mozilla::LinkedListElement * has to be different. */ typedef HashMap, RuntimeAllocPolicy> FrameMap; FrameMap frames; diff --git a/js/src/vm/DebuggerMemory.cpp b/js/src/vm/DebuggerMemory.cpp index 91771af6eacc..69923b9d263d 100644 --- a/js/src/vm/DebuggerMemory.cpp +++ b/js/src/vm/DebuggerMemory.cpp @@ -218,9 +218,9 @@ DebuggerMemory::drainAllocationsLog(JSContext* cx, unsigned argc, Value* vp) result->setDenseElement(i, ObjectValue(*obj)); - // Pop the front queue entry, and delete it immediately, so that the GC - // sees the AllocationSite's HeapPtr barriers run atomically with the - // change to the graph (the queue link). + // Pop the front queue entry, and delete it immediately, so that + // the GC sees the AllocationSite's RelocatablePtr barriers run + // atomically with the change to the graph (the queue link). MOZ_ALWAYS_TRUE(dbg->allocationsLog.popFirst() == allocSite); js_delete(allocSite); } diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h index 99050463e14f..3c8ce26ce5cc 100644 --- a/js/src/vm/RegExpObject.h +++ b/js/src/vm/RegExpObject.h @@ -120,7 +120,7 @@ class RegExpShared struct RegExpCompilation { - HeapPtrJitCode jitCode; + RelocatablePtrJitCode jitCode; uint8_t* byteCode; RegExpCompilation() : byteCode(nullptr) {} @@ -132,7 +132,7 @@ class RegExpShared }; /* Source to the RegExp, for lazy compilation. */ - HeapPtrAtom source; + RelocatablePtrAtom source; RegExpFlag flags; size_t parenCount; diff --git a/js/src/vm/RegExpStatics.h b/js/src/vm/RegExpStatics.h index 7813a8c6ac20..1b268bd9fd47 100644 --- a/js/src/vm/RegExpStatics.h +++ b/js/src/vm/RegExpStatics.h @@ -21,19 +21,19 @@ class RegExpStatics { /* The latest RegExp output, set after execution. */ VectorMatchPairs matches; - HeapPtrLinearString matchesInput; + RelocatablePtrLinearString matchesInput; /* * The previous RegExp input, used to resolve lazy state. * A raw RegExpShared cannot be stored because it may be in * a different compartment via evalcx(). */ - HeapPtrAtom lazySource; + RelocatablePtrAtom lazySource; RegExpFlag lazyFlags; size_t lazyIndex; /* The latest RegExp input, set before execution. */ - HeapPtrString pendingInput; + RelocatablePtrString pendingInput; RegExpFlag flags; /* diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h index 0b3ea7cf2ff7..8ad242281934 100644 --- a/js/src/vm/ScopeObject.h +++ b/js/src/vm/ScopeObject.h @@ -868,7 +868,7 @@ class LiveScopeVal friend class MissingScopeKey; AbstractFramePtr frame_; - HeapPtrObject staticScope_; + RelocatablePtrObject staticScope_; void sweep(); static void staticAsserts(); diff --git a/js/src/vm/TypeInference.h b/js/src/vm/TypeInference.h index ff157d2c705f..feaae7154b26 100644 --- a/js/src/vm/TypeInference.h +++ b/js/src/vm/TypeInference.h @@ -804,7 +804,7 @@ class PreliminaryObjectArray class PreliminaryObjectArrayWithTemplate : public PreliminaryObjectArray { - HeapPtrShape shape_; + RelocatablePtrShape shape_; public: explicit PreliminaryObjectArrayWithTemplate(Shape* shape) @@ -881,7 +881,7 @@ class TypeNewScript private: // Scripted function which this information was computed for. - HeapPtrFunction function_; + RelocatablePtrFunction function_; // Any preliminary objects with the type. The analyses are not performed // until this array is cleared. @@ -893,7 +893,7 @@ class TypeNewScript // allocation kind to use. This is null if the new objects have an unboxed // layout, in which case the UnboxedLayout provides the initial structure // of the object. - HeapPtrPlainObject templateObject_; + RelocatablePtrPlainObject templateObject_; // Order in which definite properties become initialized. We need this in // case the definite properties are invalidated (such as by adding a setter @@ -910,11 +910,11 @@ class TypeNewScript // shape contains all such additional properties (plus the definite // properties). When an object of this group acquires this shape, it is // fully initialized and its group can be changed to initializedGroup. - HeapPtrShape initializedShape_; + RelocatablePtrShape initializedShape_; // Group with definite properties set for all properties found by // both the definite and acquired properties analyses. - HeapPtrObjectGroup initializedGroup_; + RelocatablePtrObjectGroup initializedGroup_; public: TypeNewScript() { mozilla::PodZero(this); } diff --git a/js/src/vm/WeakMapObject.h b/js/src/vm/WeakMapObject.h index d250b226b9a4..18a8be353f15 100644 --- a/js/src/vm/WeakMapObject.h +++ b/js/src/vm/WeakMapObject.h @@ -12,11 +12,11 @@ namespace js { -class ObjectValueMap : public WeakMap +class ObjectValueMap : public WeakMap { public: ObjectValueMap(JSContext* cx, JSObject* obj) - : WeakMap(cx, obj) {} + : WeakMap(cx, obj) {} virtual bool findZoneEdges(); };