Bug 595975 diagnostic 2: shape markers and object data, r=billm, a=blocker

--HG--
extra : rebase_source : ddc486824d5f4a4e3dfe114ccde7e4841033ebaa

js/src/jsobj.cpp

@@ -106,7 +106,7 @@
 using namespace js;
 using namespace js::gc;
 
-JS_FRIEND_DATA(const JSObjectMap) JSObjectMap::sharedNonNative(JSObjectMap::SHAPELESS);
+JS_FRIEND_DATA(const JSObjectMap) JSObjectMap::sharedNonNative(JSObjectMap::NON_NATIVE_START_MARKER, JSObjectMap::SHAPELESS, 0);
 
 Class js_ObjectClass = {
     js_Object_str,

js/src/jsobj.h

@@ -176,15 +176,21 @@ typedef Vector<PropDesc, 1> PropDescArray;
 } /* namespace js */
 
 struct JSObjectMap {
+    uint32 startMarker; /* start marker for diagnostics */
     uint32 shape;       /* shape identifier */
     uint32 slotSpan;    /* one more than maximum live slot number */
 
     static JS_FRIEND_DATA(const JSObjectMap) sharedNonNative;
 
-    explicit JSObjectMap(uint32 shape) : shape(shape), slotSpan(0) {}
-    JSObjectMap(uint32 shape, uint32 slotSpan) : shape(shape), slotSpan(slotSpan) {}
+    JSObjectMap(uint32 startMarker, uint32 shape, uint32 slotSpan)
+        : startMarker(startMarker), shape(shape), slotSpan(slotSpan) {}
 
     enum { INVALID_SHAPE = 0x8fffffff, SHAPELESS = 0xffffffff };
+    enum { NON_NATIVE_START_MARKER = 0xeaeaeaea,
+           SHAPE_START_MARKER      = 0xebebebeb,
+           SHAPE_MARKER_1          = 0xecececec,
+           SHAPE_MARKER_2          = 0xedededed,
+           SHAPE_END_MARKER        = 0xefefefef };
 
     bool isNative() const { return this != &sharedNonNative; }
 

js/src/jsscope.h

@@ -292,6 +292,7 @@ struct Shape : public JSObjectMap
     friend class js::PropertyTree;
     friend bool HasUnreachableGCThings(TreeFragment *f);
 
+    uint32                    marker1;
   protected:
     mutable js::PropertyTable *table;
 
@@ -330,6 +331,7 @@ struct Shape : public JSObjectMap
                                            null if shape->hasSetterValue() */
     };
 
+    uint32              marker2;
   public:
     uint32              slot;           /* abstract index in object slots */
   private:
@@ -348,6 +350,7 @@ struct Shape : public JSObjectMap
                                            either to shape->parent if not last,
                                            else to obj->lastProp */
     };
+    uint32               endMarker;     /* end marker for diagnostics */
 
     static inline js::Shape **search(js::Shape **startp, jsid id, bool adding = false);
     static js::Shape *newDictionaryShape(JSContext *cx, const js::Shape &child, js::Shape **listp);
@@ -647,9 +650,24 @@ struct EmptyShape : public js::Shape
 #define SHAPE_STORE_PRESERVING_COLLISION(spp, shape)                          \
     (*(spp) = (js::Shape *) (jsuword(shape) | SHAPE_HAD_COLLISION(*(spp))))
 
+inline static volatile int *vcopy(volatile int *dst, int *src, size_t bytes)
+{
+    int *end = src + bytes / sizeof(int);
+    for (; src < end; ++src, ++dst)
+        *dst = *src;
+    return dst;
+}
+
 inline js::Shape **
 JSObject::nativeSearch(jsid id, bool adding)
 {
+    {
+        char blackbox[sizeof(JSObject) + 8];
+        volatile int *p = (int *) blackbox;
+        *p++ = 0xacacacac;
+        p = vcopy(p, (int *) this, sizeof(JSObject));
+        *p = 0xadadadad;
+    }
     return js::Shape::search(&lastProp, id, adding);
 }
 
@@ -829,14 +847,6 @@ extern JS_FRIEND_DATA(JSScopeStats) js_scope_stats;
 
 namespace js {
 
-inline static volatile int *vcopy(volatile int *dst, int *src, size_t bytes)
-{
-    int *end = src + bytes / sizeof(int);
-    for (; src < end; ++src, ++dst)
-        *dst = *src;
-    return dst;
-}
-
 JS_ALWAYS_INLINE js::Shape **
 Shape::search(js::Shape **startp, jsid id, bool adding)
 {

js/src/jsscopeinlines.h

@@ -169,9 +169,11 @@ namespace js {
 inline
 Shape::Shape(jsid id, js::PropertyOp getter, js::PropertyOp setter, uint32 slot, uintN attrs,
              uintN flags, intN shortid, uint32 shape, uint32 slotSpan)
-  : JSObjectMap(shape, slotSpan),
+  : JSObjectMap(JSObjectMap::SHAPE_START_MARKER, shape, slotSpan),
     table(NULL), id(id), rawGetter(getter), rawSetter(setter), slot(slot), attrs(uint8(attrs)),
-    flags(uint8(flags)), shortid(int16(shortid)), parent(NULL)
+    flags(uint8(flags)), shortid(int16(shortid)), parent(NULL),
+    marker1(JSObjectMap::SHAPE_MARKER_1), marker2(JSObjectMap::SHAPE_MARKER_2),
+    endMarker(JSObjectMap::SHAPE_END_MARKER)
 {
     JS_ASSERT_IF(slotSpan != SHAPE_INVALID_SLOT, slotSpan < JSObject::NSLOTS_LIMIT);
     JS_ASSERT_IF(getter && (attrs & JSPROP_GETTER), getterObj->isCallable());
@@ -181,9 +183,11 @@ Shape::Shape(jsid id, js::PropertyOp getter, js::PropertyOp setter, uint32 slot,
 
 inline
 Shape::Shape(JSContext *cx, Class *aclasp)
-  : JSObjectMap(js_GenerateShape(cx, false), JSSLOT_FREE(aclasp)), table(NULL),
+  : JSObjectMap(JSObjectMap::SHAPE_START_MARKER, js_GenerateShape(cx, false), JSSLOT_FREE(aclasp)), table(NULL),
     id(JSID_EMPTY), clasp(aclasp), rawSetter(NULL), slot(SHAPE_INVALID_SLOT), attrs(0),
-    flags(SHARED_EMPTY), shortid(0), parent(NULL)
+    flags(SHARED_EMPTY), shortid(0), parent(NULL),
+    marker1(JSObjectMap::SHAPE_MARKER_1), marker2(JSObjectMap::SHAPE_MARKER_2),
+    endMarker(JSObjectMap::SHAPE_END_MARKER)
 {
     kids.setNull();
 }