Bug 841059 - Do not use the ArenaHeader for zone/compartment on JSObject; r=billm

--HG--
extra : rebase_source : 6885055e08eab8f3187d5ce8a4ddcfa5efb887d2

js/src/gc/Barrier-inl.h

@@ -71,10 +71,8 @@ inline void
 EncapsulatedValue::writeBarrierPre(const Value &value)
 {
 #ifdef JSGC_INCREMENTAL
-    if (value.isMarkable()) {
-        js::gc::Cell *cell = (js::gc::Cell *)value.toGCThing();
-        writeBarrierPre(cell->zone(), value);
-    }
+    if (value.isMarkable())
+        writeBarrierPre(ZoneOfValue(value), value);
 #endif
 }
 
@@ -172,9 +170,8 @@ HeapValue::set(Zone *zone, const Value &v)
 {
 #ifdef DEBUG
     if (value.isMarkable()) {
-        js::gc::Cell *cell = (js::gc::Cell *)value.toGCThing();
-        JS_ASSERT(cell->zone() == zone ||
-                  cell->zone() == zone->rt->atomsCompartment->zone());
+        JS_ASSERT(ZoneOfValue(value) == zone ||
+                  ZoneOfValue(value) == zone->rt->atomsCompartment->zone());
     }
 #endif
 

js/src/gc/Heap.h

@@ -91,7 +91,7 @@ struct Cell
     MOZ_ALWAYS_INLINE void unmark(uint32_t color) const;
 
     inline JSRuntime *runtime() const;
-    inline Zone *zone() const;
+    inline Zone *tenuredZone() const;
 
 #ifdef DEBUG
     inline bool isAligned() const;
@@ -981,7 +981,7 @@ Cell::unmark(uint32_t color) const
 }
 
 Zone *
-Cell::zone() const
+Cell::tenuredZone() const
 {
     JS_ASSERT(isTenured());
     return arenaHeader()->zone;

js/src/gc/Marking.cpp

@@ -251,7 +251,7 @@ IsMarked(T **thingp)
 {
     JS_ASSERT(thingp);
     JS_ASSERT(*thingp);
-    Zone *zone = (*thingp)->zone();
+    Zone *zone = (*thingp)->tenuredZone();
     if (!zone->isCollecting() || zone->isGCFinished())
         return true;
     return (*thingp)->isMarked();
@@ -263,7 +263,7 @@ IsAboutToBeFinalized(T **thingp)
 {
     JS_ASSERT(thingp);
     JS_ASSERT(*thingp);
-    if (!(*thingp)->zone()->isGCSweeping())
+    if (!(*thingp)->tenuredZone()->isGCSweeping())
         return false;
     return !(*thingp)->isMarked();
 }
@@ -629,7 +629,7 @@ ShouldMarkCrossCompartment(JSTracer *trc, RawObject src, Cell *cell)
     if (!IS_GC_MARKING_TRACER(trc))
         return true;
 
-    JS::Zone *zone = cell->zone();
+    JS::Zone *zone = cell->tenuredZone();
     uint32_t color = AsGCMarker(trc)->getMarkColor();
 
     JS_ASSERT(color == BLACK || color == GRAY);
@@ -1619,7 +1619,7 @@ JS::UnmarkGrayGCThingRecursively(void *thing, JSGCTraceKind kind)
 
     UnmarkGrayGCThing(thing);
 
-    JSRuntime *rt = static_cast<Cell *>(thing)->zone()->rt;
+    JSRuntime *rt = static_cast<Cell *>(thing)->runtime();
     UnmarkGrayTracer trc(rt);
     JS_TraceChildren(&trc, thing, kind);
 }

js/src/gc/Verifier.cpp

@@ -754,15 +754,14 @@ js::gc::EndVerifyPostBarriers(JSRuntime *rt)
         goto oom;
 
     /* Walk the heap. */
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
-        if (IsAtomsCompartment(c))
-            continue;
-
-        if (c->watchpointMap)
-            c->watchpointMap->markAll(trc);
+    for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
+        for (CompartmentsIter comp(rt); !comp.done(); comp.next()) {
+            if (comp->watchpointMap)
+                comp->watchpointMap->markAll(trc);
+        }
 
         for (size_t kind = 0; kind < FINALIZE_LIMIT; ++kind) {
-            for (CellIterUnderGC cells(c, AllocKind(kind)); !cells.done(); cells.next()) {
+            for (CellIterUnderGC cells(zone, AllocKind(kind)); !cells.done(); cells.next()) {
                 Cell *src = cells.getCell();
                 if (!rt->gcVerifierNursery.isInside(src))
                     JS_TraceChildren(trc, src, MapAllocToTraceKind(AllocKind(kind)));

js/src/gc/Zone.cpp

@@ -30,7 +30,7 @@ JS::Zone::Zone(JSRuntime *rt)
     hold(false),
 #ifdef JSGC_GENERATIONAL
     gcNursery(),
-    gcStoreBuffer(&gcNursery),
+    gcStoreBuffer(rt),
 #endif
     ionUsingBarriers_(false),
     active(false),

js/src/gc/Zone.h

@@ -67,7 +67,7 @@ struct Zone : private JS::shadow::Zone, public js::gc::GraphNodeBase<JS::Zone>
     bool                         hold;
 
 #ifdef JSGC_GENERATIONAL
-    js::gc::Nursery              gcNursery;
+    js::gc::VerifierNursery      gcNursery;
     js::gc::StoreBuffer          gcStoreBuffer;
 #endif
 

js/src/ion/IonCode.h

@@ -131,6 +131,7 @@ class IonCode : public gc::Cell
     static IonCode *New(JSContext *cx, uint8_t *code, uint32_t bufferSize, JSC::ExecutablePool *pool);
 
   public:
+    JS::Zone *zone() const { return tenuredZone(); }
     static void readBarrier(IonCode *code);
     static void writeBarrierPre(IonCode *code);
     static void writeBarrierPost(IonCode *code, void *addr);

js/src/jscntxt.cpp

@@ -264,7 +264,7 @@ JSCompartment::sweepCallsiteClones()
         for (CallsiteCloneTable::Enum e(callsiteClones); !e.empty(); e.popFront()) {
             CallsiteCloneKey key = e.front().key;
             JSFunction *fun = e.front().value;
-            if (!key.script->isMarked() || !fun->isMarked())
+            if (!IsScriptMarked(&key.script) || !IsObjectMarked(&fun))
                 e.removeFront();
         }
     }

js/src/jsfriendapi.cpp

@@ -903,7 +903,9 @@ JS::IncrementalReferenceBarrier(void *ptr, JSGCTraceKind kind)
         return;
 
     gc::Cell *cell = static_cast<gc::Cell *>(ptr);
-    Zone *zone = cell->zone();
+    Zone *zone = kind == JSTRACE_OBJECT
+                 ? static_cast<JSObject *>(cell)->zone()
+                 : cell->tenuredZone();
 
     JS_ASSERT(!zone->rt->isHeapBusy());
 

js/src/jsgc.cpp

@@ -1843,7 +1843,7 @@ void
 GCMarker::checkZone(void *p)
 {
     JS_ASSERT(started);
-    JS_ASSERT(static_cast<Cell *>(p)->zone()->isCollecting());
+    JS_ASSERT(static_cast<Cell *>(p)->tenuredZone()->isCollecting());
 }
 #endif
 
@@ -1915,7 +1915,7 @@ GCMarker::appendGrayRoot(void *thing, JSGCTraceKind kind)
     root.debugPrintIndex = debugPrintIndex;
 #endif
 
-    Zone *zone = static_cast<Cell *>(thing)->zone();
+    Zone *zone = static_cast<Cell *>(thing)->tenuredZone();
     if (zone->isCollecting()) {
         zone->maybeAlive = true;
         if (!zone->gcGrayRoots.append(root)) {
@@ -2726,8 +2726,8 @@ CheckCompartmentCallback(JSTracer *trcArg, void **thingp, JSGCTraceKind kind)
     if (comp && trc->compartment) {
         CheckCompartment(trc, comp, thing, kind);
     } else {
-        JS_ASSERT(thing->zone() == trc->zone ||
-                  thing->zone() == trc->runtime->atomsCompartment->zone());
+        JS_ASSERT(thing->tenuredZone() == trc->zone ||
+                  thing->tenuredZone() == trc->runtime->atomsCompartment->zone());
     }
 }
 
@@ -2907,7 +2907,7 @@ BeginMarkPhase(JSRuntime *rt)
     for (CompartmentsIter c(rt); !c.done(); c.next()) {
         for (JSCompartment::WrapperEnum e(c); !e.empty(); e.popFront()) {
             Cell *dst = e.front().key.wrapped;
-            dst->zone()->maybeAlive = true;
+            dst->tenuredZone()->maybeAlive = true;
         }
     }
 
@@ -3284,7 +3284,7 @@ JSCompartment::findOutgoingEdges(ComponentFinder<JS::Zone> &finder)
              * after wrapped compartment.
              */
             if (!other->isMarked(BLACK) || other->isMarked(GRAY)) {
-                JS::Zone *w = other->zone();
+                JS::Zone *w = other->tenuredZone();
                 if (w->isGCMarking())
                     finder.addEdgeTo(w);
             }
@@ -3297,7 +3297,7 @@ JSCompartment::findOutgoingEdges(ComponentFinder<JS::Zone> &finder)
              * with call to Debugger::findCompartmentEdges below) that debugger
              * and debuggee objects are always swept in the same group.
              */
-            JS::Zone *w = other->zone();
+            JS::Zone *w = other->tenuredZone();
             if (w->isGCMarking())
                 finder.addEdgeTo(w);
         }

js/src/jsinfer.h

@@ -1082,6 +1082,8 @@ struct TypeObject : gc::Cell
      */
     void finalize(FreeOp *fop) {}
 
+    JS::Zone *zone() const { return tenuredZone(); }
+
     static inline void writeBarrierPre(TypeObject *type);
     static inline void writeBarrierPost(TypeObject *type, void *addr);
     static inline void readBarrier(TypeObject *type);

js/src/jsscript.h

@@ -952,6 +952,8 @@ class JSScript : public js::gc::Cell
 
     void finalize(js::FreeOp *fop);
 
+    JS::Zone *zone() const { return tenuredZone(); }
+
     static inline void writeBarrierPre(js::RawScript script);
     static inline void writeBarrierPost(js::RawScript script, void *addr);
 

js/src/jswrapper.cpp

@@ -847,8 +847,8 @@ NukeSlot(JSObject *wrapper, uint32_t slot, Value v)
 {
     Value old = wrapper->getSlot(slot);
     if (old.isMarkable()) {
-        Cell *cell = static_cast<Cell *>(old.toGCThing());
-        AutoMarkInDeadZone amd(cell->zone());
+        Zone *zone = ZoneOfValue(old);
+        AutoMarkInDeadZone amd(zone);
         wrapper->setReservedSlot(slot, v);
     } else {
         wrapper->setReservedSlot(slot, v);

js/src/vm/ObjectImpl-inl.h

@@ -317,6 +317,21 @@ js::ObjectImpl::sizeOfThis() const
     return js::gc::Arena::thingSize(getAllocKind());
 }
 
+JS_ALWAYS_INLINE JS::Zone *
+js::ObjectImpl::zone() const
+{
+    return shape_->zone();
+}
+
+JS_ALWAYS_INLINE JS::Zone *
+ZoneOfValue(const JS::Value &value)
+{
+    JS_ASSERT(value.isMarkable());
+    if (value.isObject())
+        return value.toObject().zone();
+    return static_cast<js::gc::Cell *>(value.toGCThing())->tenuredZone();
+}
+
 /* static */ inline void
 js::ObjectImpl::readBarrier(ObjectImpl *obj)
 {

js/src/vm/ObjectImpl.h

@@ -1370,6 +1370,7 @@ class ObjectImpl : public gc::Cell
     }
 
     /* GC support. */
+    JS_ALWAYS_INLINE Zone *zone() const;
     static inline ThingRootKind rootKind() { return THING_ROOT_OBJECT; }
     static inline void readBarrier(ObjectImpl *obj);
     static inline void writeBarrierPre(ObjectImpl *obj);

js/src/vm/Shape.h

@@ -333,6 +333,7 @@ class BaseShape : public js::gc::Cell
     void setSlotSpan(uint32_t slotSpan) { JS_ASSERT(isOwned()); slotSpan_ = slotSpan; }
 
     JSCompartment *compartment() const { return compartment_; }
+    JS::Zone *zone() const { return tenuredZone(); }
 
     /* Lookup base shapes from the compartment's baseShapes table. */
     static UnownedBaseShape* getUnowned(JSContext *cx, const StackBaseShape &base);
@@ -816,6 +817,8 @@ class Shape : public js::gc::Cell
     void finalize(FreeOp *fop);
     void removeChild(RawShape child);
 
+    JS::Zone *zone() const { return tenuredZone(); }
+
     static inline void writeBarrierPre(RawShape shape);
     static inline void writeBarrierPost(RawShape shape, void *addr);
 

js/src/vm/String.h

@@ -414,6 +414,8 @@ class JSString : public js::gc::Cell
         return offsetof(JSString, d.u1.chars);
     }
 
+    JS::Zone *zone() const { return tenuredZone(); }
+
     static inline void writeBarrierPre(JSString *str);
     static inline void writeBarrierPost(JSString *str, void *addr);
     static inline bool needWriteBarrierPre(JS::Zone *zone);