Bug 1368461 part 2 - Pass NewObjectKind to RegExpAlloc so most callers can use nursery allocation. r=jonco

js/src/builtin/RegExp.cpp

@@ -260,7 +260,7 @@ js::RegExpCreate(JSContext* cx, HandleValue patternValue, HandleValue flagsValue
                  MutableHandleValue rval)
 {
     /* Step 1. */
-    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx));
+    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx, GenericObject));
     if (!regexp)
          return false;
 
@@ -450,7 +450,7 @@ js::regexp_construct(JSContext* cx, unsigned argc, Value* vp)
         if (!GetPrototypeFromCallableConstructor(cx, args, &proto))
             return false;
 
-        Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx, proto));
+        Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx, GenericObject, proto));
         if (!regexp)
             return false;
 
@@ -509,7 +509,7 @@ js::regexp_construct(JSContext* cx, unsigned argc, Value* vp)
     if (!GetPrototypeFromCallableConstructor(cx, args, &proto))
         return false;
 
-    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx, proto));
+    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx, GenericObject, proto));
     if (!regexp)
         return false;
 
@@ -542,7 +542,7 @@ js::regexp_construct_raw_flags(JSContext* cx, unsigned argc, Value* vp)
     int32_t flags = int32_t(args[1].toNumber());
 
     // Step 7.
-    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx));
+    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx, GenericObject));
     if (!regexp)
         return false;
 

js/src/frontend/Parser.cpp

@@ -9398,7 +9398,8 @@ Parser<ParseHandler, CharT>::newRegExp()
     RegExpFlag flags = tokenStream.currentToken().regExpFlags();
 
     Rooted<RegExpObject*> reobj(context);
-    reobj = RegExpObject::create(context, chars, length, flags, nullptr, &tokenStream, alloc);
+    reobj = RegExpObject::create(context, chars, length, flags, nullptr, &tokenStream, alloc,
+                                 TenuredObject);
     if (!reobj)
         return null();
 

js/src/jit/IonBuilder.cpp

@@ -11979,6 +11979,8 @@ IonBuilder::jsop_delelem()
 AbortReasonOr<Ok>
 IonBuilder::jsop_regexp(RegExpObject* reobj)
 {
+    MOZ_ASSERT(!IsInsideNursery(reobj));
+
     MRegExp* regexp = MRegExp::New(alloc(), constraints(), reobj);
     current->add(regexp);
     current->push(regexp);

js/src/jsapi.cpp

@@ -6115,7 +6115,8 @@ JS_NewRegExpObject(JSContext* cx, const char* bytes, size_t length, unsigned fla
         return nullptr;
 
     RegExpObject* reobj = RegExpObject::create(cx, chars, length, RegExpFlag(flags),
-                                               nullptr, nullptr, cx->tempLifoAlloc());
+                                               nullptr, nullptr, cx->tempLifoAlloc(),
+                                               GenericObject);
     return reobj;
 }
 
@@ -6125,7 +6126,8 @@ JS_NewUCRegExpObject(JSContext* cx, const char16_t* chars, size_t length, unsign
     AssertHeapIsIdle();
     CHECK_REQUEST(cx);
     return RegExpObject::create(cx, chars, length, RegExpFlag(flags),
-                                nullptr, nullptr, cx->tempLifoAlloc());
+                                nullptr, nullptr, cx->tempLifoAlloc(),
+                                GenericObject);
 }
 
 JS_PUBLIC_API(bool)

js/src/vm/RegExpObject.cpp

@@ -52,15 +52,9 @@ JS_STATIC_ASSERT(StickyFlag == JSREG_STICKY);
 JS_STATIC_ASSERT(UnicodeFlag == JSREG_UNICODE);
 
 RegExpObject*
-js::RegExpAlloc(JSContext* cx, HandleObject proto /* = nullptr */)
+js::RegExpAlloc(JSContext* cx, NewObjectKind newKind, HandleObject proto /* = nullptr */)
 {
-    // Note: RegExp objects allocated here are always in the tenured heap. This
-    // is required for RegExp objects allocated by the parser and it also
-    // simplifies embedding them in jitcode. Cloned RegExp objects can be
-    // nursery-allocated though, see CloneRegExpObject.
-    Rooted<RegExpObject*> regexp(cx);
-
-    regexp = NewObjectWithClassProto<RegExpObject>(cx, proto, TenuredObject);
+    Rooted<RegExpObject*> regexp(cx, NewObjectWithClassProto<RegExpObject>(cx, proto, newKind));
     if (!regexp)
         return nullptr;
 
@@ -241,19 +235,19 @@ const Class RegExpObject::protoClass_ = {
 RegExpObject*
 RegExpObject::create(JSContext* cx, const char16_t* chars, size_t length, RegExpFlag flags,
                      const ReadOnlyCompileOptions* options, TokenStream* tokenStream,
-                     LifoAlloc& alloc)
+                     LifoAlloc& alloc, NewObjectKind newKind)
 {
     RootedAtom source(cx, AtomizeChars(cx, chars, length));
     if (!source)
         return nullptr;
 
-    return create(cx, source, flags, options, tokenStream, alloc);
+    return create(cx, source, flags, options, tokenStream, alloc, newKind);
 }
 
 RegExpObject*
 RegExpObject::create(JSContext* cx, HandleAtom source, RegExpFlag flags,
                      const ReadOnlyCompileOptions* options, TokenStream* tokenStream,
-                     LifoAlloc& alloc)
+                     LifoAlloc& alloc, NewObjectKind newKind)
 {
     Maybe<CompileOptions> dummyOptions;
     if (!tokenStream && !options) {
@@ -271,7 +265,7 @@ RegExpObject::create(JSContext* cx, HandleAtom source, RegExpFlag flags,
     if (!irregexp::ParsePatternSyntax(*tokenStream, alloc, source, flags & UnicodeFlag))
         return nullptr;
 
-    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx));
+    Rooted<RegExpObject*> regexp(cx, RegExpAlloc(cx, newKind));
     if (!regexp)
         return nullptr;
 
@@ -1467,7 +1461,8 @@ js::XDRScriptRegExpObject(XDRState<mode>* xdr, MutableHandle<RegExpObject*> objp
         if (xdr->hasOptions())
             options = &xdr->options();
         RegExpObject* reobj = RegExpObject::create(xdr->cx(), source, flags,
-                                                   options, nullptr, xdr->lifoAlloc());
+                                                   options, nullptr, xdr->lifoAlloc(),
+                                                   TenuredObject);
         if (!reobj)
             return false;
 
@@ -1491,7 +1486,8 @@ js::CloneScriptRegExpObject(JSContext* cx, RegExpObject& reobj)
     cx->markAtom(source);
 
     return RegExpObject::create(cx, source, reobj.getFlags(),
-                                nullptr, nullptr, cx->tempLifoAlloc());
+                                nullptr, nullptr, cx->tempLifoAlloc(),
+                                TenuredObject);
 }
 
 JS_FRIEND_API(bool)

js/src/vm/RegExpObject.h

@@ -46,7 +46,7 @@ class RegExpStatics;
 namespace frontend { class TokenStream; }
 
 extern RegExpObject*
-RegExpAlloc(JSContext* cx, HandleObject proto = nullptr);
+RegExpAlloc(JSContext* cx, NewObjectKind newKind, HandleObject proto = nullptr);
 
 // |regexp| is under-typed because this function's used in the JIT.
 extern JSObject*
@@ -74,11 +74,13 @@ class RegExpObject : public NativeObject
 
     static RegExpObject*
     create(JSContext* cx, const char16_t* chars, size_t length, RegExpFlag flags,
-           const ReadOnlyCompileOptions* options, frontend::TokenStream* ts, LifoAlloc& alloc);
+           const ReadOnlyCompileOptions* options, frontend::TokenStream* ts, LifoAlloc& alloc,
+           NewObjectKind newKind);
 
     static RegExpObject*
     create(JSContext* cx, HandleAtom atom, RegExpFlag flags,
-           const ReadOnlyCompileOptions* options, frontend::TokenStream* ts, LifoAlloc& alloc);
+           const ReadOnlyCompileOptions* options, frontend::TokenStream* ts, LifoAlloc& alloc,
+           NewObjectKind newKind);
 
     /*
      * Compute the initial shape to associate with fresh RegExp objects,

js/src/vm/SelfHosting.cpp

@@ -3047,7 +3047,8 @@ CloneObject(JSContext* cx, HandleNativeObject selfHostedObject)
         RootedAtom source(cx, reobj.getSource());
         MOZ_ASSERT(source->isPermanentAtom());
         clone = RegExpObject::create(cx, source, reobj.getFlags(),
-                                     nullptr, nullptr, cx->tempLifoAlloc());
+                                     nullptr, nullptr, cx->tempLifoAlloc(),
+                                     TenuredObject);
     } else if (selfHostedObject->is<DateObject>()) {
         clone = JS::NewDateObject(cx, selfHostedObject->as<DateObject>().clippedTime());
     } else if (selfHostedObject->is<BooleanObject>()) {

js/src/vm/StructuredClone.cpp

@@ -2127,7 +2127,7 @@ JSStructuredCloneReader::startRead(MutableHandleValue vp)
             return false;
 
         RegExpObject* reobj = RegExpObject::create(context(), atom, flags, nullptr, nullptr,
-                                                   context()->tempLifoAlloc());
+                                                   context()->tempLifoAlloc(), GenericObject);
         if (!reobj)
             return false;
         vp.setObject(*reobj);