Backed out 3 changesets (bug 1853305) for causing hazard build bustages. CLOSED TREE

Backed out changeset 1d1e7c3dd113 (bug 1853305)
Backed out changeset c7d89c1800c0 (bug 1853305)
Backed out changeset 7d3f89343255 (bug 1853305)

js/src/builtin/Eval.cpp

@@ -181,7 +181,8 @@ static EvalJSONResult ParseEvalStringAsJSON(
                                            chars.begin().get() + 1U, len - 2);
 
   Rooted<JSONParser<CharT>> parser(
-      cx, cx, jsonChars, JSONParser<CharT>::ParseType::AttemptForEval);
+      cx, JSONParser<CharT>(cx, jsonChars,
+                            JSONParser<CharT>::ParseType::AttemptForEval));
   if (!parser.parse(rval)) {
     return EvalJSONResult::Failure;
   }

js/src/builtin/JSON.cpp

@@ -1834,8 +1834,9 @@ static bool Revive(JSContext* cx, HandleValue reviver, MutableHandleValue vp) {
 template <typename CharT>
 bool ParseJSON(JSContext* cx, const mozilla::Range<const CharT> chars,
                MutableHandleValue vp) {
-  Rooted<JSONParser<CharT>> parser(cx, cx, chars,
-                                   JSONParser<CharT>::ParseType::JSONParse);
+  Rooted<JSONParser<CharT>> parser(
+      cx,
+      JSONParser<CharT>(cx, chars, JSONParser<CharT>::ParseType::JSONParse));
   return parser.parse(vp);
 }
 

js/src/gc/GC.h

@@ -11,7 +11,6 @@
 #ifndef gc_GC_h
 #define gc_GC_h
 
-#include "gc/AllocKind.h"
 #include "gc/GCEnum.h"
 #include "js/GCAPI.h"
 #include "js/HeapAPI.h"
@@ -239,34 +238,6 @@ struct MOZ_RAII AutoDisableCompactingGC {
   JSContext* cx;
 };
 
-/*
- * Dynamically select the GC heap to allocate into for a graph of GC things.
- *
- * Initially |heap()| will return Heap::Default to select nursery allocation,
- * but when a specified number of nursery collections have been triggered it
- * switches to returning Heap::Tenured.
- */
-class MOZ_RAII AutoSelectGCHeap {
- public:
-  explicit AutoSelectGCHeap(JSContext* cx,
-                            size_t allowedNurseryCollections = 0);
-  ~AutoSelectGCHeap();
-
-  gc::Heap heap() const { return heap_; }
-  operator gc::Heap() const { return heap_; }
-
-  void onNurseryCollectionEnd();
-
- private:
-  static void NurseryCollectionCallback(JSContext* cx,
-                                        JS::GCNurseryProgress progress,
-                                        JS::GCReason reason, void* data);
-
-  JSContext* cx_;
-  size_t allowedNurseryCollections_;
-  gc::Heap heap_ = gc::Heap::Default;
-};
-
 } /* namespace js */
 
 #endif /* gc_GC_h */

js/src/gc/GCAPI.cpp

@@ -797,32 +797,3 @@ JS_PUBLIC_API void js::gc::SetPerformanceHint(JSContext* cx,
 
   cx->runtime()->gc.setPerformanceHint(hint);
 }
-
-AutoSelectGCHeap::AutoSelectGCHeap(JSContext* cx,
-                                   size_t allowedNurseryCollections)
-    : cx_(cx), allowedNurseryCollections_(allowedNurseryCollections) {
-  JS::AddGCNurseryCollectionCallback(cx, &NurseryCollectionCallback, this);
-}
-
-AutoSelectGCHeap::~AutoSelectGCHeap() {
-  JS::RemoveGCNurseryCollectionCallback(cx_, &NurseryCollectionCallback, this);
-}
-
-/* static */
-void AutoSelectGCHeap::NurseryCollectionCallback(JSContext* cx,
-                                                 JS::GCNurseryProgress progress,
-                                                 JS::GCReason reason,
-                                                 void* data) {
-  if (progress == JS::GCNurseryProgress::GC_NURSERY_COLLECTION_END) {
-    static_cast<AutoSelectGCHeap*>(data)->onNurseryCollectionEnd();
-  }
-}
-
-void AutoSelectGCHeap::onNurseryCollectionEnd() {
-  if (allowedNurseryCollections_ != 0) {
-    allowedNurseryCollections_--;
-    return;
-  }
-
-  heap_ = gc::Heap::Tenured;
-}

js/src/jsnum.cpp

@@ -808,12 +808,6 @@ MOZ_ALWAYS_INLINE static T* BackfillInt32InBuffer(int32_t si, T* buffer,
 
 template <AllowGC allowGC>
 JSLinearString* js::Int32ToString(JSContext* cx, int32_t si) {
-  return js::Int32ToStringWithHeap<allowGC>(cx, si, gc::Heap::Default);
-}
-
-template <AllowGC allowGC>
-JSLinearString* js::Int32ToStringWithHeap(JSContext* cx, int32_t si,
-                                          gc::Heap heap) {
   if (JSLinearString* str = LookupInt32ToString(cx, si)) {
     return str;
   }
@@ -824,7 +818,8 @@ JSLinearString* js::Int32ToStringWithHeap(JSContext* cx, int32_t si,
       BackfillInt32InBuffer(si, buffer, std::size(buffer), &length);
 
   mozilla::Range<const Latin1Char> chars(start, length);
-  JSInlineString* str = NewInlineString<allowGC>(cx, chars, heap);
+  JSInlineString* str =
+      NewInlineString<allowGC>(cx, chars, js::gc::Heap::Default);
   if (!str) {
     return nullptr;
   }

js/src/jsnum.h

@@ -53,10 +53,6 @@ frontend::TaggedParserAtomIndex NumberToParserAtom(
 template <AllowGC allowGC>
 extern JSLinearString* Int32ToString(JSContext* cx, int32_t i);
 
-template <AllowGC allowGC>
-extern JSLinearString* Int32ToStringWithHeap(JSContext* cx, int32_t i,
-                                             gc::Heap heap);
-
 extern JSLinearString* Int32ToStringPure(JSContext* cx, int32_t i);
 
 extern JSString* Int32ToStringWithBase(JSContext* cx, int32_t i, int32_t base);

js/src/vm/Iteration.cpp

@@ -24,7 +24,6 @@
 #include "builtin/Array.h"
 #include "builtin/SelfHostingDefines.h"
 #include "ds/Sort.h"
-#include "gc/GC.h"
 #include "gc/GCContext.h"
 #include "js/ForOfIterator.h"         // JS::ForOfIterator
 #include "js/friend/ErrorMessages.h"  // js::GetErrorMessage, JSMSG_*
@@ -965,14 +964,9 @@ NativeIterator::NativeIterator(JSContext* cx,
   }
   MOZ_ASSERT(static_cast<void*>(shapesEnd_) == propertyCursor_);
 
-  // Allocate any strings in the nursery until the first minor GC. After this
-  // point they will end up getting tenured anyway because they are reachable
-  // from |propIter| which will be tenured.
-  AutoSelectGCHeap gcHeap(cx);
-
   size_t numProps = props.length();
   for (size_t i = 0; i < numProps; i++) {
-    JSLinearString* str = IdToString(cx, props[i], gcHeap);
+    JSLinearString* str = IdToString(cx, props[i]);
     if (!str) {
       *hadError = true;
       return;

js/src/vm/JSAtomUtils-inl.h

@@ -115,14 +115,13 @@ inline bool IndexToId(JSContext* cx, uint32_t index, MutableHandleId idp) {
   return IndexToIdSlow(cx, index, idp);
 }
 
-static MOZ_ALWAYS_INLINE JSLinearString* IdToString(
-    JSContext* cx, jsid id, gc::Heap heap = gc::Heap::Default) {
+static MOZ_ALWAYS_INLINE JSLinearString* IdToString(JSContext* cx, jsid id) {
   if (id.isString()) {
     return id.toAtom();
   }
 
   if (MOZ_LIKELY(id.isInt())) {
-    return Int32ToStringWithHeap<CanGC>(cx, id.toInt(), heap);
+    return Int32ToString<CanGC>(cx, id.toInt());
   }
 
   RootedValue idv(cx, IdToValue(id));

js/src/vm/JSONParser.cpp

@@ -585,30 +585,24 @@ void JSONTokenizer<CharT, ParserT, StringBuilderT>::getTextPosition(
   *line = row;
 }
 
-// JSONFullParseHandlerAnyChar uses an AutoSelectGCHeap to switch to allocating
-// in the tenured heap if we trigger more than one nursery collection.
-//
-// JSON parsing allocates from the leaves of the tree upwards (unlike
-// structured clone deserialization which works from the root
-// downwards). Because of this it doesn't necessarily make sense to stop
-// nursery allocation after the first collection as this doesn't doom the
-// whole data structure to being tenured. We don't know ahead of time how
-// big the resulting data structure will be but after two nursery
-// collections then at least half of it will end up tenured.
-
 JSONFullParseHandlerAnyChar::JSONFullParseHandlerAnyChar(JSContext* cx)
-    : cx(cx), gcHeap(cx, 1), freeElements(cx), freeProperties(cx) {}
+    : cx(cx), freeElements(cx), freeProperties(cx) {
+  JS::AddGCNurseryCollectionCallback(cx, &NurseryCollectionCallback, this);
+}
 
 JSONFullParseHandlerAnyChar::JSONFullParseHandlerAnyChar(
     JSONFullParseHandlerAnyChar&& other) noexcept
     : cx(other.cx),
       v(other.v),
       parseType(other.parseType),
-      gcHeap(cx, 1),
       freeElements(std::move(other.freeElements)),
-      freeProperties(std::move(other.freeProperties)) {}
+      freeProperties(std::move(other.freeProperties)) {
+  JS::AddGCNurseryCollectionCallback(cx, &NurseryCollectionCallback, this);
+}
 
 JSONFullParseHandlerAnyChar::~JSONFullParseHandlerAnyChar() {
+  JS::RemoveGCNurseryCollectionCallback(cx, &NurseryCollectionCallback, this);
+
   for (size_t i = 0; i < freeElements.length(); i++) {
     js_delete(freeElements[i]);
   }
@@ -618,6 +612,31 @@ JSONFullParseHandlerAnyChar::~JSONFullParseHandlerAnyChar() {
   }
 }
 
+/* static */
+void JSONFullParseHandlerAnyChar::NurseryCollectionCallback(
+    JSContext* cx, JS::GCNurseryProgress progress, JS::GCReason reason,
+    void* data) {
+  auto* handler = static_cast<JSONFullParseHandlerAnyChar*>(data);
+
+  // Switch to allocating in the tenured heap if we trigger more than one
+  // nursery collection.
+  //
+  // JSON parsing allocates from the leaves of the tree upwards (unlike
+  // structured clone deserialization which works from the root
+  // downwards). Because of this it doesn't necessarily make sense to stop
+  // nursery allocation after the first collection as this doesn't doom the
+  // whole data structure to being tenured. We don't know ahead of time how big
+  // the resulting data structure will be but after two nursery collections then
+  // at least half of it will end up tenured.
+
+  if (progress == JS::GCNurseryProgress::GC_NURSERY_COLLECTION_END) {
+    handler->nurseryCollectionCount++;
+    if (handler->nurseryCollectionCount == 2) {
+      handler->gcHeap = gc::Heap::Tenured;
+    }
+  }
+}
+
 void JSONFullParseHandlerAnyChar::trace(JSTracer* trc) {
   JS::TraceRoot(trc, &v, "JSONFullParseHandlerAnyChar current value");
 }

js/src/vm/JSONParser.h

@@ -17,7 +17,6 @@
 #include <utility>   // std::move
 
 #include "ds/IdValuePair.h"  // IdValuePair
-#include "gc/GC.h"           // AutoSelectGCHeap
 #include "js/GCVector.h"     // JS::GCVector
 #include "js/RootingAPI.h"  // JS::Handle, JS::MutableHandle, MutableWrappedPtrOperations
 #include "js/Value.h"           // JS::Value, JS::BooleanValue, JS::NullValue
@@ -195,7 +194,11 @@ class MOZ_STACK_CLASS JSONFullParseHandlerAnyChar {
 
   ParseType parseType = ParseType::JSONParse;
 
-  AutoSelectGCHeap gcHeap;
+  // The number of nursery collections that have occurred.
+  size_t nurseryCollectionCount = 0;
+
+  // The heap to use for allocating GC things.
+  gc::Heap gcHeap = gc::Heap::Default;
 
  private:
   // Unused element and property vectors for previous in progress arrays and
@@ -268,6 +271,10 @@ class MOZ_STACK_CLASS JSONFullParseHandlerAnyChar {
   inline void freeStackEntry(StackEntry& entry);
 
   void trace(JSTracer* trc);
+
+  static void NurseryCollectionCallback(JSContext* cx,
+                                        JS::GCNurseryProgress progress,
+                                        JS::GCReason reason, void* data);
 };
 
 template <typename CharT>

js/src/vm/StructuredClone.cpp

@@ -43,7 +43,6 @@
 
 #include "builtin/DataViewObject.h"
 #include "builtin/MapObject.h"
-#include "gc/GC.h"           // AutoSelectGCHeap
 #include "js/Array.h"        // JS::GetArrayLength, JS::IsArrayObject
 #include "js/ArrayBuffer.h"  // JS::{ArrayBufferHasData,DetachArrayBuffer,IsArrayBufferObject,New{,Mapped}ArrayBufferWithContents,ReleaseMappedArrayBufferContents}
 #include "js/ColumnNumber.h"  // JS::ColumnNumberOneOrigin, JS::TaggedColumnNumberOneOrigin
@@ -423,6 +422,7 @@ struct JSStructuredCloneReader {
                                    const JS::CloneDataPolicy& cloneDataPolicy,
                                    const JSStructuredCloneCallbacks* cb,
                                    void* cbClosure);
+  ~JSStructuredCloneReader();
 
   SCInput& input() { return in; }
   bool read(MutableHandleValue vp, size_t nbytes);
@@ -481,6 +481,10 @@ struct JSStructuredCloneReader {
       MutableHandleValue vp,
       ShouldAtomizeStrings atomizeStrings = DontAtomizeStrings);
 
+  static void NurseryCollectionCallback(JSContext* cx,
+                                        JS::GCNurseryProgress progress,
+                                        JS::GCReason reason, void* data);
+
   SCInput& in;
 
   // The widest scope that the caller will accept, where
@@ -534,7 +538,7 @@ struct JSStructuredCloneReader {
   //
   // This is only used for the most common kind, e.g. plain objects, strings
   // and a couple of others.
-  AutoSelectGCHeap gcHeap;
+  gc::Heap gcHeap = gc::Heap::Default;
 
   friend bool JS_ReadString(JSStructuredCloneReader* r,
                             JS::MutableHandleString str);
@@ -2453,12 +2457,31 @@ JSStructuredCloneReader::JSStructuredCloneReader(
       allObjs(in.context()),
       numItemsRead(0),
       callbacks(cb),
-      closure(cbClosure),
-      gcHeap(in.context()) {
+      closure(cbClosure) {
   // Avoid the need to bounds check by keeping a never-matching element at the
   // base of the `objState` stack. This append() will always succeed because
   // the objState vector has a nonzero MinInlineCapacity.
   MOZ_ALWAYS_TRUE(objState.append(std::make_pair(nullptr, true)));
+
+  JS::AddGCNurseryCollectionCallback(in.context(), &NurseryCollectionCallback,
+                                     this);
+}
+
+JSStructuredCloneReader::~JSStructuredCloneReader() {
+  JS::RemoveGCNurseryCollectionCallback(in.context(),
+                                        &NurseryCollectionCallback, this);
+}
+
+/* static */
+void JSStructuredCloneReader::NurseryCollectionCallback(
+    JSContext* cx, JS::GCNurseryProgress progress, JS::GCReason reason,
+    void* data) {
+  auto* reader = static_cast<JSStructuredCloneReader*>(data);
+
+  // Switch to allocation in the tenured heap after nursery collection.
+  if (progress == JS::GCNurseryProgress::GC_NURSERY_COLLECTION_END) {
+    reader->gcHeap = gc::Heap::Tenured;
+  }
 }
 
 template <typename CharT>