Avoid sharing owned base shapes between multiple shapes, bug 707842. r=luke

js/src/jsscope.cpp

@@ -656,9 +656,9 @@ JSObject::addPropertyInternal(JSContext *cx, jsid id,
     /* Find or create a property tree node labeled by our arguments. */
     Shape *shape;
     {
-        BaseShape *nbase;
+        UnownedBaseShape *nbase;
         if (lastProperty()->base()->matchesGetterSetter(getter, setter)) {
-            nbase = lastProperty()->base();
+            nbase = lastProperty()->base()->unowned();
         } else {
             BaseShape base(getClass(), getParent(), lastProperty()->getObjectFlags(),
                            attrs, getter, setter);
@@ -842,7 +842,7 @@ JSObject::putProperty(JSContext *cx, jsid id,
          */
         BaseShape base(getClass(), getParent(), lastProperty()->getObjectFlags(),
                        attrs, getter, setter);
-        BaseShape *nbase = BaseShape::getUnowned(cx, base);
+        UnownedBaseShape *nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
             return NULL;
 
@@ -951,7 +951,7 @@ JSObject::removeProperty(JSContext *cx, jsid id)
         spare = js_NewGCShape(cx);
         if (!spare)
             return false;
-        new (spare) Shape(shape->base(), 0);
+        new (spare) Shape(shape->base()->unowned(), 0);
     }
 
     /* If shape has a slot, free its slot number. */
@@ -1063,7 +1063,7 @@ JSObject::generateOwnShape(JSContext *cx, Shape *newShape)
         newShape = js_NewGCShape(cx);
         if (!newShape)
             return false;
-        new (newShape) Shape(lastProperty()->base(), 0);
+        new (newShape) Shape(lastProperty()->base()->unowned(), 0);
     }
 
     PropertyTable &table = lastProperty()->table();
@@ -1093,7 +1093,7 @@ JSObject::methodShapeChange(JSContext *cx, const Shape &shape)
     Shape *spare = js_NewGCShape(cx);
     if (!spare)
         return NULL;
-    new (spare) Shape(shape.base(), 0);
+    new (spare) Shape(shape.base()->unowned(), 0);
 
 #ifdef DEBUG
     JS_ASSERT(canHaveMethodBarrier());
@@ -1365,7 +1365,7 @@ EmptyShape::getInitialShape(JSContext *cx, Class *clasp, JSObject *proto, JSObje
     }
 
     BaseShape base(clasp, parent, objectFlags);
-    BaseShape *nbase = BaseShape::getUnowned(cx, base);
+    UnownedBaseShape *nbase = BaseShape::getUnowned(cx, base);
     if (!nbase)
         return NULL;
 

js/src/jsscope.h

@@ -653,13 +653,13 @@ struct Shape : public js::gc::Cell
         UNUSED_BITS     = 0x3C
     };
 
-    Shape(BaseShape *base, jsid id, uint32 slot, uint32 nfixed, uintN attrs, uintN flags, intN shortid);
+    Shape(UnownedBaseShape *base, jsid id, uint32 slot, uint32 nfixed, uintN attrs, uintN flags, intN shortid);
 
     /* Get a shape identical to this one, without parent/kids information. */
     Shape(const Shape *other);
 
     /* Used by EmptyShape (see jsscopeinlines.h). */
-    Shape(BaseShape *base, uint32 nfixed);
+    Shape(UnownedBaseShape *base, uint32 nfixed);
 
     /* Copy constructor disabled, to avoid misuse of the above form. */
     Shape(const Shape &other);
@@ -942,7 +942,7 @@ struct Shape : public js::gc::Cell
 
 struct EmptyShape : public js::Shape
 {
-    EmptyShape(BaseShape *base, uint32 nfixed);
+    EmptyShape(UnownedBaseShape *base, uint32 nfixed);
 
     /*
      * Lookup an initial shape matching the given parameters, creating an empty

js/src/jsscopeinlines.h

@@ -151,7 +151,7 @@ BaseShape::setOwned(UnownedBaseShape *unowned)
 }
 
 inline
-Shape::Shape(BaseShape *base, jsid propid, uint32 slot, uint32 nfixed,
+Shape::Shape(UnownedBaseShape *base, jsid propid, uint32 slot, uint32 nfixed,
              uintN attrs, uintN flags, intN shortid)
   : base_(base),
     propid_(propid),
@@ -181,7 +181,7 @@ Shape::Shape(const Shape *other)
 }
 
 inline
-Shape::Shape(BaseShape *base, uint32 nfixed)
+Shape::Shape(UnownedBaseShape *base, uint32 nfixed)
   : base_(base),
     propid_(JSID_EMPTY),
     slotInfo(SHAPE_INVALID_SLOT | (nfixed << FIXED_SLOTS_SHIFT)),
@@ -332,7 +332,7 @@ Shape::initDictionaryShape(const Shape &child, HeapPtrShape *dictp)
 }
 
 inline
-EmptyShape::EmptyShape(BaseShape *base, uint32 nfixed)
+EmptyShape::EmptyShape(UnownedBaseShape *base, uint32 nfixed)
   : js::Shape(base, nfixed)
 {
     /* Only empty shapes can be NON_NATIVE. */

js/src/jsscript.cpp

@@ -166,7 +166,7 @@ Bindings::add(JSContext *cx, JSAtom *name, BindingKind kind)
     }
 
     BaseShape base(&CallClass, NULL, BaseShape::VAROBJ, attrs, getter, setter);
-    BaseShape *nbase = BaseShape::getUnowned(cx, base);
+    UnownedBaseShape *nbase = BaseShape::getUnowned(cx, base);
     if (!nbase)
         return NULL;