Bug 841059 - Do not use the ArenaHeader for getAllocKind on JSObject; r=billm

--HG--
extra : rebase_source : f93c1b79b911815b5adf917544d2c2cf73f3f7f6

js/src/gc/Heap.h

@@ -85,7 +85,7 @@ static const size_t MAX_BACKGROUND_FINALIZE_KINDS = FINALIZE_LIMIT - FINALIZE_OB
 struct Cell
 {
     inline ArenaHeader *arenaHeader() const;
-    inline AllocKind getAllocKind() const;
+    inline AllocKind tenuredGetAllocKind() const;
     MOZ_ALWAYS_INLINE bool isMarked(uint32_t color = BLACK) const;
     MOZ_ALWAYS_INLINE bool markIfUnmarked(uint32_t color = BLACK) const;
     MOZ_ALWAYS_INLINE void unmark(uint32_t color) const;
@@ -950,7 +950,7 @@ Cell::runtime() const
 }
 
 AllocKind
-Cell::getAllocKind() const
+Cell::tenuredGetAllocKind() const
 {
     return arenaHeader()->getAllocKind();
 }

js/src/jsapi-tests/testBug604087.cpp

@@ -22,7 +22,7 @@ struct OuterWrapper : js::Wrapper
         return true;
     }
 
-    virtual bool finalizeInBackground(JS::HandleValue priv) {
+    virtual bool finalizeInBackground(JS::Value priv) {
         return false;
     }
 

js/src/jsfun.h

@@ -273,7 +273,7 @@ class JSFunction : public JSObject
 
     inline bool isExtended() const {
         JS_STATIC_ASSERT(FinalizeKind != ExtendedFinalizeKind);
-        JS_ASSERT(!!(flags & EXTENDED) == (getAllocKind() == ExtendedFinalizeKind));
+        JS_ASSERT_IF(isTenured(), !!(flags & EXTENDED) == (tenuredGetAllocKind() == ExtendedFinalizeKind));
         return !!(flags & EXTENDED);
     }
 
@@ -287,6 +287,15 @@ class JSFunction : public JSObject
     static bool setTypeForScriptedFunction(JSContext *cx, js::HandleFunction fun,
                                            bool singleton = false);
 
+    /* GC support. */
+    js::gc::AllocKind getAllocKind() const {
+        js::gc::AllocKind kind = FinalizeKind;
+        if (isExtended())
+            kind = ExtendedFinalizeKind;
+        JS_ASSERT_IF(isTenured(), kind == tenuredGetAllocKind());
+        return kind;
+    }
+
   private:
     /*
      * These member functions are inherited from JSObject, but should never be applied to

js/src/jsgcinlines.h

@@ -203,7 +203,7 @@ GetGCThingTraceKind(const void *thing)
     if (IsInsideNursery(cell->runtime(), cell))
         return JSTRACE_OBJECT;
 #endif
-    return MapAllocToTraceKind(cell->getAllocKind());
+    return MapAllocToTraceKind(cell->tenuredGetAllocKind());
 }
 
 static inline void

js/src/jsobjinlines.h

@@ -235,7 +235,7 @@ JSObject::finalize(js::FreeOp *fop)
     js::Probes::finalizeObject(this);
 
 #ifdef DEBUG
-    if (!IsBackgroundFinalized(getAllocKind())) {
+    if (isTenured() && !IsBackgroundFinalized(tenuredGetAllocKind())) {
         /* Assert we're on the main thread. */
         fop->runtime()->assertValidThread();
     }

js/src/jsproxy.h

@@ -77,7 +77,7 @@ class JS_FRIEND_API(BaseProxyHandler) {
         return false;
     }
 
-    virtual bool finalizeInBackground(HandleValue priv) {
+    virtual bool finalizeInBackground(Value priv) {
         /*
          * Called on creation of a proxy to determine whether its finalize
          * method can be finalized on the background thread.

js/src/jswrapper.cpp

@@ -206,7 +206,7 @@ CrossCompartmentWrapper::~CrossCompartmentWrapper()
 {
 }
 
-bool CrossCompartmentWrapper::finalizeInBackground(HandleValue priv)
+bool CrossCompartmentWrapper::finalizeInBackground(Value priv)
 {
     if (!priv.isObject())
         return true;

js/src/jswrapper.h

@@ -83,7 +83,7 @@ class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
 
     virtual ~CrossCompartmentWrapper();
 
-    virtual bool finalizeInBackground(HandleValue priv) MOZ_OVERRIDE;
+    virtual bool finalizeInBackground(Value priv) MOZ_OVERRIDE;
 
     /* ES5 Harmony fundamental wrapper traps. */
     virtual bool getPropertyDescriptor(JSContext *cx, JSObject *wrapper, jsid id,

js/src/vm/ObjectImpl.cpp

@@ -325,6 +325,33 @@ js::ObjectImpl::markChildren(JSTracer *trc)
     }
 }
 
+gc::AllocKind
+js::ObjectImpl::getAllocKind() const
+{
+    gc::AllocKind allocKind;
+    if (asObjectPtr()->isArray()) {
+        JS_ASSERT(isTenured());
+        allocKind = tenuredGetAllocKind();
+    } else if (asObjectPtr()->isFunction()) {
+        allocKind = asObjectPtr()->toFunction()->getAllocKind();
+    } else if (asObjectPtr()->isProxy()) {
+        BaseProxyHandler *handler =
+            static_cast<BaseProxyHandler *>(getSlot(JSSLOT_PROXY_HANDLER).toPrivate());
+        Value priv = getSlot(JSSLOT_PROXY_PRIVATE);
+        allocKind = gc::GetGCObjectKind(getClass());
+        if (handler->finalizeInBackground(priv))
+            allocKind = GetBackgroundAllocKind(allocKind);
+    } else {
+        Class *clasp = getClass();
+        allocKind = gc::GetGCObjectFixedSlotsKind(numFixedSlots());
+        JS_ASSERT(!IsBackgroundFinalized(allocKind));
+        if (CanBeFinalizedInBackground(allocKind, clasp))
+            allocKind = GetBackgroundAllocKind(allocKind);
+    }
+    JS_ASSERT_IF(isTenured(), allocKind == tenuredGetAllocKind());
+    return allocKind;
+}
+
 bool
 DenseElementsHeader::getOwnElement(JSContext *cx, Handle<ObjectImpl*> obj, uint32_t index,
                                    unsigned resolveFlags, PropDesc *desc)

js/src/vm/ObjectImpl.h

@@ -1094,6 +1094,7 @@ class ObjectImpl : public gc::Cell
     }
 
     JSObject * asObjectPtr() { return reinterpret_cast<JSObject *>(this); }
+    const JSObject * asObjectPtr() const { return reinterpret_cast<const JSObject *>(this); }
 
     friend inline Value ObjectValue(ObjectImpl &obj);
 
@@ -1371,6 +1372,7 @@ class ObjectImpl : public gc::Cell
 
     /* GC support. */
     JS_ALWAYS_INLINE Zone *zone() const;
+    gc::AllocKind getAllocKind() const;
     static inline ThingRootKind rootKind() { return THING_ROOT_OBJECT; }
     static inline void readBarrier(ObjectImpl *obj);
     static inline void writeBarrierPre(ObjectImpl *obj);

js/src/vm/String.h

@@ -415,6 +415,7 @@ class JSString : public js::gc::Cell
     }
 
     JS::Zone *zone() const { return tenuredZone(); }
+    js::gc::AllocKind getAllocKind() const { return tenuredGetAllocKind(); }
 
     static inline void writeBarrierPre(JSString *str);
     static inline void writeBarrierPost(JSString *str, void *addr);