Backed out 2 changesets (bug 1684123, bug 1682068) for causing bustages.

CLOSED TREE

Backed out changeset e6df68a131a3 (bug 1682068)
Backed out changeset 91ad893cc4d4 (bug 1684123)

dom/bindings/TypedArray.h

@@ -115,18 +115,6 @@ struct TypedArray_base : public SpiderMonkeyInterfaceObjectStorage,
     return mData;
   }
 
-  // Return a pointer to data that will not move during a GC.
-  //
-  // For some smaller views, this will copy the data into the provided buffer
-  // and return that buffer as the pointer. Otherwise, this will return a
-  // direct pointer to the actual data with no copying. If the provided buffer
-  // is not large enough, nullptr will be returned. If bufSize is at least
-  // JS_MaxMovableTypedArraySize(), the data is guaranteed to fit.
-  inline T* FixedData(uint8_t* buffer, size_t bufSize) const {
-    MOZ_ASSERT(mComputed);
-    return JS_GetArrayBufferViewFixedData(mImplObj, buffer, bufSize);
-  }
-
   inline uint32_t Length() const {
     MOZ_ASSERT(mComputed);
     return mLength;

dom/canvas/ImageBitmap.cpp

@@ -881,27 +881,13 @@ already_AddRefed<ImageBitmap> ImageBitmap::CreateInternal(
 
   // Create and Crop the raw data into a layers::Image
   RefPtr<layers::Image> data;
-
-  // If the data could move during a GC, copy it out into a local buffer that
-  // lives until a CreateImageFromRawData lower in the stack copies it.
-  // Reassure the static analysis that we know what we're doing.
-  size_t maxInline = JS_MaxMovableTypedArraySize();
-  uint8_t inlineDataBuffer[maxInline];
-  uint8_t* fixedData = array.FixedData(inlineDataBuffer, maxInline);
-
-  // Lie to the hazard analysis and say that we're done with everything that
-  // `array` was using (safe because the data buffer is fixed, and the holding
-  // JSObject is being kept alive elsewhere.)
-  array.Reset();
-
   if (NS_IsMainThread()) {
-    data = CreateImageFromRawData(imageSize, imageStride, FORMAT,
-                                  fixedData,
+    data = CreateImageFromRawData(imageSize, imageStride, FORMAT, array.Data(),
                                   dataLength, aCropRect);
   } else {
     RefPtr<CreateImageFromRawDataInMainThreadSyncTask> task =
         new CreateImageFromRawDataInMainThreadSyncTask(
-            fixedData, dataLength, imageStride, FORMAT, imageSize, aCropRect,
+            array.Data(), dataLength, imageStride, FORMAT, imageSize, aCropRect,
             getter_AddRefs(data));
     task->Dispatch(Canceling, aRv);
   }
@@ -911,7 +897,7 @@ already_AddRefed<ImageBitmap> ImageBitmap::CreateInternal(
     return nullptr;
   }
 
-  // Create an ImageBitmap.
+  // Create an ImageBimtap.
   RefPtr<ImageBitmap> ret =
       new ImageBitmap(aGlobal, data, false /* write-only */, alphaType);
 

js/public/experimental/TypedData.h

@@ -378,27 +378,6 @@ extern JS_FRIEND_API double* JS_GetFloat64ArrayData(JSObject* obj,
 extern JS_FRIEND_API void* JS_GetArrayBufferViewData(
     JSObject* obj, bool* isSharedMemory, const JS::AutoRequireNoGC&);
 
-/**
- * Return a "fixed" pointer (one that will not move during a GC) to the
- * ArrayBufferView's data. Note that this will not keep the object alive; the
- * holding object should be rooted or traced. If the view is storing the data
- * inline, this will copy the data to the provided buffer, returning nullptr if
- * bufSize is inadequate.
- *
- * Avoid using this unless necessary. JS_GetArrayBufferViewData is simpler and
- * more efficient because it requires the caller to ensure that a GC will not
- * occur and thus does not need to handle movable data.
- */
-extern JS_FRIEND_API uint8_t* JS_GetArrayBufferViewFixedData(
-    JSObject* obj, uint8_t* buffer, size_t bufSize);
-
-/**
- * If the bufSize passed to JS_GetArrayBufferViewFixedData is at least this
- * many bytes, then any copied data is guaranteed to fit into the provided
- * buffer.
- */
-extern JS_FRIEND_API size_t JS_MaxMovableTypedArraySize();
-
 /**
  * Return the ArrayBuffer or SharedArrayBuffer underlying an ArrayBufferView.
  * This may return a detached buffer.  |obj| must be an object that would

js/src/vm/ArrayBufferViewObject.cpp

@@ -175,37 +175,6 @@ JS_FRIEND_API void* JS_GetArrayBufferViewData(JSObject* obj,
       /*safe - caller sees isSharedMemory flag*/);
 }
 
-JS_FRIEND_API uint8_t* JS_GetArrayBufferViewFixedData(JSObject* obj,
-                                                      uint8_t* buffer,
-                                                      size_t bufSize)
-{
-  ArrayBufferViewObject* view = obj->maybeUnwrapAs<ArrayBufferViewObject>();
-  if (!view) {
-    return nullptr;
-  }
-
-  // Disallow shared memory until it is needed.
-  if (view->isSharedMemory()) {
-    return nullptr;
-  }
-
-  // TypedArrays (but not DataViews) can have inline data, in which case we
-  // need to copy into the given buffer.
-  if (view->is<TypedArrayObject>()) {
-    TypedArrayObject* ta = &view->as<TypedArrayObject>();
-    if (ta->hasInlineElements()) {
-      size_t bytes = ta->byteLength().get();
-      if (bytes > bufSize) {
-        return nullptr; // Does not fit.
-      }
-      memcpy(buffer, view->dataPointerUnshared(), bytes);
-      return buffer;
-    }
-  }
-
-  return static_cast<uint8_t*>(view->dataPointerUnshared());
-}
-
 JS_FRIEND_API JSObject* JS_GetArrayBufferViewBuffer(JSContext* cx,
                                                     HandleObject obj,
                                                     bool* isSharedMemory) {

js/src/vm/TypedArrayObject.cpp

@@ -2622,7 +2622,3 @@ JS_FRIEND_API js::Scalar::Type JS_GetArrayBufferViewType(JSObject* obj) {
   }
   MOZ_CRASH("invalid ArrayBufferView type");
 }
-
-JS_FRIEND_API size_t JS_MaxMovableTypedArraySize() {
-  return TypedArrayObject::INLINE_BUFFER_LIMIT;
-}