Bug 1517823 - Part 1: Store out of line TypedArray data in ArrayBuffer malloc-arena. r=sfink

js/src/gc/Nursery.cpp

@@ -456,7 +456,8 @@ void* js::Nursery::allocateBufferSameLocation(JSObject* obj, size_t nbytes) {
   return allocate(nbytes);
 }
 
-void* js::Nursery::allocateZeroedBuffer(Zone* zone, size_t nbytes) {
+void* js::Nursery::allocateZeroedBuffer(
+    Zone* zone, size_t nbytes, arena_id_t arena /*= js::MallocArena*/) {
   MOZ_ASSERT(nbytes > 0);
 
   if (nbytes <= MaxNurseryBufferSize) {
@@ -467,7 +468,7 @@ void* js::Nursery::allocateZeroedBuffer(Zone* zone, size_t nbytes) {
     }
   }
 
-  void* buffer = zone->pod_calloc<uint8_t>(nbytes);
+  void* buffer = zone->pod_calloc<uint8_t>(nbytes, arena);
   if (buffer && !registerMallocedBuffer(buffer)) {
     js_free(buffer);
     return nullptr;
@@ -475,14 +476,15 @@ void* js::Nursery::allocateZeroedBuffer(Zone* zone, size_t nbytes) {
   return buffer;
 }
 
-void* js::Nursery::allocateZeroedBuffer(JSObject* obj, size_t nbytes) {
+void* js::Nursery::allocateZeroedBuffer(
+    JSObject* obj, size_t nbytes, arena_id_t arena /*= js::MallocArena*/) {
   MOZ_ASSERT(obj);
   MOZ_ASSERT(nbytes > 0);
 
   if (!IsInsideNursery(obj)) {
-    return obj->zone()->pod_calloc<uint8_t>(nbytes);
+    return obj->zone()->pod_calloc<uint8_t>(nbytes, arena);
   }
-  return allocateZeroedBuffer(obj->zone(), nbytes);
+  return allocateZeroedBuffer(obj->zone(), nbytes, arena);
 }
 
 void* js::Nursery::reallocateBuffer(JSObject* obj, void* oldBuffer,

js/src/gc/Nursery.h

@@ -244,15 +244,19 @@ class Nursery {
   void* allocateBufferSameLocation(JSObject* obj, size_t nbytes);
 
   /* Allocate a zero-initialized buffer for a given zone, using the nursery if
-   * possible.
+   * possible. If the buffer isn't allocated in the nursery, the given arena is
+   * used.
    */
-  void* allocateZeroedBuffer(JS::Zone* zone, size_t nbytes);
+  void* allocateZeroedBuffer(JS::Zone* zone, size_t nbytes,
+                             arena_id_t arena = js::MallocArena);
 
   /*
    * Allocate a zero-initialized buffer for a given object, using the nursery if
-   * possible and obj is in the nursery.
+   * possible and obj is in the nursery. If the buffer isn't allocated in the
+   * nursery, the given arena is used.
    */
-  void* allocateZeroedBuffer(JSObject* obj, size_t nbytes);
+  void* allocateZeroedBuffer(JSObject* obj, size_t nbytes,
+                             arena_id_t arena = js::MallocArena);
 
   /* Resize an existing object buffer. */
   void* reallocateBuffer(JSObject* obj, void* oldBuffer, size_t oldBytes,

js/src/jit/MacroAssembler.cpp

@@ -1180,7 +1180,8 @@ static void AllocateObjectBufferWithInit(JSContext* cx, TypedArrayObject* obj,
   MOZ_ASSERT((CheckedUint32(nbytes) + sizeof(Value)).isValid());
 
   nbytes = JS_ROUNDUP(nbytes, sizeof(Value));
-  void* buf = cx->nursery().allocateZeroedBuffer(obj, nbytes);
+  void* buf = cx->nursery().allocateZeroedBuffer(obj, nbytes,
+                                                 js::ArrayBufferContentsArena);
   if (buf) {
     obj->initPrivate(buf);
   }

js/src/vm/MallocProvider.h

@@ -49,8 +49,8 @@ namespace js {
 template <class Client>
 struct MallocProvider {
   template <class T>
-  T* maybe_pod_malloc(size_t numElems) {
-    T* p = js_pod_malloc<T>(numElems);
+  T* maybe_pod_malloc(size_t numElems, arena_id_t arena = js::MallocArena) {
+    T* p = js_pod_arena_malloc<T>(arena, numElems);
     if (MOZ_LIKELY(p)) {
       client()->updateMallocCounter(numElems * sizeof(T));
     }
@@ -85,8 +85,8 @@ struct MallocProvider {
   }
 
   template <class T>
-  T* pod_malloc(size_t numElems) {
-    T* p = maybe_pod_malloc<T>(numElems);
+  T* pod_malloc(size_t numElems, arena_id_t arena = js::MallocArena) {
+    T* p = maybe_pod_malloc<T>(numElems, arena);
     if (MOZ_LIKELY(p)) {
       return p;
     }

js/src/vm/TypedArrayObject.cpp

@@ -192,7 +192,8 @@ void TypedArrayObject::finalize(FreeOp* fop, JSObject* obj) {
     MOZ_ASSERT(!oldObj->hasInlineElements());
     AutoEnterOOMUnsafeRegion oomUnsafe;
     nbytes = JS_ROUNDUP(nbytes, sizeof(Value));
-    void* data = newObj->zone()->pod_malloc<uint8_t>(nbytes);
+    void* data = newObj->zone()->pod_malloc<uint8_t>(
+        nbytes, js::ArrayBufferContentsArena);
     if (!data) {
       oomUnsafe.crash(
           "Failed to allocate typed array elements while tenuring.");
@@ -528,7 +529,7 @@ class TypedArrayObjectTemplate : public TypedArrayObject {
     UniquePtr<void, JS::FreePolicy> buf;
     if (!fitsInline) {
       MOZ_ASSERT(len > 0);
-      buf.reset(cx->pod_calloc<uint8_t>(nbytes));
+      buf.reset(cx->pod_calloc<uint8_t>(nbytes, js::ArrayBufferContentsArena));
       if (!buf) {
         return nullptr;
       }