From e90202ab51ddd4b6358335306f7a08e9f7516554 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Thu, 12 Nov 2015 13:43:30 -0800
Subject: [PATCH] Bug 1223853 - Use stable hashing for ObjectValueMap; r=jonco

--HG--
extra : rebase_source : 70ef64bca2e6c5e1cc0883b25fc3453b2966257c
---
 js/src/builtin/WeakMapObject.cpp |  8 --------
 js/src/gc/Barrier.h              | 19 ++++++++++++++++++-
 js/src/jsweakmap.cpp             |  2 --
 js/src/jsweakmap.h               |  9 +++++----
 4 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/js/src/builtin/WeakMapObject.cpp b/js/src/builtin/WeakMapObject.cpp
index 6429b3307256..240398b71be5 100644
--- a/js/src/builtin/WeakMapObject.cpp
+++ b/js/src/builtin/WeakMapObject.cpp
@@ -148,13 +148,6 @@ TryPreserveReflector(JSContext* cx, HandleObject obj)
     return true;
 }
 
-static inline void
-WeakMapPostWriteBarrier(JSRuntime* rt, ObjectValueMap* weakMap, JSObject* key)
-{
-    if (key && IsInsideNursery(key))
-        rt->gc.storeBuffer.putGeneric(gc::HashKeyRef<ObjectValueMap, JSObject*>(weakMap, key));
-}
-
 static MOZ_ALWAYS_INLINE bool
 SetWeakMapEntryInternal(JSContext* cx, Handle<WeakMapObject*> mapObj,
                         HandleObject key, HandleValue value)
@@ -189,7 +182,6 @@ SetWeakMapEntryInternal(JSContext* cx, Handle<WeakMapObject*> mapObj,
         JS_ReportOutOfMemory(cx);
         return false;
     }
-    WeakMapPostWriteBarrier(cx->runtime(), map, key.get());
     return true;
 }
 
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index ddff73496158..9fdcca6a3f8d 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -482,7 +482,9 @@ class RelocatablePtr : public WriteBarrieredBase<T>
 {
   public:
     RelocatablePtr() : WriteBarrieredBase<T>(GCMethods<T>::initial()) {}
-    explicit RelocatablePtr(T v) : WriteBarrieredBase<T>(v) {
+
+    // Implicitly adding barriers is a reasonable default.
+    MOZ_IMPLICIT RelocatablePtr(const T& v) : WriteBarrieredBase<T>(v) {
         this->post(GCMethods<T>::initial(), this->value);
     }
 
@@ -560,14 +562,18 @@ class ReadBarriered : public ReadBarrieredBase<T>
   public:
     ReadBarriered() : ReadBarrieredBase<T>(GCMethods<T>::initial()) {}
 
+    // It is okay to add barriers implicitly.
     MOZ_IMPLICIT ReadBarriered(const T& v) : ReadBarrieredBase<T>(v) {
         this->post(GCMethods<T>::initial(), v);
     }
 
+    // Copy is creating a new edge, so we must read barrier the source edge.
     explicit ReadBarriered(const ReadBarriered& v) : ReadBarrieredBase<T>(v) {
         this->post(GCMethods<T>::initial(), v.get());
     }
 
+    // Move retains the lifetime status of the source edge, so does not fire
+    // the read barrier of the defunct edge.
     ReadBarriered(ReadBarriered&& v)
       : ReadBarrieredBase<T>(mozilla::Forward<ReadBarriered<T>>(v))
     {
@@ -799,6 +805,17 @@ struct MovableCellHasher
     static void rekey(Key& k, const Key& newKey) { k = newKey; }
 };
 
+template <typename T>
+struct MovableCellHasher<RelocatablePtr<T>>
+{
+    using Key = RelocatablePtr<T>;
+    using Lookup = T;
+
+    static HashNumber hash(const Lookup& l) { return MovableCellHasher<T>::hash(l); }
+    static bool match(const Key& k, const Lookup& l) { return MovableCellHasher<T>::match(k, l); }
+    static void rekey(Key& k, const Key& newKey) { k.unsafeSet(newKey); }
+};
+
 /* Useful for hashtables with a HeapPtr as key. */
 template <class T>
 struct HeapPtrHasher
diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 20859a628bec..004c04806bb6 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -188,8 +188,6 @@ ObjectWeakMap::add(JSContext* cx, JSObject* obj, JSObject* target)
         ReportOutOfMemory(cx);
         return false;
     }
-    if (IsInsideNursery(obj))
-        cx->runtime()->gc.storeBuffer.putGeneric(StoreBufferRef(&map, obj));
 
     return true;
 }
diff --git a/js/src/jsweakmap.h b/js/src/jsweakmap.h
index 5d256e631336..a82d6ea42f09 100644
--- a/js/src/jsweakmap.h
+++ b/js/src/jsweakmap.h
@@ -392,11 +392,14 @@ extern JSObject*
 InitWeakMapClass(JSContext* cx, HandleObject obj);
 
 
-class ObjectValueMap : public WeakMap<PreBarrieredObject, RelocatableValue>
+class ObjectValueMap : public WeakMap<RelocatablePtrObject, RelocatableValue,
+                                      MovableCellHasher<RelocatablePtrObject>>
 {
   public:
     ObjectValueMap(JSContext* cx, JSObject* obj)
-      : WeakMap<PreBarrieredObject, RelocatableValue>(cx, obj) {}
+      : WeakMap<RelocatablePtrObject, RelocatableValue,
+                MovableCellHasher<RelocatablePtrObject>>(cx, obj)
+    {}
 
     virtual bool findZoneEdges();
 };
@@ -405,9 +408,7 @@ class ObjectValueMap : public WeakMap<PreBarrieredObject, RelocatableValue>
 // Generic weak map for mapping objects to other objects.
 class ObjectWeakMap
 {
-  private:
     ObjectValueMap map;
-    typedef gc::HashKeyRef<ObjectValueMap, JSObject*> StoreBufferRef;
 
   public:
     explicit ObjectWeakMap(JSContext* cx);