Bug 1212533 - Change the out-param of js/JS::Construct from MutableHandleValue to MutableHandleObject. r=arai, r=jorendorff

--HG--
extra : rebase_source : 74a21ddaa663da2b66fda186b2289f82272f7761

js/ipc/WrapperAnswer.cpp

@@ -425,13 +425,15 @@ WrapperAnswer::RecvCallOrConstruct(const ObjectId& objId,
         ContextOptionsRef(cx).setDontReportUncaught(true);
 
         HandleValueArray args = HandleValueArray::subarray(vals, 2, vals.length() - 2);
-        bool success;
-        if (construct)
-            success = JS::Construct(cx, vals[0], args, &rval);
-        else
-            success = JS::Call(cx, vals[1], vals[0], args, &rval);
-        if (!success)
-            return fail(aes, rs);
+        if (construct) {
+            RootedObject obj(cx);
+            if (!JS::Construct(cx, vals[0], args, &obj))
+                return fail(aes, rs);
+            rval.setObject(*obj);
+        } else {
+            if(!JS::Call(cx, vals[1], vals[0], args, &rval))
+                return fail(aes, rs);
+        }
     }
 
     if (!toVariant(cx, rval, result))

js/src/builtin/Reflect.cpp

@@ -114,7 +114,12 @@ Reflect_construct(JSContext* cx, unsigned argc, Value* vp)
         return false;
 
     // Step 6.
-    return Construct(cx, args.get(0), constructArgs, newTarget, args.rval());
+    RootedObject obj(cx);
+    if (!Construct(cx, args.get(0), constructArgs, newTarget, &obj))
+        return false;
+
+    args.rval().setObject(*obj);
+    return true;
 }
 
 /* ES6 26.1.3 Reflect.defineProperty(target, propertyKey, attributes) */

js/src/jit/BaselineIC.cpp

@@ -6090,8 +6090,12 @@ DoCallFallback(JSContext* cx, BaselineFrame* frame, ICCall_Fallback* stub_, uint
                    "either callee == newTarget, or the initial |new| checked "
                    "that IsConstructor(newTarget)");
 
-        if (!Construct(cx, callee, cargs, newTarget, res))
+        RootedObject obj(cx);
+        if (!Construct(cx, callee, cargs, newTarget, &obj))
             return false;
+
+        res.setObject(*obj);
+
     } else if ((op == JSOP_EVAL || op == JSOP_STRICTEVAL) &&
                frame->scopeChain()->global().valueIsEval(callee))
     {

js/src/jit/VMFunctions.cpp

@@ -83,7 +83,13 @@ InvokeFunction(JSContext* cx, HandleObject obj, bool constructing, uint32_t argc
         if (thisv.isMagic()) {
             MOZ_ASSERT(thisv.whyMagic() == JS_IS_CONSTRUCTING ||
                        thisv.whyMagic() == JS_UNINITIALIZED_LEXICAL);
-            return Construct(cx, fval, cargs, newTarget, rval);
+
+            RootedObject obj(cx);
+            if (!Construct(cx, fval, cargs, newTarget, &obj))
+                return false;
+
+            rval.setObject(*obj);
+            return true;
         }
 
         // Otherwise the default |this| has already been created.  We could

js/src/jsapi-tests/testDifferentNewTargetInvokeConstructor.cpp

@@ -19,18 +19,18 @@ BEGIN_TEST(testDifferentNewTargetInvokeConstructor)
     JS::AutoValueArray<1> args(cx);
     args[0].set(otherFunc);
 
-    JS::RootedValue rval(cx);
+    JS::RootedObject obj(cx);
 
     JS::RootedObject newTarget(cx, &otherFunc.toObject());
 
-    CHECK(JS::Construct(cx, func, newTarget, args, &rval));
+    CHECK(JS::Construct(cx, func, newTarget, args, &obj));
 
     // It should fail, though, if newTarget is not a constructor
     JS::RootedValue plain(cx);
     EVAL("({})", &plain);
     args[0].set(plain);
     newTarget = &plain.toObject();
-    CHECK(!JS::Construct(cx, func, newTarget, args, &rval));
+    CHECK(!JS::Construct(cx, func, newTarget, args, &obj));
 
     return true;
 }

js/src/jsapi-tests/testNewTargetInvokeConstructor.cpp

@@ -16,9 +16,9 @@ BEGIN_TEST(testNewTargetInvokeConstructor)
     JS::AutoValueArray<1> args(cx);
     args[0].set(func);
 
-    JS::RootedValue rval(cx);
+    JS::RootedObject obj(cx);
 
-    CHECK(JS::Construct(cx, func, args, &rval));
+    CHECK(JS::Construct(cx, func, args, &obj));
 
     return true;
 }

js/src/jsapi.cpp

@@ -2884,7 +2884,7 @@ JS::Call(JSContext* cx, HandleValue thisv, HandleValue fval, const JS::HandleVal
 
 JS_PUBLIC_API(bool)
 JS::Construct(JSContext* cx, HandleValue fval, HandleObject newTarget, const JS::HandleValueArray& args,
-              MutableHandleValue rval)
+              MutableHandleObject objp)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -2906,12 +2906,12 @@ JS::Construct(JSContext* cx, HandleValue fval, HandleObject newTarget, const JS:
     if (!FillArgumentsFromArraylike(cx, cargs, args))
         return false;
 
-    return js::Construct(cx, fval, cargs, newTargetVal, rval);
+    return js::Construct(cx, fval, cargs, newTargetVal, objp);
 }
 
 JS_PUBLIC_API(bool)
 JS::Construct(JSContext* cx, HandleValue fval, const JS::HandleValueArray& args,
-              MutableHandleValue rval)
+              MutableHandleObject objp)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -2927,7 +2927,7 @@ JS::Construct(JSContext* cx, HandleValue fval, const JS::HandleValueArray& args,
     if (!FillArgumentsFromArraylike(cx, cargs, args))
         return false;
 
-    return js::Construct(cx, fval, cargs, fval, rval);
+    return js::Construct(cx, fval, cargs, fval, objp);
 }
 
 
@@ -4577,11 +4577,11 @@ JS_NewHelper(JSContext* cx, HandleObject ctor, const JS::HandleValueArray& input
     if (!FillArgumentsFromArraylike(cx, args, inputArgs))
         return nullptr;
 
-    RootedValue rval(cx);
-    if (!js::Construct(cx, ctorVal, args, ctorVal, &rval))
+    RootedObject obj(cx);
+    if (!js::Construct(cx, ctorVal, args, ctorVal, &obj))
         return nullptr;
 
-    return &rval.toObject();
+    return obj;
 }
 
 JS_PUBLIC_API(JSObject*)

js/src/jsapi.h

@@ -3325,21 +3325,18 @@ Call(JSContext* cx, JS::HandleValue thisv, JS::HandleObject funObj, const JS::Ha
  */
 extern JS_PUBLIC_API(bool)
 Construct(JSContext* cx, JS::HandleValue fun, HandleObject newTarget,
-          const JS::HandleValueArray &args, MutableHandleValue rval);
+          const JS::HandleValueArray &args, MutableHandleObject objp);
 
 /**
  * Invoke a constructor. This is the C++ equivalent of
  * `rval = new fun(...args)`.
  *
- * The value left in rval on success is always an object in practice,
- * though at the moment this is not enforced by the C++ type system.
- *
  * Implements: ES6 7.3.13 Construct(F, [argumentsList], [newTarget]), when
  * newTarget is omitted.
  */
 extern JS_PUBLIC_API(bool)
 Construct(JSContext* cx, JS::HandleValue fun, const JS::HandleValueArray& args,
-          MutableHandleValue rval);
+          MutableHandleObject objp);
 
 } /* namespace JS */
 

js/src/jsarray.cpp

@@ -3095,11 +3095,8 @@ array_of(JSContext* cx, unsigned argc, Value* vp)
             return false;
         cargs[0].setNumber(args.length());
 
-        RootedValue v(cx);
-        if (!Construct(cx, args.thisv(), cargs, args.thisv(), &v))
+        if (!Construct(cx, args.thisv(), cargs, args.thisv(), &obj))
             return false;
-
-        obj = &v.toObject();
     }
 
     // Step 8.

js/src/proxy/DirectProxyHandler.cpp

@@ -92,7 +92,12 @@ DirectProxyHandler::construct(JSContext* cx, HandleObject proxy, const CallArgs&
     if (!FillArgumentsFromArraylike(cx, cargs, args))
         return false;
 
-    return Construct(cx, target, cargs, args.newTarget(), args.rval());
+    RootedObject obj(cx);
+    if (!Construct(cx, target, cargs, args.newTarget(), &obj))
+        return false;
+
+    args.rval().setObject(*obj);
+    return true;
 }
 
 bool

js/src/proxy/ScriptedDirectProxyHandler.cpp

@@ -1050,7 +1050,12 @@ ScriptedDirectProxyHandler::construct(JSContext* cx, HandleObject proxy, const C
             return false;
 
         RootedValue targetv(cx, ObjectValue(*target));
-        return Construct(cx, targetv, cargs, args.newTarget(), args.rval());
+        RootedObject obj(cx);
+        if (!Construct(cx, targetv, cargs, args.newTarget(), &obj))
+            return false;
+
+        args.rval().setObject(*obj);
+        return true;
     }
 
     // step 8-9

js/src/proxy/ScriptedIndirectProxyHandler.cpp

@@ -480,7 +480,12 @@ CallableScriptedIndirectProxyHandler::construct(JSContext* cx, HandleObject prox
     if (!FillArgumentsFromArraylike(cx, cargs, args))
         return false;
 
-    return Construct(cx, construct, cargs, args.newTarget(), args.rval());
+    RootedObject obj(cx);
+    if (!Construct(cx, construct, cargs, args.newTarget(), &obj))
+        return false;
+
+    args.rval().setObject(*obj);
+    return true;
 }
 
 const CallableScriptedIndirectProxyHandler CallableScriptedIndirectProxyHandler::singleton;

js/src/vm/Interpreter.cpp

@@ -593,7 +593,7 @@ ConstructFromStack(JSContext* cx, const CallArgs& args)
 
 bool
 js::Construct(JSContext* cx, HandleValue fval, const ConstructArgs& args, HandleValue newTarget,
-              MutableHandleValue rval)
+              MutableHandleObject objp)
 {
     args.setCallee(fval);
     args.setThis(MagicValue(JS_IS_CONSTRUCTING));
@@ -601,7 +601,8 @@ js::Construct(JSContext* cx, HandleValue fval, const ConstructArgs& args, Handle
     if (!InternalConstruct(cx, args))
         return false;
 
-    rval.set(args.rval());
+    MOZ_ASSERT(args.rval().isObject());
+    objp.set(&args.rval().toObject());
     return true;
 }
 
@@ -4577,8 +4578,10 @@ js::SpreadCallOperation(JSContext* cx, HandleScript script, jsbytecode* pc, Hand
         if (!GetElements(cx, aobj, length, cargs.array()))
             return false;
 
-        if (!Construct(cx, callee, cargs, newTarget, res))
+        RootedObject obj(cx);
+        if (!Construct(cx, callee, cargs, newTarget, &obj))
             return false;
+        res.setObject(*obj);
     } else {
         InvokeArgs args(cx);
 

js/src/vm/Interpreter.h

@@ -87,7 +87,7 @@ InvokeSetter(JSContext* cx, const Value& thisv, Value fval, HandleValue v);
 //       ensure |fval| and |newTarget| are both |IsConstructor|.
 extern bool
 Construct(JSContext* cx, HandleValue fval, const ConstructArgs& args, HandleValue newTarget,
-          MutableHandleValue rval);
+          MutableHandleObject objp);
 
 // Call Construct(fval, args, newTarget), but use the given |thisv| as |this|
 // during construction of |fval|.
@@ -478,9 +478,6 @@ ThrowUninitializedThis(JSContext* cx, AbstractFramePtr frame);
 bool
 DefaultClassConstructor(JSContext* cx, unsigned argc, Value* vp);
 
-bool
-DefaultDerivedClassConstructor(JSContext* cx, unsigned argc, Value* vp);
-
 bool
 Debug_CheckSelfHosted(JSContext* cx, HandleValue v);
 

js/src/vm/SelfHosting.cpp

@@ -1376,7 +1376,12 @@ intrinsic_ConstructFunction(JSContext* cx, unsigned argc, Value* vp)
     for (uint32_t index = 0; index < len; index++)
         constructArgs[index].set(argsList->getDenseElement(index));
 
-    return Construct(cx, args[0], constructArgs, args.rval());
+    RootedObject res(cx);
+    if (!Construct(cx, args[0], constructArgs, args[0], &res))
+        return false;
+
+    args.rval().setObject(*res);
+    return true;
 }
 
 

js/src/vm/TypedArrayObject.cpp

@@ -2522,9 +2522,8 @@ JS_NewDataView(JSContext* cx, HandleObject arrayBuffer, uint32_t byteOffset, int
     cargs[2].setInt32(byteLength);
 
     RootedValue fun(cx, ObjectValue(*constructor));
-    RootedValue rval(cx);
-    if (!Construct(cx, fun, cargs, fun, &rval))
+    RootedObject obj(cx);
+    if (!Construct(cx, fun, cargs, fun, &obj))
         return nullptr;
-    MOZ_ASSERT(rval.isObject());
-    return &rval.toObject();
+    return obj;
 }

js/xpconnect/src/ExportHelpers.cpp

@@ -345,8 +345,10 @@ FunctionForwarder(JSContext* cx, unsigned argc, Value* vp)
 
         RootedValue fval(cx, ObjectValue(*unwrappedFun));
         if (args.isConstructing()) {
-            if (!JS::Construct(cx, fval, args, args.rval()))
+            RootedObject obj(cx);
+            if (!JS::Construct(cx, fval, args, &obj))
                 return false;
+            args.rval().setObject(*obj);
         } else {
             if (!JS_CallFunctionValue(cx, thisObj, fval, args, args.rval()))
                 return false;