Backed out changeset dafb1d54cf74 -- it was a temporary diagnostic and we got the data.

js/src/jsstr.cpp

@@ -108,8 +108,6 @@ JSString::flatten()
     jschar *chars;
     size_t capacity;
     JS_ASSERT(isRope());
-    if (!isRope())
-        JS_CRASH(0xe0 | (mLengthAndFlags & TYPE_FLAGS_MASK));
 
     /*
      * This can be called from any string in the rope, so first traverse to the
@@ -131,7 +129,7 @@ JSString::flatten()
      * interior node with a NULL parent, so that we end up at NULL when we are
      * done processing it.
      */
-    topNode->convertToInteriorNode((JSString *) 0x2);
+    topNode->convertToInteriorNode(NULL);
     JSString *str = topNode, *next;
     size_t pos = 0;
 
@@ -139,7 +137,7 @@ JSString::flatten()
      * Traverse the tree, making each interior string dependent on the resulting
      * string.
      */
-    while (str != (JSString *) 0x2) {
+    while (str) {
         switch (str->ropeTraversalCount()) {
           case 0:
             next = str->ropeLeft();
@@ -300,9 +298,6 @@ js_ConcatStrings(JSContext *cx, JSString *left, JSString *right)
         return shortStr->header();
     }
 
-    left->checkCompartment(cx, 0xd0);
-    right->checkCompartment(cx, 0xd4);
-
     /*
      * We need to enforce a tree structure in ropes: every node needs to have a
      * unique parent. So, we can't have the left or right child be in the middle

js/src/jsstr.h

@@ -57,8 +57,6 @@
 #include "jsvalue.h"
 #include "jscell.h"
 
-#define JS_CRASH(addr) *(int *) (addr) = 0;
-
 #define JSSTRING_BIT(n)             ((size_t)1 << (n))
 #define JSSTRING_BITMASK(n)         (JSSTRING_BIT(n) - 1)
 
@@ -206,13 +204,6 @@ struct JSString {
         return reinterpret_cast<js::gc::FreeCell *>(this);
     }
 
-    inline void checkInteriorParent(int addr) {
-        if (isInteriorNode() && e.mParent == NULL)
-            JS_CRASH(addr);
-    }
-
-    inline void checkCompartment(JSContext *cx, int addr);
-
     /*
      * Generous but sane length bound; the "-1" is there for comptibility with
      * OOM tests.
@@ -287,7 +278,6 @@ struct JSString {
         e.mCapacity = 0;
         mLengthAndFlags = (length << FLAGS_LENGTH_SHIFT) | FLAT;
         mChars = chars;
-        checkInteriorParent(0x90);
     }
 
     JS_ALWAYS_INLINE void initFlatMutable(jschar *chars, size_t length, size_t cap) {
@@ -297,7 +287,6 @@ struct JSString {
         e.mCapacity = cap;
         mLengthAndFlags = (length << FLAGS_LENGTH_SHIFT) | FLAT | MUTABLE;
         mChars = chars;
-        checkInteriorParent(0x94);
     }
 
     JS_ALWAYS_INLINE jschar *flatChars() const {
@@ -346,14 +335,12 @@ struct JSString {
         JS_ASSERT(isFlat());
         JS_ASSERT(!isStatic(this));
         JS_ATOMIC_SET_MASK((jsword *)&mLengthAndFlags, ATOMIZED);
-        checkInteriorParent(0x98);
     }
 
     inline void flatSetMutable() {
         JS_ASSERT(isFlat());
         JS_ASSERT(!isAtomized());
         mLengthAndFlags |= MUTABLE;
-        checkInteriorParent(0x9c);
     }
 
     inline void flatClearMutable() {
@@ -365,7 +352,6 @@ struct JSString {
          */
         if (mLengthAndFlags & MUTABLE)
             mLengthAndFlags &= ~MUTABLE;
-        checkInteriorParent(0xa0);
     }
 
     /*
@@ -379,7 +365,6 @@ struct JSString {
         mChars = chars;
         mLengthAndFlags = DEPENDENT | (len << FLAGS_LENGTH_SHIFT);
         e.mBase = bstr;
-        checkInteriorParent(0xa4);
     }
 
     inline JSString *dependentBase() const {
@@ -405,16 +390,12 @@ struct JSString {
         mLeft = left;
         e.mRight = right;
         e.mBufferWithInfo = buf;
-        checkInteriorParent(0xa8);
     }
 
     inline void convertToInteriorNode(JSString *parent) {
         JS_ASSERT(isTopNode());
-        if (parent == NULL)
-            JS_CRASH(0x80);
         e.mParent = parent;
         mLengthAndFlags = INTERIOR_NODE | (length() << FLAGS_LENGTH_SHIFT);
-        checkInteriorParent(0xac);
     }
 
     inline JSString *interiorNodeParent() const {
@@ -444,10 +425,7 @@ struct JSString {
 
     inline void nullifyTopNodeBuffer() {
         JS_ASSERT(isTopNode());
-        if (!isTopNode())
-            JS_CRASH(0x84);
         e.mBufferWithInfo = NULL;
-        checkInteriorParent(0xb0);
     }
 
     /*
@@ -466,13 +444,11 @@ struct JSString {
         mLengthAndFlags = JSString::DEPENDENT |
             ((chars + end - mChars) << JSString::FLAGS_LENGTH_SHIFT);
         e.mBase = base;
-        checkInteriorParent(0xb4);
     }
 
     inline void ropeClearTraversalCount() {
         JS_ASSERT(isRope());
         mLengthAndFlags &= ~ROPE_TRAVERSAL_COUNT_MASK;
-        checkInteriorParent(0xb8);
     }
 
     inline size_t ropeTraversalCount() const {
@@ -484,7 +460,6 @@ struct JSString {
     inline void ropeIncrementTraversalCount() {
         JS_ASSERT(isRope());
         mLengthAndFlags += ROPE_TRAVERSAL_COUNT_UNIT;
-        checkInteriorParent(0xbc);
     }
 
     inline bool ensureNotDependent(JSContext *cx) {

js/src/jsstrinlines.h

@@ -123,11 +123,4 @@ inline
 JSRopeBuilder::JSRopeBuilder(JSContext *cx)
   : cx(cx), mStr(cx->runtime->emptyString) {}
 
-inline void
-JSString::checkCompartment(JSContext *cx, int addr)
-{
-    if (isRope() && asCell()->compartment() != cx->compartment)
-        JS_CRASH(addr);
-}
-
 #endif /* jsstrinlines_h___ */