Bug 807458 - Eliminate a SkipRoot from NewDenseCopiedArray. r=terrence

--HG--
extra : rebase_source : 57b50c345cb0a9a481efda9a8526732d5129df48

js/src/jsapi.cpp

@@ -4700,6 +4700,8 @@ JS_SetReservedSlot(RawObject obj, uint32_t index, RawValue value)
 JS_PUBLIC_API(JSObject *)
 JS_NewArrayObject(JSContext *cx, int length, jsval *vector)
 {
+    AutoArrayRooter tvr(cx, length, vector);
+
     JS_THREADSAFE_ASSERT(cx->compartment != cx->runtime->atomsCompartment);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);

js/src/jsarray.cpp

@@ -2603,8 +2603,7 @@ array_splice(JSContext *cx, unsigned argc, Value *vp)
     /* Steps 2, 8-9. */
     RootedObject arr(cx);
     if (CanOptimizeForDenseStorage(obj, actualStart, actualDeleteCount, cx)) {
-        arr = NewDenseCopiedArray(cx, actualDeleteCount,
-                                  obj->getDenseArrayElements() + actualStart);
+        arr = NewDenseCopiedArray(cx, actualDeleteCount, obj, actualStart);
         if (!arr)
             return false;
         TryReuseArrayType(obj, arr);
@@ -2803,9 +2802,8 @@ js::array_concat(JSContext *cx, unsigned argc, Value *vp)
     uint32_t length;
     if (aobj->isDenseArray()) {
         length = aobj->getArrayLength();
-        const Value *vector = aobj->getDenseArrayElements();
         uint32_t initlen = aobj->getDenseArrayInitializedLength();
-        nobj = NewDenseCopiedArray(cx, initlen, vector);
+        nobj = NewDenseCopiedArray(cx, initlen, aobj, 0);
         if (!nobj)
             return JS_FALSE;
         TryReuseArrayType(aobj, nobj);
@@ -2911,7 +2909,7 @@ array_slice(JSContext *cx, unsigned argc, Value *vp)
 
     if (obj->isDenseArray() && end <= obj->getDenseArrayInitializedLength() &&
         !js_PrototypeHasIndexedProperties(obj)) {
-        nobj = NewDenseCopiedArray(cx, end - begin, obj->getDenseArrayElements() + begin);
+        nobj = NewDenseCopiedArray(cx, end - begin, obj, begin);
         if (!nobj)
             return JS_FALSE;
         TryReuseArrayType(obj, nobj);
@@ -3708,17 +3706,15 @@ mjit::stubs::NewDenseUnallocatedArray(VMFrame &f, uint32_t length)
 #endif
 
 JSObject *
-NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *vp, RawObject proto /* = NULL */)
+NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32_t elementOffset, RawObject proto /* = NULL */)
 {
-    // XXX vp may be an internal pointer to an object's dense array elements.
-    SkipRoot skip(cx, &vp);
-
     JSObject* obj = NewArray<true>(cx, length, proto);
     if (!obj)
         return NULL;
 
     JS_ASSERT(obj->getDenseArrayCapacity() >= length);
 
+    const Value* vp = src->getDenseArrayElements() + elementOffset;
     obj->setDenseArrayInitializedLength(vp ? length : 0);
 
     if (vp)
@@ -3727,6 +3723,24 @@ NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *vp, RawObject p
     return obj;
 }
 
+// values must point at already-rooted Value objects
+JSObject *
+NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, RawObject proto /* = NULL */)
+{
+    JSObject* obj = NewArray<true>(cx, length, proto);
+    if (!obj)
+        return NULL;
+
+    JS_ASSERT(obj->getDenseArrayCapacity() >= length);
+
+    obj->setDenseArrayInitializedLength(values ? length : 0);
+
+    if (values)
+        obj->initDenseArrayElements(0, values, length);
+
+    return obj;
+}
+
 JSObject *
 NewSlowEmptyArray(JSContext *cx)
 {

js/src/jsarray.h

@@ -63,9 +63,13 @@ NewDenseAllocatedArray(JSContext *cx, uint32_t length, RawObject proto = NULL);
 extern JSObject * JS_FASTCALL
 NewDenseUnallocatedArray(JSContext *cx, uint32_t length, RawObject proto = NULL);
 
-/* Create a dense array with a copy of vp. */
+/* Create a dense array with a copy of the dense array elements in src. */
 extern JSObject *
-NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *vp, RawObject proto = NULL);
+NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32_t elementOffset, RawObject proto = NULL);
+
+/* Create a dense array from the given array values, which must be rooted */
+extern JSObject *
+NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, RawObject proto = NULL);
 
 /* Create a sparse array. */
 extern JSObject *

js/src/jsstr.cpp

@@ -2757,8 +2757,8 @@ js::str_split(JSContext *cx, unsigned argc, Value *vp)
 
     /* Step 10. */
     if (!sepDefined) {
-        Value v = StringValue(str);
-        JSObject *aobj = NewDenseCopiedArray(cx, 1, &v);
+        RootedValue v(cx, StringValue(str));
+        JSObject *aobj = NewDenseCopiedArray(cx, 1, v.address());
         if (!aobj)
             return false;
         aobj->setType(type);

js/src/vm/ScopeObject.cpp

@@ -1710,7 +1710,7 @@ DebugScopes::onPopCall(StackFrame *fp, JSContext *cx)
          * aliasing. This unnecessarily includes aliased variables
          * but it simplifies later indexing logic.
          */
-        StackFrame::CopyVector vec;
+        AutoValueVector vec(cx);
         if (!fp->copyRawFrameSlots(&vec) || vec.length() == 0)
             return;
 

js/src/vm/Stack.cpp

@@ -217,7 +217,7 @@ StackFrame::pcQuadratic(const ContextStack &stack, size_t maxDepth)
 }
 
 bool
-StackFrame::copyRawFrameSlots(CopyVector *vec)
+StackFrame::copyRawFrameSlots(AutoValueVector *vec)
 {
     if (!vec->resize(numFormalArgs() + script()->nfixed))
         return false;

js/src/vm/Stack.h

@@ -497,8 +497,7 @@ class StackFrame
     inline Value &unaliasedActual(unsigned i, MaybeCheckAliasing = CHECK_ALIASING);
     template <class Op> inline void forEachUnaliasedActual(Op op);
 
-    typedef Vector<Value, 16, SystemAllocPolicy> CopyVector;
-    bool copyRawFrameSlots(CopyVector *v);
+    bool copyRawFrameSlots(AutoValueVector *v);
 
     inline unsigned numFormalArgs() const;
     inline unsigned numActualArgs() const;