From 244cf5d69d218e47ced2ad6b078b6fd4e6ed7e27 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Thu, 19 Nov 2015 11:20:53 -0800
Subject: [PATCH] Bug 1225298 - Use GCHashSet for InnerViewTable, r=terrence

--HG--
extra : rebase_source : 715f2bb5a591efd1acdb28ba1c83f5f2c9c06855
---
 js/src/jscompartment.cpp        |  4 ++--
 js/src/vm/ArrayBufferObject.cpp | 17 +++++------------
 js/src/vm/ArrayBufferObject.h   | 22 +++++++++++++++-------
 3 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 66433ab1dc5d..19f8aba465f7 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -667,13 +667,13 @@ JSCompartment::sweepAfterMinorGC()
     globalWriteBarriered = false;
 
     if (innerViews.needsSweepAfterMinorGC())
-        innerViews.sweepAfterMinorGC(runtimeFromMainThread());
+        innerViews.sweepAfterMinorGC();
 }
 
 void
 JSCompartment::sweepInnerViews()
 {
-    innerViews.sweep(runtimeFromAnyThread());
+    innerViews.sweep();
 }
 
 void
diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp
index d68ddae867a9..8814f8a9a742 100644
--- a/js/src/vm/ArrayBufferObject.cpp
+++ b/js/src/vm/ArrayBufferObject.cpp
@@ -1114,7 +1114,7 @@ InnerViewTable::removeViews(ArrayBufferObject* buffer)
     map.remove(p);
 }
 
-bool
+/* static */ bool
 InnerViewTable::sweepEntry(JSObject** pkey, ViewVector& views)
 {
     if (IsAboutToBeFinalizedUnbarriered(pkey))
@@ -1132,21 +1132,14 @@ InnerViewTable::sweepEntry(JSObject** pkey, ViewVector& views)
 }
 
 void
-InnerViewTable::sweep(JSRuntime* rt)
+InnerViewTable::sweep()
 {
     MOZ_ASSERT(nurseryKeys.empty());
-
-    if (!map.initialized())
-        return;
-
-    for (Map::Enum e(map); !e.empty(); e.popFront()) {
-        if (sweepEntry(&e.front().mutableKey(), e.front().value()))
-            e.removeFront();
-    }
+    map.sweep();
 }
 
 void
-InnerViewTable::sweepAfterMinorGC(JSRuntime* rt)
+InnerViewTable::sweepAfterMinorGC()
 {
     MOZ_ASSERT(needsSweepAfterMinorGC());
 
@@ -1164,7 +1157,7 @@ InnerViewTable::sweepAfterMinorGC(JSRuntime* rt)
     } else {
         // Do the required sweeping by looking at every map entry.
         nurseryKeys.clear();
-        sweep(rt);
+        sweep();
 
         nurseryKeysValid = true;
     }
diff --git a/js/src/vm/ArrayBufferObject.h b/js/src/vm/ArrayBufferObject.h
index 998ed35bda3a..6cd81d325f2c 100644
--- a/js/src/vm/ArrayBufferObject.h
+++ b/js/src/vm/ArrayBufferObject.h
@@ -10,6 +10,7 @@
 #include "jsobj.h"
 
 #include "builtin/TypedObjectConstants.h"
+#include "js/GCHashTable.h"
 #include "vm/Runtime.h"
 #include "vm/SharedMem.h"
 
@@ -501,6 +502,12 @@ class InnerViewTable
     friend class ArrayBufferObject;
 
   private:
+    struct MapGCPolicy {
+        static bool needsSweep(JSObject** key, ViewVector* value) {
+            return InnerViewTable::sweepEntry(key, *value);
+        }
+    };
+
     // This key is a raw pointer and not a ReadBarriered because the post-
     // barrier would hold nursery-allocated entries live unconditionally. It is
     // a very common pattern in low-level and performance-oriented JavaScript
@@ -509,10 +516,11 @@ class InnerViewTable
     // performance regression. Thus, it is vital that nursery pointers in this
     // map not be held live. Special support is required in the minor GC,
     // implemented in sweepAfterMinorGC.
-    typedef HashMap<JSObject*,
-                    ViewVector,
-                    MovableCellHasher<JSObject*>,
-                    SystemAllocPolicy> Map;
+    typedef GCHashMap<JSObject*,
+                      ViewVector,
+                      MovableCellHasher<JSObject*>,
+                      SystemAllocPolicy,
+                      MapGCPolicy> Map;
 
     // For all objects sharing their storage with some other view, this maps
     // the object to the list of such views. All entries in this map are weak.
@@ -529,7 +537,7 @@ class InnerViewTable
     bool nurseryKeysValid;
 
     // Sweep an entry during GC, returning whether the entry should be removed.
-    bool sweepEntry(JSObject** pkey, ViewVector& views);
+    static bool sweepEntry(JSObject** pkey, ViewVector& views);
 
     bool addView(JSContext* cx, ArrayBufferObject* obj, ArrayBufferViewObject* view);
     ViewVector* maybeViewsUnbarriered(ArrayBufferObject* obj);
@@ -542,8 +550,8 @@ class InnerViewTable
 
     // Remove references to dead objects in the table and update table entries
     // to reflect moved objects.
-    void sweep(JSRuntime* rt);
-    void sweepAfterMinorGC(JSRuntime* rt);
+    void sweep();
+    void sweepAfterMinorGC();
 
     bool needsSweepAfterMinorGC() {
         return !nurseryKeys.empty() || !nurseryKeysValid;