Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-22 12:04:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1299284 - Change typed-object code's alignment, offset, and size concepts to use unsigned types. r=sfink

Browse Source 
--HG--
extra : rebase_source : a6354f2444d417e48a44b24c6fe4f1578faebfff
This commit is contained in:
Jeff Walden 2016-07-20 21:49:12 -07:00
parent 5d99b819c6
commit 519d3b4049
10 changed files with 96 additions and 90 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
js/src/builtin/TypedObject.cpp
View File

@ -32,6 +32,7 @@ using mozilla::AssertedCast;
using mozilla::CheckedInt32;
using mozilla::DebugOnly;
using mozilla::PodCopy;
using mozilla::PointerRangeSize;
using namespace js;
@ -67,7 +68,8 @@ ToObjectIf(HandleValue value)
return &value.toObject().as<T>();
}
static inline CheckedInt32 roundUpToAlignment(CheckedInt32 address, int32_t align)
static inline CheckedInt32
RoundUpToAlignment(CheckedInt32 address, uint32_t align)
{
MOZ_ASSERT(IsPowerOfTwo(align));
@ -232,16 +234,16 @@ const JSFunctionSpec js::ScalarTypeDescr::typeObjectMethods[] = {
JS_FS_END
};
int32_t
uint32_t
ScalarTypeDescr::size(Type t)
{
return Scalar::byteSize(t);
return AssertedCast<uint32_t>(Scalar::byteSize(t));
}
int32_t
uint32_t
ScalarTypeDescr::alignment(Type t)
{
return Scalar::byteSize(t);
return AssertedCast<uint32_t>(Scalar::byteSize(t));
}
/*static*/ const char*
@ -339,20 +341,20 @@ const JSFunctionSpec js::ReferenceTypeDescr::typeObjectMethods[] = {
JS_FS_END
};
static const int32_t ReferenceSizes[] = {
static const uint32_t ReferenceSizes[] = {
#define REFERENCE_SIZE(_kind, _type, _name) \
sizeof(_type),
JS_FOR_EACH_REFERENCE_TYPE_REPR(REFERENCE_SIZE) 0
#undef REFERENCE_SIZE
};
int32_t
uint32_t
ReferenceTypeDescr::size(Type t)
{
return ReferenceSizes[t];
}
int32_t
uint32_t
ReferenceTypeDescr::alignment(Type t)
{
return ReferenceSizes[t];
@ -424,7 +426,7 @@ SimdTypeDescr::type() const {
return SimdType(t);
}
int32_t
uint32_t
SimdTypeDescr::size(SimdType t)
{
MOZ_ASSERT(unsigned(t) < unsigned(SimdType::Count));
@ -448,7 +450,7 @@ SimdTypeDescr::size(SimdType t)
MOZ_CRASH("unexpected SIMD type");
}
int32_t
uint32_t
SimdTypeDescr::alignment(SimdType t)
{
MOZ_ASSERT(unsigned(t) < unsigned(SimdType::Count));
@ -554,7 +556,7 @@ js::CreateUserSizeAndAlignmentProperties(JSContext* cx, HandleTypeDescr descr)
// If data is transparent, also store the public slots.
if (descr->transparent()) {
// byteLength
RootedValue typeByteLength(cx, Int32Value(descr->size()));
RootedValue typeByteLength(cx, Int32Value(AssertedCast<int32_t>(descr->size())));
if (!DefineProperty(cx, descr, cx->names().byteLength, typeByteLength,
nullptr, nullptr, JSPROP_READONLY | JSPROP_PERMANENT))
{
@ -798,7 +800,7 @@ StructMetaTypeDescr::create(JSContext* cx,
RootedObject userFieldOffsets(cx); // User-exposed {f:offset} object
RootedObject userFieldTypes(cx); // User-exposed {f:descr} object.
CheckedInt32 sizeSoFar(0); // Size of struct thus far.
int32_t alignment = 1; // Alignment of struct.
uint32_t alignment = 1; // Alignment of struct.
bool opaque = false; // Opacity of struct.
userFieldOffsets = NewBuiltinClassInstance<PlainObject>(cx, TenuredObject);
@ -862,7 +864,7 @@ StructMetaTypeDescr::create(JSContext* cx,
// Offset of this field is the current total size adjusted for
// the field's alignment.
CheckedInt32 offset = roundUpToAlignment(sizeSoFar, fieldType->alignment());
CheckedInt32 offset = RoundUpToAlignment(sizeSoFar, fieldType->alignment());
if (!offset.isValid()) {
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPEDOBJECT_TOO_BIG);
return nullptr;
@ -903,7 +905,7 @@ StructMetaTypeDescr::create(JSContext* cx,
return nullptr;
// Adjust the total size to be a multiple of the final alignment.
CheckedInt32 totalSize = roundUpToAlignment(sizeSoFar, alignment);
CheckedInt32 totalSize = RoundUpToAlignment(sizeSoFar, alignment);
if (!totalSize.isValid()) {
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPEDOBJECT_TOO_BIG);
return nullptr;
@ -921,7 +923,7 @@ StructMetaTypeDescr::create(JSContext* cx,
descr->initReservedSlot(JS_DESCR_SLOT_KIND, Int32Value(type::Struct));
descr->initReservedSlot(JS_DESCR_SLOT_STRING_REPR, StringValue(stringRepr));
descr->initReservedSlot(JS_DESCR_SLOT_ALIGNMENT, Int32Value(alignment));
descr->initReservedSlot(JS_DESCR_SLOT_ALIGNMENT, Int32Value(AssertedCast<int32_t>(alignment)));
descr->initReservedSlot(JS_DESCR_SLOT_SIZE, Int32Value(totalSize.value()));
descr->initReservedSlot(JS_DESCR_SLOT_OPAQUE, BooleanValue(opaque));
@ -1137,7 +1139,7 @@ DefineSimpleTypeDescr(JSContext* cx,
descr->initReservedSlot(JS_DESCR_SLOT_KIND, Int32Value(T::Kind));
descr->initReservedSlot(JS_DESCR_SLOT_STRING_REPR, StringValue(className));
descr->initReservedSlot(JS_DESCR_SLOT_ALIGNMENT, Int32Value(T::alignment(type)));
descr->initReservedSlot(JS_DESCR_SLOT_SIZE, Int32Value(T::size(type)));
descr->initReservedSlot(JS_DESCR_SLOT_SIZE, Int32Value(AssertedCast<int32_t>(T::size(type))));
descr->initReservedSlot(JS_DESCR_SLOT_OPAQUE, BooleanValue(T::Opaque));
descr->initReservedSlot(JS_DESCR_SLOT_TYPE, Int32Value(type));
@ -1325,15 +1327,15 @@ js::InitTypedObjectModuleObject(JSContext* cx, HandleObject obj)
* Typed objects
*/
int32_t
uint32_t
TypedObject::offset() const
{
if (is<InlineTypedObject>())
return 0;
return typedMem() - typedMemBase();
return PointerRangeSize(typedMemBase(), typedMem());
}
int32_t
uint32_t
TypedObject::length() const
{
return typeDescr().as<ArrayTypeDescr>().length();
@ -1403,7 +1405,7 @@ TypedObject::GetBuffer(JSContext* cx, unsigned argc, Value* vp)
TypedObject::GetByteOffset(JSContext* cx, unsigned argc, Value* vp)
{
CallArgs args = CallArgsFromVp(argc, vp);
args.rval().setInt32(args[0].toObject().as<TypedObject>().offset());
args.rval().setInt32(AssertedCast<int32_t>(args[0].toObject().as<TypedObject>().offset()));
return true;
}
@ -1470,11 +1472,11 @@ OutlineTypedObject::createUnattachedWithClass(JSContext* cx,
}
void
OutlineTypedObject::attach(JSContext* cx, ArrayBufferObject& buffer, int32_t offset)
OutlineTypedObject::attach(JSContext* cx, ArrayBufferObject& buffer, uint32_t offset)
{
MOZ_ASSERT(!isAttached());
MOZ_ASSERT(offset >= 0);
MOZ_ASSERT((size_t) (offset + size()) <= buffer.byteLength());
MOZ_ASSERT(offset <= buffer.byteLength());
MOZ_ASSERT(size() <= buffer.byteLength() - offset);
// If the owner's data is from an inline typed object, associate this with
// the inline typed object instead, to simplify tracing.
@ -1496,7 +1498,7 @@ OutlineTypedObject::attach(JSContext* cx, ArrayBufferObject& buffer, int32_t off
}
void
OutlineTypedObject::attach(JSContext* cx, TypedObject& typedObj, int32_t offset)
OutlineTypedObject::attach(JSContext* cx, TypedObject& typedObj, uint32_t offset)
{
MOZ_ASSERT(!isAttached());
MOZ_ASSERT(typedObj.isAttached());
@ -1504,6 +1506,7 @@ OutlineTypedObject::attach(JSContext* cx, TypedObject& typedObj, int32_t offset)
JSObject* owner = &typedObj;
if (typedObj.is<OutlineTypedObject>()) {
owner = &typedObj.as<OutlineTypedObject>().owner();
MOZ_ASSERT(typedObj.offset() <= UINT32_MAX - offset);
offset += typedObj.offset();
}
@ -1518,7 +1521,7 @@ OutlineTypedObject::attach(JSContext* cx, TypedObject& typedObj, int32_t offset)
// Returns a suitable JS_TYPEDOBJ_SLOT_LENGTH value for an instance of
// the type `type`.
static int32_t
static uint32_t
TypedObjLengthFromType(TypeDescr& descr)
{
switch (descr.kind()) {
@ -1536,7 +1539,7 @@ TypedObjLengthFromType(TypeDescr& descr)
/*static*/ OutlineTypedObject*
OutlineTypedObject::createDerived(JSContext* cx, HandleTypeDescr type,
HandleTypedObject typedObj, int32_t offset)
HandleTypedObject typedObj, uint32_t offset)
{
MOZ_ASSERT(offset <= typedObj->size());
MOZ_ASSERT(offset + type->size() <= typedObj->size());
@ -1559,7 +1562,7 @@ OutlineTypedObject::createDerived(JSContext* cx, HandleTypeDescr type,
TypedObject::createZeroed(JSContext* cx, HandleTypeDescr descr, int32_t length, gc::InitialHeap heap)
{
// If possible, create an object with inline data.
if ((size_t) descr->size() <= InlineTypedObject::MaximumSize) {
if (descr->size() <= InlineTypedObject::MaximumSize) {
AutoSetNewObjectMetadata metadata(cx);
InlineTypedObject* obj = InlineTypedObject::create(cx, descr, heap);
@ -2043,7 +2046,7 @@ TypedObject::obj_enumerate(JSContext* cx, HandleObject obj, AutoIdVector& proper
if (!properties.reserve(typedObj->length()))
return false;
for (int32_t index = 0; index < typedObj->length(); index++) {
for (uint32_t index = 0; index < typedObj->length(); index++) {
id = INT_TO_JSID(index);
properties.infallibleAppend(id);
}
@ -2141,7 +2144,7 @@ InlineTypedObject::objectMovedDuringMinorGC(JSTracer* trc, JSObject* dst, JSObje
uint8_t* oldData = reinterpret_cast<uint8_t*>(src) + offsetOfDataStart();
uint8_t* newData = dst->as<InlineTypedObject>().inlineTypedMem();
trc->runtime()->gc.nursery.maybeSetForwardingPointer(trc, oldData, newData,
size_t(descr.size()) >= sizeof(uintptr_t));
descr.size() >= sizeof(uintptr_t));
}
}
@ -2269,18 +2272,8 @@ LengthForType(TypeDescr& descr)
}
static bool
CheckOffset(int32_t offset,
int32_t size,
int32_t alignment,
int32_t bufferLength)
CheckOffset(uint32_t offset, uint32_t size, uint32_t alignment, uint32_t bufferLength)
{
MOZ_ASSERT(size >= 0);
MOZ_ASSERT(alignment >= 0);
// No negative offsets.
if (offset < 0)
return false;
// Offset (plus size) must be fully contained within the buffer.
if (offset > bufferLength)
return false;
@ -2296,6 +2289,9 @@ CheckOffset(int32_t offset,
return true;
}
template<typename T, typename U, typename V, typename W>
inline bool CheckOffset(T, U, V, W) = delete;
/*static*/ bool
TypedObject::construct(JSContext* cx, unsigned int argc, Value* vp)
{
@ -2331,9 +2327,9 @@ TypedObject::construct(JSContext* cx, unsigned int argc, Value* vp)
return false;
}
int32_t offset;
uint32_t offset;
if (args.length() >= 2 && !args[1].isUndefined()) {
if (!args[1].isInt32()) {
if (!args[1].isInt32() || args[1].toInt32() < 0) {
JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPEDOBJECT_BAD_ARGS);
return false;
}
@ -2417,7 +2413,7 @@ js::NewDerivedTypedObject(JSContext* cx, unsigned argc, Value* vp)
Rooted<TypeDescr*> descr(cx, &args[0].toObject().as<TypeDescr>());
Rooted<TypedObject*> typedObj(cx, &args[1].toObject().as<TypedObject>());
int32_t offset = args[2].toInt32();
uint32_t offset = AssertedCast<uint32_t>(args[2].toInt32());
Rooted<TypedObject*> obj(cx);
obj = OutlineTypedObject::createDerived(cx, descr, typedObj, offset);
@ -2438,7 +2434,7 @@ js::AttachTypedObject(JSContext* cx, unsigned argc, Value* vp)
OutlineTypedObject& handle = args[0].toObject().as<OutlineTypedObject>();
TypedObject& target = args[1].toObject().as<TypedObject>();
MOZ_ASSERT(!handle.isAttached());
size_t offset = args[2].toInt32();
uint32_t offset = AssertedCast<uint32_t>(args[2].toInt32());
handle.attach(cx, target, offset);
@ -2780,7 +2776,7 @@ visitReferences(TypeDescr& descr,
{
ArrayTypeDescr& arrayDescr = descr.as<ArrayTypeDescr>();
TypeDescr& elementDescr = arrayDescr.elementType();
for (int32_t i = 0; i < arrayDescr.length(); i++) {
for (uint32_t i = 0; i < arrayDescr.length(); i++) {
visitReferences(elementDescr, mem, visitor);
mem += elementDescr.size();
}
@ -2977,7 +2973,7 @@ CreateTraceList(JSContext* cx, HandleTypeDescr descr)
// for larger objects, both to limit the size of the trace lists and
// because tracing outline typed objects is considerably more complicated
// than inline ones.
if ((size_t) descr->size() > InlineTypedObject::MaximumSize || descr->transparent())
if (descr->size() > InlineTypedObject::MaximumSize || descr->transparent())
return true;
TraceListVisitor visitor;

42
js/src/builtin/TypedObject.h
View File

@ -166,12 +166,16 @@ class TypeDescr : public NativeObject
return !opaque();
}
int32_t alignment() const {
return getReservedSlot(JS_DESCR_SLOT_ALIGNMENT).toInt32();
uint32_t alignment() const {
int32_t i = getReservedSlot(JS_DESCR_SLOT_ALIGNMENT).toInt32();
MOZ_ASSERT(i >= 0);
return uint32_t(i);
}
int32_t size() const {
return getReservedSlot(JS_DESCR_SLOT_SIZE).toInt32();
uint32_t size() const {
int32_t i = getReservedSlot(JS_DESCR_SLOT_SIZE).toInt32();
MOZ_ASSERT(i >= 0);
return uint32_t(i);
}
// Whether id is an 'own' property of objects with this descriptor.
@ -218,8 +222,8 @@ class ScalarTypeDescr : public SimpleTypeDescr
static const type::Kind Kind = type::Scalar;
static const bool Opaque = false;
static int32_t size(Type t);
static int32_t alignment(Type t);
static uint32_t size(Type t);
static uint32_t alignment(Type t);
static const char* typeName(Type type);
static const Class class_;
@ -299,8 +303,8 @@ class ReferenceTypeDescr : public SimpleTypeDescr
static const type::Kind Kind = type::Reference;
static const bool Opaque = true;
static const Class class_;
static int32_t size(Type t);
static int32_t alignment(Type t);
static uint32_t size(Type t);
static uint32_t alignment(Type t);
static const JSFunctionSpec typeObjectMethods[];
ReferenceTypeDescr::Type type() const {
@ -342,8 +346,8 @@ class SimdTypeDescr : public ComplexTypeDescr
static const type::Kind Kind = type::Simd;
static const bool Opaque = false;
static const Class class_;
static int32_t size(SimdType t);
static int32_t alignment(SimdType t);
static uint32_t size(SimdType t);
static uint32_t alignment(SimdType t);
static MOZ_MUST_USE bool call(JSContext* cx, unsigned argc, Value* vp);
static bool is(const Value& v);
@ -407,8 +411,10 @@ class ArrayTypeDescr : public ComplexTypeDescr
return getReservedSlot(JS_DESCR_SLOT_ARRAY_ELEM_TYPE).toObject().as<TypeDescr>();
}
int32_t length() const {
return getReservedSlot(JS_DESCR_SLOT_ARRAY_LENGTH).toInt32();
uint32_t length() const {
int32_t i = getReservedSlot(JS_DESCR_SLOT_ARRAY_LENGTH).toInt32();
MOZ_ASSERT(i >= 0);
return uint32_t(i);
}
static int32_t offsetOfLength() {
@ -547,12 +553,12 @@ class TypedObject : public ShapedObject
return group()->typeDescr();
}
int32_t offset() const;
int32_t length() const;
uint32_t offset() const;
uint32_t length() const;
uint8_t* typedMem(const JS::AutoRequireNoGC&) const { return typedMem(); }
bool isAttached() const;
int32_t size() const {
uint32_t size() const {
return typeDescr().size();
}
@ -650,13 +656,13 @@ class OutlineTypedObject : public TypedObject
static OutlineTypedObject* createDerived(JSContext* cx,
HandleTypeDescr type,
Handle<TypedObject*> typedContents,
int32_t offset);
uint32_t offset);
// Use this method when `buffer` is the owner of the memory.
void attach(JSContext* cx, ArrayBufferObject& buffer, int32_t offset);
void attach(JSContext* cx, ArrayBufferObject& buffer, uint32_t offset);
// Otherwise, use this to attach to memory referenced by another typedObj.
void attach(JSContext* cx, TypedObject& typedObj, int32_t offset);
void attach(JSContext* cx, TypedObject& typedObj, uint32_t offset);
// Invoked when array buffer is transferred elsewhere
void notifyBufferDetached(void* newData);

2
js/src/jit/IonAnalysis.cpp
View File

@ -3660,7 +3660,7 @@ LinearSum::multiply(int32_t scale)
}
bool
LinearSum::divide(int32_t scale)
LinearSum::divide(uint32_t scale)
{
MOZ_ASSERT(scale > 0);

2
js/src/jit/IonAnalysis.h
View File

@ -153,7 +153,7 @@ class LinearSum
// Unlike the above function, on failure this leaves the sum unchanged and
// it can still be used.
MOZ_MUST_USE bool divide(int32_t scale);
MOZ_MUST_USE bool divide(uint32_t scale);
int32_t constant() const { return constant_; }
size_t numTerms() const { return terms_.length(); }

28
js/src/jit/IonBuilder.cpp
View File

@ -9036,7 +9036,7 @@ IonBuilder::getElemTryTypedObject(bool* emitted, MDefinition* obj, MDefinition*
if (elemPrediction.isUseless())
return true;
int32_t elemSize;
uint32_t elemSize;
if (!elemPrediction.hasKnownSize(&elemSize))
return true;
@ -9077,7 +9077,7 @@ static MIRType
MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble);
bool
IonBuilder::checkTypedObjectIndexInBounds(int32_t elemSize,
IonBuilder::checkTypedObjectIndexInBounds(uint32_t elemSize,
MDefinition* obj,
MDefinition* index,
TypedObjectPrediction objPrediction,
@ -9110,7 +9110,7 @@ IonBuilder::checkTypedObjectIndexInBounds(int32_t elemSize,
index = addBoundsCheck(idInt32, length);
return indexAsByteOffset->add(index, elemSize);
return indexAsByteOffset->add(index, AssertedCast<int32_t>(elemSize));
}
bool
@ -9119,7 +9119,7 @@ IonBuilder::getElemTryScalarElemOfTypedObject(bool* emitted,
MDefinition* index,
TypedObjectPrediction objPrediction,
TypedObjectPrediction elemPrediction,
int32_t elemSize)
uint32_t elemSize)
{
MOZ_ASSERT(objPrediction.ofArrayKind());
@ -9147,7 +9147,7 @@ IonBuilder::getElemTryReferenceElemOfTypedObject(bool* emitted,
MOZ_ASSERT(objPrediction.ofArrayKind());
ReferenceTypeDescr::Type elemType = elemPrediction.referenceType();
size_t elemSize = ReferenceTypeDescr::size(elemType);
uint32_t elemSize = ReferenceTypeDescr::size(elemType);
LinearSum indexAsByteOffset(alloc());
if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset))
@ -9164,7 +9164,7 @@ IonBuilder::pushScalarLoadFromTypedObject(MDefinition* obj,
const LinearSum& byteOffset,
ScalarTypeDescr::Type elemType)
{
int32_t size = ScalarTypeDescr::size(elemType);
uint32_t size = ScalarTypeDescr::size(elemType);
MOZ_ASSERT(size == ScalarTypeDescr::alignment(elemType));
// Find location within the owner object.
@ -9211,7 +9211,7 @@ IonBuilder::pushReferenceLoadFromTypedObject(MDefinition* typedObj,
MDefinition* elements;
MDefinition* scaledOffset;
int32_t adjustment;
size_t alignment = ReferenceTypeDescr::alignment(type);
uint32_t alignment = ReferenceTypeDescr::alignment(type);
loadTypedObjectElements(typedObj, byteOffset, alignment, &elements, &scaledOffset, &adjustment);
TemporaryTypeSet* observedTypes = bytecodeTypes(pc);
@ -9263,7 +9263,7 @@ IonBuilder::getElemTryComplexElemOfTypedObject(bool* emitted,
MDefinition* index,
TypedObjectPrediction objPrediction,
TypedObjectPrediction elemPrediction,
int32_t elemSize)
uint32_t elemSize)
{
MOZ_ASSERT(objPrediction.ofArrayKind());
@ -10176,7 +10176,7 @@ IonBuilder::setElemTryTypedObject(bool* emitted, MDefinition* obj,
if (elemPrediction.isUseless())
return true;
int32_t elemSize;
uint32_t elemSize;
if (!elemPrediction.hasKnownSize(&elemSize))
return true;
@ -10218,7 +10218,7 @@ IonBuilder::setElemTryReferenceElemOfTypedObject(bool* emitted,
TypedObjectPrediction elemPrediction)
{
ReferenceTypeDescr::Type elemType = elemPrediction.referenceType();
size_t elemSize = ReferenceTypeDescr::size(elemType);
uint32_t elemSize = ReferenceTypeDescr::size(elemType);
LinearSum indexAsByteOffset(alloc());
if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset))
@ -10241,7 +10241,7 @@ IonBuilder::setElemTryScalarElemOfTypedObject(bool* emitted,
TypedObjectPrediction objPrediction,
MDefinition* value,
TypedObjectPrediction elemPrediction,
int32_t elemSize)
uint32_t elemSize)
{
// Must always be loading the same scalar type
ScalarTypeDescr::Type elemType = elemPrediction.scalarType();
@ -14297,7 +14297,7 @@ IonBuilder::loadTypedObjectData(MDefinition* typedObj,
void
IonBuilder::loadTypedObjectElements(MDefinition* typedObj,
const LinearSum& baseByteOffset,
int32_t scale,
uint32_t scale,
MDefinition** ownerElements,
MDefinition** ownerScaledOffset,
int32_t* ownerByteAdjustment)
@ -14430,7 +14430,7 @@ IonBuilder::storeScalarTypedObjectValue(MDefinition* typedObj,
MDefinition* elements;
MDefinition* scaledOffset;
int32_t adjustment;
size_t alignment = ScalarTypeDescr::alignment(type);
uint32_t alignment = ScalarTypeDescr::alignment(type);
loadTypedObjectElements(typedObj, byteOffset, alignment, &elements, &scaledOffset, &adjustment);
// Clamp value to [0, 255] when type is Uint8Clamped
@ -14476,7 +14476,7 @@ IonBuilder::storeReferenceTypedObjectValue(MDefinition* typedObj,
MDefinition* elements;
MDefinition* scaledOffset;
int32_t adjustment;
size_t alignment = ReferenceTypeDescr::alignment(type);
uint32_t alignment = ReferenceTypeDescr::alignment(type);
loadTypedObjectElements(typedObj, byteOffset, alignment, &elements, &scaledOffset, &adjustment);
MInstruction* store = nullptr; // initialize to silence GCC warning

10
js/src/jit/IonBuilder.h
View File

@ -555,7 +555,7 @@ class IonBuilder
LinearSum* ownerOffset);
void loadTypedObjectElements(MDefinition* typedObj,
const LinearSum& byteOffset,
int32_t scale,
uint32_t scale,
MDefinition** ownerElements,
MDefinition** ownerScaledOffset,
int32_t* ownerByteAdjustment);
@ -571,7 +571,7 @@ class IonBuilder
const LinearSum& byteOffset,
ScalarTypeDescr::Type type,
MDefinition* value);
MOZ_MUST_USE bool checkTypedObjectIndexInBounds(int32_t elemSize,
MOZ_MUST_USE bool checkTypedObjectIndexInBounds(uint32_t elemSize,
MDefinition* obj,
MDefinition* index,
TypedObjectPrediction objTypeDescrs,
@ -615,7 +615,7 @@ class IonBuilder
TypedObjectPrediction objTypeReprs,
MDefinition* value,
TypedObjectPrediction elemTypeReprs,
int32_t elemSize);
uint32_t elemSize);
MOZ_MUST_USE bool initializeArrayElement(MDefinition* obj, size_t index, MDefinition* value,
JSValueType unboxedType,
bool addResumePointAndIncrementInitializedLength);
@ -636,7 +636,7 @@ class IonBuilder
MDefinition* index,
TypedObjectPrediction objTypeReprs,
TypedObjectPrediction elemTypeReprs,
int32_t elemSize);
uint32_t elemSize);
MOZ_MUST_USE bool getElemTryReferenceElemOfTypedObject(bool* emitted,
MDefinition* obj,
MDefinition* index,
@ -647,7 +647,7 @@ class IonBuilder
MDefinition* index,
TypedObjectPrediction objTypeReprs,
TypedObjectPrediction elemTypeReprs,
int32_t elemSize);
uint32_t elemSize);
TemporaryTypeSet* computeHeapType(const TemporaryTypeSet* objTypes, const jsid id);
enum BoundsChecking { DoBoundsCheck, SkipBoundsCheck };

2
js/src/jit/TypedObjectPrediction.cpp
View File

@ -131,7 +131,7 @@ TypedObjectPrediction::ofArrayKind() const
}
bool
TypedObjectPrediction::hasKnownSize(int32_t* out) const
TypedObjectPrediction::hasKnownSize(uint32_t* out) const
{
switch (predictionKind()) {
case TypedObjectPrediction::Empty:

2
js/src/jit/TypedObjectPrediction.h
View File

@ -159,7 +159,7 @@ class TypedObjectPrediction {
// The size may not be statically known if (1) the object is
// an array whose dimensions are unknown or (2) only a prefix
// of its type is known.
bool hasKnownSize(int32_t* out) const;
bool hasKnownSize(uint32_t* out) const;
//////////////////////////////////////////////////////////////////////
// Simple operations

5
js/src/jit/shared/IonAssemblerBuffer.h
View File

@ -8,6 +8,7 @@
#define jit_shared_IonAssemblerBuffer_h
#include "mozilla/Assertions.h"
#include "mozilla/MathAlgorithms.h"
#include "jit/shared/Assembler-shared.h"
@ -169,8 +170,8 @@ class AssemblerBuffer
{ }
public:
bool isAligned(int alignment) const {
MOZ_ASSERT(IsPowerOfTwo(alignment));
bool isAligned(size_t alignment) const {
MOZ_ASSERT(mozilla::IsPowerOfTwo(alignment));
return !(size() & (alignment - 1));
}

5
js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
View File

@ -7,6 +7,8 @@
#ifndef jit_shared_IonAssemblerBufferWithConstantPools_h
#define jit_shared_IonAssemblerBufferWithConstantPools_h
#include "mozilla/MathAlgorithms.h"
#include <algorithm>
#include "jit/JitSpewer.h"
@ -1059,7 +1061,8 @@ struct AssemblerBufferWithConstantPools : public AssemblerBuffer<SliceSize, Inst
}
void align(unsigned alignment) {
MOZ_ASSERT(IsPowerOfTwo(alignment) && alignment >= InstSize);
MOZ_ASSERT(mozilla::IsPowerOfTwo(alignment));
MOZ_ASSERT(alignment >= InstSize);
// A pool many need to be dumped at this point, so insert NOP fill here.
insertNopFill();