Backed out changeset c7b32ffa822e (bug 1321014) on a CLOSED TREE

--HG--
extra : amend_source : 1a8f1a344d56d70673ec9977c62847ebb147f4ca

browser/config/mozconfigs/linux64/hazards

@@ -36,12 +36,9 @@ ac_add_options --without-ccache
 
 ac_add_options --disable-replace-malloc
 
-# -Wattributes is very verbose due to attributes being ignored on template
-# instantiations. -Wignored-attributes is very verbose due to attributes being
-# ignored on template parameters.
-CFLAGS="$CFLAGS -Wno-attributes -Wno-ignored-attributes"
-CPPFLAGS="$CPPFLAGS -Wno-attributes -Wno-ignored-attributes"
-CXXFLAGS="$CXXFLAGS -Wno-attributes -Wno-ignored-attributes"
+CFLAGS="$CFLAGS -Wno-attributes"
+CPPFLAGS="$CPPFLAGS -Wno-attributes"
+CXXFLAGS="$CXXFLAGS -Wno-attributes"
 
 NODEJS="$TOOLTOOL_DIR/node/bin/node"
 

js/public/GCAnnotations.h

@@ -15,18 +15,15 @@
 # define JS_HAZ_GC_THING __attribute__((annotate("GC Thing")))
 
 // Mark a type as holding a pointer to a GC thing (eg JS::Value has this
-// annotation.) "Inherited" by templatized types with
-// MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS.
+// annotation.)
 # define JS_HAZ_GC_POINTER __attribute__((annotate("GC Pointer")))
 
 // Mark a type as a rooted pointer, suitable for use on the stack (eg all
-// Rooted<T> instantiations should have this.) "Inherited" by templatized types with
-// MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS.
+// Rooted<T> instantiations should have this.)
 # define JS_HAZ_ROOTED __attribute__((annotate("Rooted Pointer")))
 
 // Mark a type as something that should not be held live across a GC, but which
-// is not itself a GC pointer. Note that this property is *not* inherited by
-// templatized types with MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS.
+// is not itself a GC pointer.
 # define JS_HAZ_GC_INVALIDATED __attribute__((annotate("Invalidated by GC")))
 
 // Mark a class as a base class of rooted types, eg CustomAutoRooter. All

js/public/StableStringChars.h

@@ -56,7 +56,7 @@ class MOZ_STACK_CLASS JS_FRIEND_API(AutoStableStringChars) final
 
     /* Ensure the string is kept alive while we're using its chars. */
     Rooted<JSString*> s_;
-    union MOZ_INIT_OUTSIDE_CTOR {
+    MOZ_INIT_OUTSIDE_CTOR union {
         const char16_t* twoByteChars_;
         const Latin1Char* latin1Chars_;
     };

js/public/Utility.h

@@ -511,7 +511,7 @@ static inline void js_free(void* p)
 #define JS_DECLARE_NEW_METHODS(NEWNAME, ALLOCATOR, QUALIFIERS) \
     template <class T, typename... Args> \
     QUALIFIERS T * \
-    MOZ_HEAP_ALLOCATOR NEWNAME(Args&&... args) { \
+    NEWNAME(Args&&... args) MOZ_HEAP_ALLOCATOR { \
         void* memory = ALLOCATOR(sizeof(T)); \
         return MOZ_LIKELY(memory) \
             ? new(memory) T(std::forward<Args>(args)...) \
@@ -531,7 +531,7 @@ static inline void js_free(void* p)
 #define JS_DECLARE_MAKE_METHODS(MAKENAME, NEWNAME, QUALIFIERS)\
     template <class T, typename... Args> \
     QUALIFIERS mozilla::UniquePtr<T, JS::DeletePolicy<T>> \
-    MOZ_HEAP_ALLOCATOR MAKENAME(Args&&... args) { \
+    MAKENAME(Args&&... args) MOZ_HEAP_ALLOCATOR { \
         T* ptr = NEWNAME<T>(std::forward<Args>(args)...); \
         return mozilla::UniquePtr<T, JS::DeletePolicy<T>>(ptr); \
     }

js/public/Value.h

@@ -316,7 +316,7 @@ CanonicalizeNaN(double d)
  *   conditional move (not speculated) to zero the payload register if the type
  *   doesn't match.
  */
-union alignas(8) Value
+union MOZ_NON_PARAM alignas(8) Value
 {
   private:
     uint64_t asBits_;
@@ -929,7 +929,7 @@ union alignas(8) Value
     bool isPrivateGCThing() const {
         return toTag() == JSVAL_TAG_PRIVATE_GCTHING;
     }
-} JS_HAZ_GC_POINTER MOZ_NON_PARAM;
+} JS_HAZ_GC_POINTER;
 
 static_assert(sizeof(Value) == 8,
               "Value size must leave three tag bits, be a binary power, and "

js/src/devtools/rootAnalysis/computeGCTypes.js

@@ -11,13 +11,11 @@ var typeInfo_filename = scriptArgs[1] || "typeInfo.txt";
 var typeInfo = {
     'GCPointers': [],
     'GCThings': [],
-    'GCInvalidated': [],
     'NonGCTypes': {}, // unused
     'NonGCPointers': {},
     'RootedGCThings': {},
     'RootedPointers': {},
     'RootedBases': {'JS::AutoGCRooter': true},
-    'InheritFromTemplateArgs': {},
 
     // RAII types within which we should assume GC is suppressed, eg
     // AutoSuppressGC.
@@ -46,7 +44,7 @@ function processCSU(csu, body)
         if (tag == 'GC Pointer')
             typeInfo.GCPointers.push(csu);
         else if (tag == 'Invalidated by GC')
-            typeInfo.GCInvalidated.push(csu);
+            typeInfo.GCPointers.push(csu);
         else if (tag == 'GC Thing')
             typeInfo.GCThings.push(csu);
         else if (tag == 'Suppressed GC Pointer')
@@ -57,8 +55,6 @@ function processCSU(csu, body)
             typeInfo.RootedBases[csu] = true;
         else if (tag == 'Suppress GC')
             typeInfo.GCSuppressors[csu] = true;
-        else if (tag == 'moz_inherit_type_annotations_from_template_args')
-            typeInfo.InheritFromTemplateArgs[csu] = true;
     }
 
     for (let { 'Base': base } of (body.CSUBaseClass || []))
@@ -143,47 +139,6 @@ for (const csu of typeInfo.GCThings)
     addGCType(csu);
 for (const csu of typeInfo.GCPointers)
     addGCPointer(csu);
-for (const csu of typeInfo.GCInvalidated)
-    addGCPointer(csu);
-
-// GC Thing and GC Pointer annotations can be inherited from template args if
-// this annotation is used. Think of Maybe<T> for example: Maybe<JSObject*> has
-// the same GC rules as JSObject*. But this needs to be done in a conservative
-// direction: Maybe<AutoSuppressGC> should not be regarding as suppressing GC
-// (because it might still be None).
-//
-// Note that there is an order-dependence here that is being mostly ignored (eg
-// Maybe<Maybe<Cell*>> -- if that is processed before Maybe<Cell*> is
-// processed, we won't get the right answer). We'll at least sort by string
-// length to make it hard to hit that case.
-var inheritors = Object.keys(typeInfo.InheritFromTemplateArgs).sort((a, b) => a.length - b.length);
-for (const csu of inheritors) {
-    // Unfortunately, we just have a string type name, not the full structure
-    // of a templatized type, so we will have to resort to loose (buggy)
-    // pattern matching.
-    //
-    // Currently, the simplest ways I know of to break this are:
-    //
-    //   foo<T>::bar<U>
-    //   foo<bar<T,U>>
-    //
-    const [_, params_str] = csu.match(/<(.*)>/);
-    for (let param of params_str.split(",")) {
-        param = param.replace(/^\s+/, '')
-        param = param.replace(/\s+$/, '')
-        const pieces = param.split("*");
-        const core_type = pieces[0];
-        const ptrdness = pieces.length - 1;
-        if (ptrdness > 1)
-            continue;
-        const paramDesc = 'template-param-' + param;
-        const why = '(inherited annotations from ' + param + ')';
-        if (typeInfo.GCThings.indexOf(core_type) != -1)
-            markGCType(csu, paramDesc, why, ptrdness, 0, "");
-        if (typeInfo.GCPointers.indexOf(core_type) != -1)
-            markGCType(csu, paramDesc, why, ptrdness + 1, 0, "");
-    }
-}
 
 // Everything that inherits from a "Rooted Base" is considered to be rooted.
 // This is for things like CustomAutoRooter and its subclasses.

js/src/devtools/rootAnalysis/t/hazards/source.cpp

@@ -2,11 +2,6 @@
 
 struct Cell { int f; } ANNOTATE("GC Thing");
 
-template<typename T, typename U>
-struct UntypedContainer {
-    char data[sizeof(T) + sizeof(U)];
-} ANNOTATE("moz_inherit_type_annotations_from_template_args");
-
 struct RootedCell { RootedCell(Cell*) {} } ANNOTATE("Rooted Pointer");
 
 class AutoSuppressGC_Base {
@@ -62,12 +57,6 @@ struct GCInDestructor {
     }
 };
 
-template <typename T>
-void
-usecontainer(T* value) {
-    if (value) asm("");
-}
-
 Cell*
 f()
 {
@@ -96,23 +85,6 @@ f()
     Cell* cell5 = &cell;
     usecell(cell5);
 
-    {
-        // Templatized container that inherits attributes from Cell*, should
-        // report a hazard.
-        UntypedContainer<int, Cell*> container1;
-        usecontainer(&container1);
-        GC();
-        usecontainer(&container1);
-    }
-
-    {
-        // As above, but with a non-GC type.
-        UntypedContainer<int, double> container2;
-        usecontainer(&container2);
-        GC();
-        usecontainer(&container2);
-    }
-
     // Hazard in return value due to ~GCInDestructor
     Cell* cell6 = &cell;
     return cell6;

js/src/devtools/rootAnalysis/t/hazards/test.py

@@ -35,9 +35,6 @@
     'void halfSuppressedFunction()', 'void unsuppressedFunction()'))
 assert(hazmap['<returnvalue>'].GCFunction == 'void GCInDestructor::~GCInDestructor()')
 
-assert('container1' in hazmap);
-assert('container2' not in hazmap);
-
 # Type names are handy to have in the report.
 assert(hazmap['cell2'].type == 'Cell*')
 assert(hazmap['<returnvalue>'].type == 'Cell*')

layout/base/AccessibleCaret.h

@@ -214,7 +214,7 @@ class AccessibleCaret
   // AccessibleCaretEventHub::Terminate() which is called in
   // PresShell::Destroy(), it frees us automatically. No need to worry if we
   // outlive mPresShell.
-  nsIPresShell* const MOZ_NON_OWNING_REF mPresShell = nullptr;
+  nsIPresShell* MOZ_NON_OWNING_REF const mPresShell = nullptr;
 
   RefPtr<dom::AnonymousContent> mCaretElementHolder;