Currently the typed objects code distinguishes between sized arrays, which have a fixed length created as part of their descriptor, and unsized arrays, whose instances can have different (though immutable) lengths. Spec changes for typed objects have removed this distinction, so that all array types have a known length. The attached patch removes unsized arrays and unsized type descriptors from the typed objects implementation, which is a considerable simplification. This doesn't bring the array typed objects totally up to date with the spec --- there is still an ArrayType function, though its signature is now ArrayType(elemType, length). This isn't part of any spec, but makes for a gentler transition from the current state of things and will be removed after this lands.

Comment on attachment 8515212 [details] [diff] [review] patch Review of attachment 8515212 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/builtin/TypedObject.cpp @@ +675,5 @@ > ReportCannotConvertTo(cx, args[0], "ArrayType element specifier"); > return false; > } > > + if (!args[1].isInt32() || args[1].toInt32() < 0) { For future reference, I am pretty sure it was incorrect of me to write the code this way. I imagine we ought to be coercing to int32, not checking the type-tag. But that might be best done in another patch. @@ +705,5 @@ > if (!stringRepr) > return false; > > + // Extract ArrayType.prototype > + RootedObject arrayTypePrototype(cx, GetPrototype(cx, arrayTypeGlobal)); If I read this correctly, you're giving all array types period the same prototype? This is certainly not what the spec will do, though there will exist a prototype object that plays that role.

Backed out in https://hg.mozilla.org/integration/mozilla-inbound/rev/c6c9c652409f for jsreftest failures: https://treeherder.mozilla.org/ui/logviewer.html#?job_id=3637351&repo=mozilla-inbound

This failure was only on ASAN, on a test that seems to be behaving fine but allocates a 2GB typed object, which ASAN isn't able to allocate (don't know why it worked before) and ends up reporting an error rather than just returning null. I just removed the test in the push below. https://hg.mozilla.org/integration/mozilla-inbound/rev/ceca39a1a154