The members of the `wasm` member of `JSFunction::u` are required to occupy certain offsets within the structure in order to alias other members, yet this aliasing could easily be accomplished by simply reusing existing fields (which already have the correct type) or placing the fields in the same union (which necessarily locates them at the same offset). Perhaps the intention behind the present structure is to clearly establish the relevant fields for different sorts of functions. But the code does not actually use the fields consistently with this intent: for example, `JSFunction::u::wasm::native_` is only ever written to, and never read; the data stored in it is always retrieved via `JSFunction::u::native::func_`. When I encountered this code this morning, I was bewildered until someone pointed out the required aliasing.

Comment on attachment 8950455 [details] [diff] [review] Merge JSFunction::u::wasm with other members. Review of attachment 8950455 [details] [diff] [review]: ----------------------------------------------------------------- Yeah, we switched designs a few times, so indeed the wasm part of the union doesn't seem necessary anymore. Nice cleanup, thanks. ::: js/src/jsfun.h @@ +127,5 @@ > // used if isBuiltinNative(); use the accessor! > const JSJitInfo* jitInfo_; > // asm.js function index, only used if isAsmJSNative(). > size_t asmJSFuncIndex_; > + // for wasm, A pointer to a fast jit->wasm table entry. nit: "a" lowercase @@ +128,5 @@ > const JSJitInfo* jitInfo_; > // asm.js function index, only used if isAsmJSNative(). > size_t asmJSFuncIndex_; > + // for wasm, A pointer to a fast jit->wasm table entry. > + void** jitEntry_; nit: maybe rename wasmJitEntry_ to make it overly explicit?

Revised per comments. Carrying over r=bbouvier.

This got bitrotted by bug 1429206, please provide an updated patch.

Pushed by jblandy@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/de8d3617e884 Merge JSFunction::u::wasm with other members. r=bbouvier