bool
PropertyTree::insertChild(JSContext *cx, UnrootedShape parent, UnrootedShape child)
{
    JS_ASSERT(!parent->inDictionary());
    JS_ASSERT(!child->parent);
    JS_ASSERT(!child->inDictionary());
    JS_ASSERT(cx->compartment == compartment);
    JS_ASSERT(child->compartment() == parent->compartment());

    KidsPointer *kidp = &parent->kids;

    if (kidp->isNull()) {
        child->setParent(parent);
        kidp->setShape(child);
        return true;
    }

    if (kidp->isShape()) {
        UnrootedShape shape = kidp->toShape();
        JS_ASSERT(shape != child);
        JS_ASSERT(!shape->matches(child));

        KidsHash *hash = HashChildren(shape, child);
        if (!hash) {
            JS_ReportOutOfMemory(cx);
            return false;
        }
        kidp->setHash(hash);
        child->setParent(parent);
        return true;
    }

    if (!kidp->toHash()->putNew(child, child)) {
        JS_ReportOutOfMemory(cx);
        return false;
    }

    child->setParent(parent);
    return true;
}
UnrootedShape
PropertyTree::getChild(JSContext *cx, Shape *parent_, uint32_t nfixed, const StackShape &child)
{
    AssertCanGC();

    {
        UnrootedShape shape = NULL;

        JS_ASSERT(parent_);

        /*
         * The property tree has extremely low fan-out below its root in
         * popular embeddings with real-world workloads. Patterns such as
         * defining closures that capture a constructor's environment as
         * getters or setters on the new object that is passed in as
         * |this| can significantly increase fan-out below the property
         * tree root -- see bug 335700 for details.
         */
        KidsPointer *kidp = &parent_->kids;
        if (kidp->isShape()) {
            UnrootedShape kid = kidp->toShape();
            if (kid->matches(child))
                shape = kid;
        } else if (kidp->isHash()) {
            if (KidsHash::Ptr p = kidp->toHash()->lookup(child))
                shape = *p;
        } else {
            /* If kidp->isNull(), we always insert. */
        }

#ifdef JSGC_INCREMENTAL
        if (shape) {
            JS::Zone *zone = shape->zone();
            if (zone->needsBarrier()) {
                /*
                 * We need a read barrier for the shape tree, since these are weak
                 * pointers.
                 */
                Shape *tmp = shape;
                MarkShapeUnbarriered(zone->barrierTracer(), &tmp, "read barrier");
                JS_ASSERT(tmp == shape);
            } else if (zone->isGCSweeping() && !shape->isMarked() &&
                       !shape->arenaHeader()->allocatedDuringIncremental)
            {
                /*
                 * The shape we've found is unreachable and due to be finalized, so
                 * remove our weak reference to it and don't use it.
                 */
                JS_ASSERT(parent_->isMarked());
                parent_->removeChild(shape);
                shape = NULL;
            }
        }
#endif

        if (shape)
            return shape;
    }

    StackShape::AutoRooter childRoot(cx, &child);
    RootedShape parent(cx, parent_);

    UnrootedShape shape = newShape(cx);
    if (!shape)
        return UnrootedShape(NULL);

    new (shape) Shape(child, nfixed);

    if (!insertChild(cx, parent, shape))
        return UnrootedShape(NULL);

    return shape;
}