mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-21 09:15:35 +00:00
Bug 1505574 - Remove Unboxed Objects support from GC r=jandem
Also fixes Bug 1536460.
Differential Revision: https://phabricator.services.mozilla.com/D24040
--HG--
extra : moz-landing-system : lando
This commit is contained in:
Matthew Gaudet
parent
e52b7c03d2
commit
2fe65313f1
@ -8093,14 +8093,6 @@ void GCRuntime::mergeRealms(Realm* source, Realm* target) {
|
||||
|
||||
group->setGeneration(target->zone()->types.generation);
|
||||
group->realm_ = target;
|
||||
|
||||
// Remove any unboxed layouts from the list in the off thread
|
||||
// realm. These do not need to be reinserted in the target
|
||||
// realm's list, as the list is not required to be complete.
|
||||
if (UnboxedLayout* layout =
|
||||
group->maybeUnboxedLayoutDontCheckGeneration()) {
|
||||
layout->detachFromRealm();
|
||||
}
|
||||
}
|
||||
|
||||
// Fixup zone pointers in source's zone to refer to target's zone.
|
||||
|
||||
@ -30,7 +30,6 @@
|
||||
#include "vm/Shape.h"
|
||||
#include "vm/SymbolType.h"
|
||||
#include "vm/TypedArrayObject.h"
|
||||
#include "vm/UnboxedObject.h"
|
||||
#include "wasm/WasmJS.h"
|
||||
|
||||
#include "gc/GC-inl.h"
|
||||
@ -41,7 +40,6 @@
|
||||
#include "vm/NativeObject-inl.h"
|
||||
#include "vm/Realm-inl.h"
|
||||
#include "vm/StringType-inl.h"
|
||||
#include "vm/UnboxedObject-inl.h"
|
||||
|
||||
using namespace js;
|
||||
using namespace js::gc;
|
||||
@ -1427,16 +1425,6 @@ void js::ObjectGroup::traceChildren(JSTracer* trc) {
|
||||
maybePreliminaryObjects(sweep)->trace(trc);
|
||||
}
|
||||
|
||||
if (maybeUnboxedLayout(sweep)) {
|
||||
unboxedLayout(sweep).trace(trc);
|
||||
}
|
||||
|
||||
if (ObjectGroup* unboxedGroup = maybeOriginalUnboxedGroup()) {
|
||||
TraceManuallyBarrieredEdge(trc, &unboxedGroup,
|
||||
"group_original_unboxed_group");
|
||||
setOriginalUnboxedGroup(unboxedGroup);
|
||||
}
|
||||
|
||||
if (JSObject* descr = maybeTypeDescr()) {
|
||||
TraceManuallyBarrieredEdge(trc, &descr, "group_type_descr");
|
||||
setTypeDescr(&descr->as<TypeDescr>());
|
||||
@ -1474,14 +1462,6 @@ void js::GCMarker::lazilyMarkChildren(ObjectGroup* group) {
|
||||
group->maybePreliminaryObjects(sweep)->trace(this);
|
||||
}
|
||||
|
||||
if (group->maybeUnboxedLayout(sweep)) {
|
||||
group->unboxedLayout(sweep).trace(this);
|
||||
}
|
||||
|
||||
if (ObjectGroup* unboxedGroup = group->maybeOriginalUnboxedGroup()) {
|
||||
traverseEdge(group, unboxedGroup);
|
||||
}
|
||||
|
||||
if (TypeDescr* descr = group->maybeTypeDescr()) {
|
||||
traverseEdge(group, static_cast<JSObject*>(descr));
|
||||
}
|
||||
@ -1525,23 +1505,6 @@ static inline NativeObject* CallTraceHook(Functor&& f, JSTracer* trc,
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
if (clasp == &UnboxedPlainObject::class_) {
|
||||
JSObject** pexpando = obj->as<UnboxedPlainObject>().addressOfExpando();
|
||||
if (*pexpando) {
|
||||
f(pexpando);
|
||||
}
|
||||
|
||||
UnboxedPlainObject& unboxed = obj->as<UnboxedPlainObject>();
|
||||
const UnboxedLayout& layout = check == CheckGeneration::DoChecks
|
||||
? unboxed.layout()
|
||||
: unboxed.layoutDontCheckGeneration();
|
||||
if (layout.traceList()) {
|
||||
VisitTraceList(f, layout.traceList(), unboxed.data());
|
||||
}
|
||||
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
clasp->doTrace(trc, obj);
|
||||
|
||||
if (!clasp->isNative()) {
|
||||
@ -2796,20 +2759,6 @@ void js::gc::StoreBuffer::SlotsEdge::trace(TenuringTracer& mover) const {
|
||||
|
||||
static inline void TraceWholeCell(TenuringTracer& mover, JSObject* object) {
|
||||
mover.traceObject(object);
|
||||
|
||||
// Additionally trace the expando object attached to any unboxed plain
|
||||
// objects. Baseline and Ion can write properties to the expando while
|
||||
// only adding a post barrier to the owning unboxed object. Note that
|
||||
// it isn't possible for a nursery unboxed object to have a tenured
|
||||
// expando, so that adding a post barrier on the original object will
|
||||
// capture any tenured->nursery edges in the expando as well.
|
||||
|
||||
if (object->is<UnboxedPlainObject>()) {
|
||||
if (UnboxedExpandoObject* expando =
|
||||
object->as<UnboxedPlainObject>().maybeExpando()) {
|
||||
expando->traceChildren(&mover);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static inline void TraceWholeCell(TenuringTracer& mover, JSString* str) {
|
||||
|
||||
@ -157,76 +157,11 @@ void gc::TraceCycleCollectorChildren(JS::CallbackTracer* trc, Shape* shape) {
|
||||
} while (shape);
|
||||
}
|
||||
|
||||
// Object groups can point to other object groups via an UnboxedLayout or the
|
||||
// the original unboxed group link. There can potentially be deep or cyclic
|
||||
// chains of such groups to trace through without going through a thing that
|
||||
// participates in cycle collection. These need to be handled iteratively to
|
||||
// avoid blowing the stack when running the cycle collector's callback tracer.
|
||||
struct ObjectGroupCycleCollectorTracer : public JS::CallbackTracer {
|
||||
explicit ObjectGroupCycleCollectorTracer(JS::CallbackTracer* innerTracer)
|
||||
: JS::CallbackTracer(innerTracer->runtime(), DoNotTraceWeakMaps),
|
||||
innerTracer(innerTracer) {}
|
||||
|
||||
void onChild(const JS::GCCellPtr& thing) override;
|
||||
|
||||
JS::CallbackTracer* innerTracer;
|
||||
Vector<ObjectGroup*, 4, SystemAllocPolicy> seen, worklist;
|
||||
};
|
||||
|
||||
void ObjectGroupCycleCollectorTracer::onChild(const JS::GCCellPtr& thing) {
|
||||
if (thing.is<BaseShape>()) {
|
||||
// The CC does not care about BaseShapes, and no additional GC things
|
||||
// will be reached by following this edge.
|
||||
return;
|
||||
}
|
||||
|
||||
if (thing.is<JSObject>() || thing.is<JSScript>()) {
|
||||
// Invoke the inner cycle collector callback on this child. It will not
|
||||
// recurse back into TraceChildren.
|
||||
innerTracer->onChild(thing);
|
||||
return;
|
||||
}
|
||||
|
||||
if (thing.is<ObjectGroup>()) {
|
||||
// If this group is required to be in an ObjectGroup chain, trace it
|
||||
// via the provided worklist rather than continuing to recurse.
|
||||
ObjectGroup& group = thing.as<ObjectGroup>();
|
||||
AutoSweepObjectGroup sweep(&group);
|
||||
if (group.maybeUnboxedLayout(sweep)) {
|
||||
for (size_t i = 0; i < seen.length(); i++) {
|
||||
if (seen[i] == &group) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
if (seen.append(&group) && worklist.append(&group)) {
|
||||
return;
|
||||
} else {
|
||||
// If append fails, keep tracing normally. The worst that will
|
||||
// happen is we end up overrecursing.
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
TraceChildren(this, thing.asCell(), thing.kind());
|
||||
}
|
||||
|
||||
void gc::TraceCycleCollectorChildren(JS::CallbackTracer* trc,
|
||||
ObjectGroup* group) {
|
||||
MOZ_ASSERT(trc->isCallbackTracer());
|
||||
|
||||
// Early return if this group is not required to be in an ObjectGroup chain.
|
||||
AutoSweepObjectGroup sweep(group);
|
||||
if (!group->maybeUnboxedLayout(sweep)) {
|
||||
return group->traceChildren(trc);
|
||||
}
|
||||
|
||||
ObjectGroupCycleCollectorTracer groupTracer(trc->asCallbackTracer());
|
||||
group->traceChildren(&groupTracer);
|
||||
|
||||
while (!groupTracer.worklist.empty()) {
|
||||
ObjectGroup* innerGroup = groupTracer.worklist.popCopy();
|
||||
innerGroup->traceChildren(&groupTracer);
|
||||
}
|
||||
group->traceChildren(trc);
|
||||
}
|
||||
|
||||
/*** Traced Edge Printer ****************************************************/
|
||||
|
||||
Loading…
Reference in New Issue
Block a user