1293260 - Improve ObjectGroup hash in TenureCountCache in 64 bit builds

Status: RESOLVED FIXED

(Core :: JavaScript: GC, defect)

Description

[Jon Coppeard (:jonco)]

Attachment: fix-tenure-count-hash

Currently we use PointerHasher<ObjectGroup*, 3>::hash() to hash the ObjectGroup pointer, and use the result modulo the table size as an index.

This function shifts off the bottom 3 bits and combines the two 32-bit halves of the remaining word with XOR.  The table size is 16, so we then use the bottom four bits of that.

In 64 bit builds the bottom 4 bits of the ObjectGroup pointer are always zero since the size of the object is 48 bytes (it's 24 in 32 bit builds).  This means the bottom bit of the result comes only from bit 29 (32 - 3) of the input, which is almost always going to be the same.  This means we usually only use half the entries in the table (I originally found this because splay wasn't always pretenuring as expected).

Here's a patch to shift off 4 bits on 64 bit builds and to XOR in bits 8-4 of the remaining word which are more likely to be different.

Comment 1

[Terrence Cole [:terrence]]

Comment on attachment 8778896 [details] [diff] [review]
fix-tenure-count-hash

Review of attachment 8778896 [details] [diff] [review]:
-----------------------------------------------------------------

Excellent! We put approximately zero thought into that once we got splay working twice in a row on Brian's laptop. I think I meant to take a closer look, but it obviously fell off the radar.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/547340fb951d
Improve ObjectGroup hash in TenureCountCache in 64 bit builds r=terrence

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/547340fb951d