1005532 - IonMonkey: Recover MNewObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Nicolas B. Pierron [:nbp]]

Attachment: Recover MNewObject.

Convert MNewObject in such a way that we can encode it as a recover instruction.
This is needed to implement any kind of escape analysis working on objects.

About the patch: The templateObject cannot be encoded as part of the recover instruction as the recover instruction buffer is not marked. To work around this limitation, I add a MConstant which is emitted at use (no extra code generated at runtime) to hold the templateObject.

 - If the MNewObject is not recovered this should not change the generated code.

 - If the MNewObject is recovered on bailout, then the MConstant will be listed as part of the snapshot and it would be encoded in the list of Values which are marked during GCs.

The recover part just duplicate the fallback path of NewObject which is based on VMFunction calls.

Comment 1

[Sean Stangl [:sstangl]]

Comment on attachment 8416941 [details] [diff] [review]
Recover MNewObject.

Review of attachment 8416941 [details] [diff] [review]:
-----------------------------------------------------------------

Seems fine to me.

::: js/src/jit/MIR.h
@@ +944,5 @@
>      INSTRUCTION_HEADER(Constant)
>      static MConstant *New(TempAllocator &alloc, const Value &v,
>                            types::CompilerConstraintList *constraints = nullptr);
>      static MConstant *NewAsmJS(TempAllocator &alloc, const Value &v, MIRType type);
> +    static MConstant *NewConstraintLessObject(TempAllocator &alloc, JSObject *v);

This should be "NewConstraintlessObject".

@@ +1472,5 @@
> +
> +        // The constant is inlined in the code of MNewObject, but we need a
> +        // MConstant such as it would be marked during GC, and thus as we can
> +        // safely access it in the recover instruction.
> +        templateConst->setEmittedAtUses();

This comment should describe the new state of the world, not the old state.

Comment 2

[Nicolas B. Pierron [:nbp]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/db65001f1407

Comment 3

[Nicolas B. Pierron [:nbp]]

https://tbpl.mozilla.org/?tree=Try&showall=1&rev=8dd1c40b48b4

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/db65001f1407