1137978 - Store JSObject::compartment() via its group

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

As discussed on IRC, storing an object's compartment via its group instead of its shape is both forward compatible with objects that don't have a shape, and saves a dereference when accessing the compartment.  This patch moves the canonical location of an object's compartment into its group, and also removes the unnecessary ObjectGroup::singleton_ field so that sizeof(ObjectGroup) does not increase.  BaseShape::compartment_ is still there, because removing it doesn't improve memory usage on 32 bit platforms and because memory reporting stuff (about:memory and Ubi) seem to depend on knowing the compartment for a shape or base shape.

r? jandem for TI changes, r? terrence for GC changes.  With the latter I mainly just copied over the stuff from BaseShapes for marking compartments, which was kind of strange code --- the compartment and its global are marked from ScanShape, but not MarkChildren(BaseShape*), and I preserved this behavior for object groups.

Comment 1

[Jan de Mooij [:jandem]]

Comment on attachment 8570824 [details] [diff] [review]
patch

Review of attachment 8570824 [details] [diff] [review]:
-----------------------------------------------------------------

Nice, using these flags instead of ObjectGroup::singleton_ is pretty nice.

Comment 2

[Terrence Cole [:terrence]]

Comment on attachment 8570824 [details] [diff] [review]
patch

Review of attachment 8570824 [details] [diff] [review]:
-----------------------------------------------------------------

(In reply to Brian Hackett (:bhackett) from comment #0)
> r? jandem for TI changes, r? terrence for GC changes.  With the latter I
> mainly just copied over the stuff from BaseShapes for marking compartments,
> which was kind of strange code --- the compartment and its global are marked
> from ScanShape, but not MarkChildren(BaseShape*), and I preserved this
> behavior for object groups.

Yeah, compartment liveness culling is extremely complex: I would assume this distinction is necessary, but I wouldn't want to hazard a guess as to why.

::: js/src/jsobj.h
@@ +168,5 @@
>          return group_->lazy();
>      }
>  
>      JSCompartment *compartment() const {
> +        return group_->compartment();

I think this is going to break Minor and Compacting GC because we expect JSObject::compartment to continue working on relocated objects. You should be able to restore the existing functionality by swapping the field order in RelocationOverlay, since ObjectGroup is always Tenured; please refer to and update the comment at jsgc.h:1146.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/73591b41e777

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/73591b41e777