1247298 - Generalize the mechanism used to store weakly held objects in the nursery

Status: NEW

(Core :: JavaScript: GC, defect)

Description

[Terrence Cole [:terrence]]

Initially, the nursery treated all edges into and inside of the nursery as strong edges. The reason for this was simple: it is possible to allocate JS WeakMap objects in the nursery. Given a complex graph of tenured and nursery allocated WeakMaps, it is impossible to tell from just nursery-local state (e.g. in minor collections) if any particular WeakMap object in the nursery is alive or dead.

However, script allocated WeakMaps are a somewhat special case; most runtime-held weak caches cannot (obviously) participate in weak graphs. In these cases, we /can/ tell if a held object is live during a minor collection if any strong edges exist to hold it live. We just need the GC to tell the weak holder that the thing is no longer alive so that it can remove its reference.

Currently, there are two cases that use this technique. The first is TypedArray views. It is an extremely common pattern to create a massive ArrayBuffer (e.g. vertex data) and to then map thousands of tiny views over a part of it (e.g. to examine vertices one at a time). We need those tiny views to be fast and not clog up memory. The second case is for event wrappers. If event wrappers are allocated tenured, then they create JS to C++ cycles, which forces us to CC to clear them. In cases where a page is otherwise totally idle, this is rather silly.

We're not considering adding a third nursery-clearable weak cache, so we should find a good way to generalize this mechanism before doing so.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

(In reply to Terrence Cole [:terrence] from comment #0)
> The second case is for event
> wrappers. If event wrappers are allocated tenured, then they create JS to
> C++ cycles, which forces us to CC to clear them.
Not quite true. Wrappers can be tenured also if some tenured JS starts to have an edge to them, and in that
case just running GC is enough to kill the Event (when finalizer + SnowWhitekiller run).
Only if the wrapper is preserved, CC needs to clear the cycle.