2005437 - Allow movement of Wasm{Struct,Array}Object OOL blocks during GC

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, enhancement, P3)

Description

[Julian Seward [:jseward]]

Bug 1995106 introduced suitable plumbing that allows stackmap entries for OOL
storage of Wasm{Struct,Array}Objects to flow through to the GC, but it does not
make use of them. This patch completes the job, by giving the GC the
opportunity of moving those blocks, recording their new locations in the
Nursery's forwarded-block table, and later using those entries to fix up
on-stack pointers to such blocks.

There is no change to the layout of either WasmStructObject or WasmArrayObject.

Comment 1

[Julian Seward [:jseward]]

Attachment: Bug 2005437 - Allow movement of Wasm{Struct,Array}Object OOL blocks during GC. r=rhunt.

Bug 1995106 introduced suitable plumbing that allows stackmap entries for OOL
storage of Wasm{Struct,Array}Objects to flow through to the GC, but it does not
make use of them. This patch completes the job, by giving the GC the
opportunity of moving those blocks, recording their new locations in the
Nursery's forwarded-block table, and later using those entries to fix up
on-stack pointers to such blocks.

There is no change to the layout of either WasmStructObject or WasmArrayObject.

Changes:

• WasmArrayObject::obj_moved, WasmStructObject::obj_moved: completely
  rewritten. More assertions, and more clarity about the {Nursery,Tenured} ->
  {Nursery,Tenured} transitions. Allows the GC to move OOL blocks if required,
  and if so adds their new addresses to the Nursery's forwarded-block table.

• Instance::updateFrameForMovingGC: completely rewritten. Use the
  forwarded-block table to update OOL pointers as required.

• A bit of tidying of routines associated with WasmArrayObject::DataHeader.
  Creates DataHeader::dataHeaderToDataPointer and makes that be more obviously
  the "inverse" to ::dataHeaderFromDataPointer.

Comment 2

[Julian Seward [:jseward]]

Perf effects, for this patch applied together with that of bug 1995106.
Intel Tiger lake, best of 10 runs.

                    million           million
                instructions:u        cycles:u         Total Score
                before    after   before    after    before    after

j2cl-box2d      11,901   11,753    4,878    4,755    155.80   159.18
Ko-compose     117,468  116,798   76,378   76,044      4.17     4.20
Df-todomvc      29,526   29,600   22,334   22,426     25.31    25.18
Df-complex     102,098  102,065   68,466   68,564      4.57     4.56 

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2be25aae43d1
https://hg.mozilla.org/integration/autoland/rev/d2378d9ccc43
Allow movement of Wasm{Struct,Array}Object OOL blocks during GC.  r=rhunt.

Comment 4

[amarc]

https://hg.mozilla.org/mozilla-central/rev/d2378d9ccc43