Make TypeObject a GC thing

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
5 years ago

People

(Reporter: bhackett, Assigned: bhackett)

Tracking

(Blocks: 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

6 years ago
We need to check whether type objects are marked over and over during GC, regardless of how many type objects there actually are.  TypeObjects are currently malloc'ed individually and store their mark bits as a field, which has the potential for lots of fragmentation and cache misses.
(Assignee)

Comment 1

6 years ago
Created attachment 547397 [details] [diff] [review]
patch

Make TypeObject a GC thing, and do some other refactoring:

- Allow singleton type objects (representing exactly one JS object) to be destroyed on each GC (in addition to being lazily constructed, as last week's refactoring did) if the conservative GC does not find a pointer to them, and allocate their data from the analysis pool rather than via malloc.

- Track per-allocation-site type objects in a per-compartment hashtable (similar to what we do for JSON/singleton type info).  This cuts the size of TypeObject significantly, and removes a mostly-unused pointer from JSScript.  Allocation of such objects may slow down, the fix for that is to inline creation of objects, arrays etc. in the jitcode.  This also removes the quadratic behavior seen with scripts containing tons of object/array initializers.

Another tests-pass push (at least in the shell), still need to see how this affects memory.
Assignee: general → bhackett1024
(Assignee)

Comment 2

6 years ago
http://hg.mozilla.org/projects/jaegermonkey/rev/dd84f621ca25

Updated

6 years ago
Blocks: 680951

Updated

6 years ago
Depends on: 684348

Comment 3

5 years ago
Can this be closed?
(Assignee)

Updated

5 years ago
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.