679329 - TI: allocate all typeset data and properties from arenas

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Right now the tables used in typesets containing multiple objects, type properties, and tables used in type objects containing multiple properties are allocated either from the compartment's transient pool or from malloc, depending on whether the data must survive GCs.  It would be cleaner and faster to just always allocate from the transient arena, and on GC copy over everything that is still live to a new arena.  This copying may have a marginal impact during GC, though I doubt it (the data needs to be traversed anyways, and there isn't much of it --- 3MB in a 150 tab run, per bug 678044).  The primary purpose is to reduce any effect which TI has on browser heap fragmentation, as this will eliminate almost all malloc'ing done by TI.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Patch, with the above and some other fixes:

- Purge observed types from a compartment's scripts on each 1/8 lifetime for normal mjit code, provided that no frames from the compartment are on the stack.  The 1/8 lifetime was reduced from 2min to 1min.

- Report to about:memory for TI data that was previously missed: newScript data attached to type objects, per-compartment tables storing TI data and worklists for solving type constraints.  These add up to a few MB in a 150 tab run; all TI data should now be accounted for.

- Purge the constraint worklist on each GC, which could be 75K+ for complex compartments and is easy to regenerate if the compartment becomes active again.

http://hg.mozilla.org/projects/jaegermonkey/rev/aa547ed80bba