GC: purge jitcode when we disable the nursery

RESOLVED FIXED in mozilla24

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: terrence, Assigned: terrence)

Tracking

Trunk
mozilla24
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Assignee)

Description

5 years ago
Created attachment 758674 [details] [diff] [review]
v0

JIT code implicitly bakes the enable/disable status of the nursery into its allocators, so continuing to run existing JIT code after disabling continues to allocate into the disabled nursery. Fortunately, we only disable the nursery when we exceed gcMaxBytes and when we enter post-barrier verification. Because both of these features are only available when testing and fuzzing, the performance of Nursery::disable does not matter at all. Thus, the simple solution of just purging and re-generating the JIT code is adequate in this case.
Attachment #758674 - Flags: review?(bhackett1024)
It seems a little unfortunate to purge jitcode every time we verify post barriers?  How does jitcode bake in the enabled/disabled status?  Since the nursery is resizable jitcode won't bake in the end pointer, and will load it when doing allocations.  If the position >= end when the nursery is disabled then jitcode should always take a slow path when allocating and go through the tenured heap.
(Assignee)

Comment 2

5 years ago
Comment on attachment 758674 [details] [diff] [review]
v0

Hmm, okay. I assumed that since you wanted bug 877835 to disable by updating numAvailableChunks_ rather than position_ that you preferred this approach.
Attachment #758674 - Flags: review?(bhackett1024)
If numAvailableChunks_ is zero then the end pointer (which is dynamically loaded by jitcode when allocating from the nursery) should never be > either the start or current position in the nursery.
(Assignee)

Comment 4

5 years ago
Created attachment 758844 [details] [diff] [review]
v1

That works well, thanks.
Attachment #758674 - Attachment is obsolete: true
Attachment #758844 - Flags: review?(bhackett1024)
Attachment #758844 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 5

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/61a183d6b59e
https://hg.mozilla.org/mozilla-central/rev/61a183d6b59e
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.