888872 - IonMonkey: Track location of slots/elements pointers for generational GC

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

Slots/elements can be allocated in the nursery and moved by minor GCs. When this happens we have to update any slots/elements pointers stored in Ion frames to point to the new malloc'ed buffer.

This patch tracks slots/elements pointers in safepoints, and updates them during minor GCs. This depends on Terrence's patch in bug 888463 and fixes Kraken.

Comment 1

[Terrence Cole [:terrence]]

Comment on attachment 769650 [details] [diff] [review]
Patch

Review of attachment 769650 [details] [diff] [review]:
-----------------------------------------------------------------

The changes to Nursery look righteous. I'll leave the rest to David.

r=me

::: js/src/ion/LIR.h
@@ -542,5 @@
>  #endif
>            case MIRType_Slots:
>            case MIRType_Elements:
> -            // When we begin allocating slots vectors from the GC, this will
> -            // need to change to ::OBJECT.

Well, that was prescient at least.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 769650 [details] [diff] [review]
Patch

Review of attachment 769650 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch. It's unfortunate we have to add all this extra complexity. It seems like a good long-term goal for the GC will be removing the distinctions between where GC objects are allocated.

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9a62d56be0bc

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/9a62d56be0bc