Skip to content
This repository was archived by the owner on Jul 9, 2025. It is now read-only.

Commit 297ac5b

Browse files
jonco3jonco3
committed
Bug 1532376 - Fix places where we don't respect the shouldPretenure flag when creating an object r=jandem
This adds an overload of GetInitialHeap that takes an ObjectGroup* instead of a Class* and also takes into account whether the group's shouldPreTenure flag is set. I moved this to JSObject-inl.h too. I removed the heap parameter in a few places, in particular in NewDenseCopyOnWriteArray which required a bunch of changes elsewhere including the JITs. I left the heap parameter intact for environment objects where we may have reason prefer these objects to be allocated in the tenure heap. It's possible we should just remove all these parameters too and make allocation more uniform. Differential Revision: https://phabricator.services.mozilla.com/D22324
1 parent ba8662d commit 297ac5b

19 files changed

+72
-48
lines changed

‎js/src/builtin/Array.cpp‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4064,7 +4064,7 @@ static MOZ_ALWAYS_INLINE ArrayObject* NewArray(
40644064
AutoSetNewObjectMetadata metadata(cx);
40654065
RootedArrayObject arr(
40664066
cx, ArrayObject::createArray(
4067-
cx, allocKind, GetInitialHeap(newKind, &ArrayObject::class_),
4067+
cx, allocKind, GetInitialHeap(newKind, group),
40684068
shape, group, length, metadata));
40694069
if (!arr) {
40704070
return nullptr;
@@ -4153,7 +4153,7 @@ ArrayObject* js::NewDenseFullyAllocatedArrayWithTemplate(
41534153
RootedObjectGroup group(cx, templateObject->group());
41544154
RootedShape shape(cx, templateObject->as<ArrayObject>().lastProperty());
41554155

4156-
gc::InitialHeap heap = GetInitialHeap(GenericObject, &ArrayObject::class_);
4156+
gc::InitialHeap heap = GetInitialHeap(GenericObject, group);
41574157
Rooted<ArrayObject*> arr(
41584158
cx, ArrayObject::createArray(cx, allocKind, heap, shape, group, length,
41594159
metadata));
@@ -4171,10 +4171,11 @@ ArrayObject* js::NewDenseFullyAllocatedArrayWithTemplate(
41714171
}
41724172

41734173
ArrayObject* js::NewDenseCopyOnWriteArray(JSContext* cx,
4174-
HandleArrayObject templateObject,
4175-
gc::InitialHeap heap) {
4174+
HandleArrayObject templateObject) {
41764175
MOZ_ASSERT(!gc::IsInsideNursery(templateObject));
41774176

4177+
gc::InitialHeap heap = GetInitialHeap(GenericObject, templateObject->group());
4178+
41784179
ArrayObject* arr =
41794180
ArrayObject::createCopyOnWriteArray(cx, heap, templateObject);
41804181
if (!arr) {

‎js/src/builtin/Array.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,7 @@ extern ArrayObject* NewDenseFullyAllocatedArrayWithTemplate(
7979

8080
// Create a dense array with the same copy-on-write elements as another object.
8181
extern ArrayObject* NewDenseCopyOnWriteArray(JSContext* cx,
82-
HandleArrayObject templateObject,
83-
gc::InitialHeap heap);
82+
HandleArrayObject templateObject);
8483

8584
extern ArrayObject* NewFullyAllocatedArrayTryUseGroup(
8685
JSContext* cx, HandleObjectGroup group, size_t length,

‎js/src/builtin/Stream.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1553,7 +1553,7 @@ static MOZ_MUST_USE JSObject* ReadableStreamCreateReadResult(
15531553
NativeObject* obj;
15541554
JS_TRY_VAR_OR_RETURN_NULL(
15551555
cx, obj,
1556-
NativeObject::createWithTemplate(cx, gc::DefaultHeap, templateObject));
1556+
NativeObject::createWithTemplate(cx, templateObject));
15571557

15581558
// Step 5: Perform CreateDataProperty(obj, "value", value).
15591559
obj->setSlot(Realm::IterResultObjectValueSlot, value);

‎js/src/jit/BaselineCompiler.cpp‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2447,10 +2447,9 @@ bool BaselineCompilerCodeGen::emit_JSOP_NEWARRAY_COPYONWRITE() {
24472447

24482448
prepareVMCall();
24492449

2450-
pushArg(Imm32(gc::DefaultHeap));
24512450
pushArg(ImmGCPtr(obj));
24522451

2453-
using Fn = ArrayObject* (*)(JSContext*, HandleArrayObject, gc::InitialHeap);
2452+
using Fn = ArrayObject* (*)(JSContext*, HandleArrayObject);
24542453
if (!callVM<Fn, js::NewDenseCopyOnWriteArray>()) {
24552454
return false;
24562455
}

‎js/src/jit/CodeGenerator.cpp‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6608,8 +6608,7 @@ void CodeGenerator::visitOutOfLineNewArray(OutOfLineNewArray* ool) {
66086608
masm.jump(ool->rejoin());
66096609
}
66106610

6611-
typedef ArrayObject* (*NewArrayCopyOnWriteFn)(JSContext*, HandleArrayObject,
6612-
gc::InitialHeap);
6611+
typedef ArrayObject* (*NewArrayCopyOnWriteFn)(JSContext*, HandleArrayObject);
66136612
static const VMFunction NewArrayCopyOnWriteInfo =
66146613
FunctionInfo<NewArrayCopyOnWriteFn>(js::NewDenseCopyOnWriteArray,
66156614
"NewDenseCopyOnWriteArray");
@@ -6623,7 +6622,7 @@ void CodeGenerator::visitNewArrayCopyOnWrite(LNewArrayCopyOnWrite* lir) {
66236622
// If we have a template object, we can inline call object creation.
66246623
OutOfLineCode* ool =
66256624
oolCallVM(NewArrayCopyOnWriteInfo, lir,
6626-
ArgList(ImmGCPtr(templateObject), Imm32(initialHeap)),
6625+
ArgList(ImmGCPtr(templateObject)),
66276626
StoreRegisterTo(objReg));
66286627

66296628
TemplateObject templateObj(templateObject);

‎js/src/jit/Recover.cpp‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1254,12 +1254,10 @@ bool RNewArray::recover(JSContext* cx, SnapshotIterator& iter) const {
12541254
bool MNewArrayCopyOnWrite::writeRecoverData(CompactBufferWriter& writer) const {
12551255
MOZ_ASSERT(canRecoverOnBailout());
12561256
writer.writeUnsigned(uint32_t(RInstruction::Recover_NewArrayCopyOnWrite));
1257-
writer.writeByte(initialHeap());
12581257
return true;
12591258
}
12601259

12611260
RNewArrayCopyOnWrite::RNewArrayCopyOnWrite(CompactBufferReader& reader) {
1262-
initialHeap_ = gc::InitialHeap(reader.readByte());
12631261
}
12641262

12651263
bool RNewArrayCopyOnWrite::recover(JSContext* cx,
@@ -1269,7 +1267,7 @@ bool RNewArrayCopyOnWrite::recover(JSContext* cx,
12691267
RootedValue result(cx);
12701268

12711269
ArrayObject* resultObject =
1272-
NewDenseCopyOnWriteArray(cx, templateObject, initialHeap_);
1270+
NewDenseCopyOnWriteArray(cx, templateObject);
12731271
if (!resultObject) {
12741272
return false;
12751273
}

‎js/src/jit/Recover.h‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -617,9 +617,6 @@ class RNewArray final : public RInstruction {
617617
};
618618

619619
class RNewArrayCopyOnWrite final : public RInstruction {
620-
private:
621-
gc::InitialHeap initialHeap_;
622-
623620
public:
624621
RINSTRUCTION_HEADER_NUM_OP_(NewArrayCopyOnWrite, 1)
625622

‎js/src/vm/EnvironmentObject.cpp‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,9 +79,11 @@ CallObject* CallObject::create(JSContext* cx, HandleShape shape,
7979
MOZ_ASSERT(CanBeFinalizedInBackground(kind, &CallObject::class_));
8080
kind = gc::GetBackgroundAllocKind(kind);
8181

82+
gc::InitialHeap heap = GetInitialHeap(GenericObject, group);
83+
8284
JSObject* obj;
8385
JS_TRY_VAR_OR_RETURN_NULL(
84-
cx, obj, NativeObject::create(cx, kind, gc::DefaultHeap, shape, group));
86+
cx, obj, NativeObject::create(cx, kind, heap, shape, group));
8587

8688
return &obj->as<CallObject>();
8789
}
@@ -108,6 +110,10 @@ CallObject* CallObject::createTemplateObject(JSContext* cx, HandleScript script,
108110
MOZ_ASSERT(CanBeFinalizedInBackground(kind, &class_));
109111
kind = gc::GetBackgroundAllocKind(kind);
110112

113+
if (group->shouldPreTenureDontCheckGeneration()) {
114+
heap = gc::TenuredHeap;
115+
}
116+
111117
JSObject* obj;
112118
JS_TRY_VAR_OR_RETURN_NULL(cx, obj,
113119
NativeObject::create(cx, kind, heap, shape, group));
@@ -887,6 +893,10 @@ LexicalEnvironmentObject* LexicalEnvironmentObject::createTemplateObject(
887893
return nullptr;
888894
}
889895

896+
if (group->shouldPreTenureDontCheckGeneration()) {
897+
heap = gc::TenuredHeap;
898+
}
899+
890900
gc::AllocKind allocKind = gc::GetGCObjectKind(shape->numFixedSlots());
891901
MOZ_ASSERT(
892902
CanBeFinalizedInBackground(allocKind, &LexicalEnvironmentObject::class_));

‎js/src/vm/Interpreter.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5288,7 +5288,7 @@ ArrayObject* js::NewArrayCopyOnWriteOperation(JSContext* cx,
52885288
return nullptr;
52895289
}
52905290

5291-
return NewDenseCopyOnWriteArray(cx, baseobj, gc::DefaultHeap);
5291+
return NewDenseCopyOnWriteArray(cx, baseobj);
52925292
}
52935293

52945294
void js::ReportRuntimeLexicalError(JSContext* cx, unsigned errorNumber,

‎js/src/vm/Iteration.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -619,7 +619,7 @@ static PropertyIteratorObject* NewPropertyIteratorObject(JSContext* cx) {
619619
JS_TRY_VAR_OR_RETURN_NULL(
620620
cx, obj,
621621
NativeObject::create(cx, ITERATOR_FINALIZE_KIND,
622-
GetInitialHeap(GenericObject, clasp), shape, group));
622+
GetInitialHeap(GenericObject, group), shape, group));
623623

624624
PropertyIteratorObject* res = &obj->as<PropertyIteratorObject>();
625625

@@ -996,7 +996,7 @@ JSObject* js::CreateIterResultObject(JSContext* cx, HandleValue value,
996996
NativeObject* resultObj;
997997
JS_TRY_VAR_OR_RETURN_NULL(
998998
cx, resultObj,
999-
NativeObject::createWithTemplate(cx, gc::DefaultHeap, templateObject));
999+
NativeObject::createWithTemplate(cx, templateObject));
10001000

10011001
// Step 3.
10021002
resultObj->setSlot(Realm::IterResultObjectValueSlot, value);

0 commit comments

Comments
 (0)