Backed out 3 changesets (bug 903519) for frequent assertion failures on js/src/gc/Cell.h:182 a=backout

Backed out changeset e8978f3fcfbe (bug 903519)
Backed out changeset 0f4234c21322 (bug 903519)
Backed out changeset 741225b427a8 (bug 903519)

js/src/gc/Allocator.cpp

@@ -182,11 +182,7 @@ js::AllocateString(JSContext* cx, InitialHeap heap)
     if (!rt->gc.checkAllocatorState<allowGC>(cx, kind))
         return nullptr;
 
-    if (cx->nursery().isEnabled() &&
-        heap != TenuredHeap &&
-        cx->nursery().canAllocateStrings() &&
-        cx->zone()->allocNurseryStrings)
-    {
+    if (cx->nursery().isEnabled() && heap != TenuredHeap && cx->nursery().canAllocateStrings()) {
         auto str = static_cast<StringAllocT*>(rt->gc.tryNewNurseryString<allowGC>(cx, size, kind));
         if (str)
             return str;

js/src/gc/Nursery.cpp

@@ -123,7 +123,7 @@ js::Nursery::Nursery(JSRuntime* rt)
   , previousPromotionRate_(0)
   , profileThreshold_(0)
   , enableProfiling_(false)
-  , canAllocateStrings_(true)
+  , canAllocateStrings_(false)
   , reportTenurings_(0)
   , minorGCTriggerReason_(JS::gcreason::NO_REASON)
   , minorGcCount_(0)
@@ -132,9 +132,9 @@ js::Nursery::Nursery(JSRuntime* rt)
   , lastCanary_(nullptr)
 #endif
 {
-    const char* env = getenv("MOZ_DISABLE_NURSERY_STRINGS");
+    const char* env = getenv("MOZ_ENABLE_NURSERY_STRINGS");
     if (env && *env)
-        canAllocateStrings_ = false;
+        canAllocateStrings_ = true;
 }
 
 bool
@@ -738,10 +738,8 @@ js::Nursery::collect(JS::gcreason::Reason reason)
     bool validPromotionRate;
     const float promotionRate = calcPromotionRate(&validPromotionRate);
     uint32_t pretenureCount = 0;
-    bool shouldPretenure = (validPromotionRate && promotionRate > 0.6) ||
-        IsFullStoreBufferReason(reason);
-
-    if (shouldPretenure) {
+    if (validPromotionRate) {
+        if (promotionRate > 0.8 || IsFullStoreBufferReason(reason)) {
             JSContext* cx = TlsContext.get();
             for (auto& entry : tenureCounts.entries) {
                 if (entry.count >= 3000) {
@@ -754,23 +752,6 @@ js::Nursery::collect(JS::gcreason::Reason reason)
                 }
             }
         }
-    for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
-        if (shouldPretenure && zone->allocNurseryStrings && zone->tenuredStrings >= 30 * 1000) {
-            JSRuntime::AutoProhibitActiveContextChange apacc(rt);
-            CancelOffThreadIonCompile(zone);
-            bool preserving = zone->isPreservingCode();
-            zone->setPreservingCode(false);
-            zone->discardJitCode(rt->defaultFreeOp());
-            zone->setPreservingCode(preserving);
-            for (CompartmentsInZoneIter c(zone); !c.done(); c.next()) {
-                if (jit::JitCompartment* jitComp = c->jitCompartment()) {
-                    jitComp->discardStubs();
-                    jitComp->stringsCanBeInNursery = false;
-                }
-            }
-            zone->allocNurseryStrings = false;
-        }
-        zone->tenuredStrings = 0;
     }
     endProfile(ProfileKey::Pretenure);
 
@@ -1105,7 +1086,7 @@ js::Nursery::setStartPosition()
 void
 js::Nursery::maybeResizeNursery(JS::gcreason::Reason reason)
 {
-    static const double GrowThreshold   = 0.03;
+    static const double GrowThreshold   = 0.05;
     static const double ShrinkThreshold = 0.01;
     unsigned newMaxNurseryChunks;
 

js/src/gc/Zone.cpp

@@ -46,8 +46,6 @@ JS::Zone::Zone(JSRuntime* rt, ZoneGroup* group)
     usage(&rt->gc.usage),
     threshold(),
     gcDelayBytes(0),
-    tenuredStrings(group, 0),
-    allocNurseryStrings(group, true),
     propertyTree_(group, this),
     baseShapes_(group, this),
     initialShapes_(group, this),

js/src/gc/Zone.h

@@ -482,9 +482,6 @@ struct Zone : public JS::shadow::Zone,
     // the current GC.
     js::UnprotectedData<size_t> gcDelayBytes;
 
-    js::ZoneGroupData<uint32_t> tenuredStrings;
-    js::ZoneGroupData<bool> allocNurseryStrings;
-
   private:
     // Shared Shape property tree.
     js::ZoneGroupData<js::PropertyTree> propertyTree_;

js/src/jit-test/tests/basic/testTypedArrayInit.js

@@ -13,12 +13,10 @@ function f() {
   {
     for (var len of [ 3, 30, 300, 3000, 30000 ]) {
       var arr = new ctor(len);
-      for (var i = 0; i < arr.length; i++) {
-        if (arr[i] != 0)
+      for (var i = 0; i < arr.length; i++)
         assertEq(arr[i], 0, "index " + i + " of " + ctor.name + " len " + len);
     }
   }
-  }
 }
 
 f();

js/src/jit/CompileWrappers.cpp

@@ -205,9 +205,7 @@ CompileZone::addressOfStringNurseryCurrentEnd()
 bool
 CompileZone::canNurseryAllocateStrings()
 {
-    return nurseryExists() &&
-        zone()->group()->nursery().canAllocateStrings() &&
-        zone()->allocNurseryStrings;
+    return nurseryExists() && zone()->group()->nursery().canAllocateStrings();
 }
 
 bool

js/src/jit/JitCompartment.h

@@ -610,13 +610,6 @@ class JitCompartment
         return stringConcatStub_;
     }
 
-    void discardStubs() {
-        stringConcatStub_ = nullptr;
-        regExpMatcherStub_ = nullptr;
-        regExpSearcherStub_ = nullptr;
-        regExpTesterStub_ = nullptr;
-    }
-
     JitCode* regExpMatcherStubNoBarrier() const {
         return regExpMatcherStub_;
     }

js/src/shell/js.cpp

@@ -9083,7 +9083,7 @@ main(int argc, char** argv, char** envp)
         || !op.addBoolOption('\0', "no-ggc", "Disable Generational GC")
         || !op.addBoolOption('\0', "no-cgc", "Disable Compacting GC")
         || !op.addBoolOption('\0', "no-incremental-gc", "Disable Incremental GC")
-        || !op.addBoolOption('\0', "no-nursery-strings", "Do not allocate strings in the nursery")
+        || !op.addBoolOption('\0', "nursery-strings", "Allocate strings in the nursery")
         || !op.addIntOption('\0', "available-memory", "SIZE",
                             "Select GC settings based on available memory (MB)", 0)
         || !op.addStringOption('\0', "arm-hwcap", "[features]",
@@ -9231,8 +9231,8 @@ main(int argc, char** argv, char** envp)
 
     js::UseInternalJobQueues(cx);
 
-    if (op.getBoolOption("no-nursery-strings"))
-        cx->runtime()->gc.nursery().disableStrings();
+    if (op.getBoolOption("nursery-strings"))
+        cx->runtime()->gc.nursery().enableStrings();
 
     if (!JS::InitSelfHostedCode(cx))
         return 1;

js/src/vm/HelperThreads.cpp

@@ -219,7 +219,6 @@ GetSelectorRuntime(const CompilationSelector& selector)
     {
         JSRuntime* match(JSScript* script)    { return script->runtimeFromActiveCooperatingThread(); }
         JSRuntime* match(JSCompartment* comp) { return comp->runtimeFromActiveCooperatingThread(); }
-        JSRuntime* match(Zone* zone)          { return zone->runtimeFromActiveCooperatingThread(); }
         JSRuntime* match(ZonesInState zbs)    { return zbs.runtime; }
         JSRuntime* match(JSRuntime* runtime)  { return runtime; }
         JSRuntime* match(AllCompilations all) { return nullptr; }
@@ -236,7 +235,6 @@ JitDataStructuresExist(const CompilationSelector& selector)
     {
         bool match(JSScript* script)    { return !!script->compartment()->jitCompartment(); }
         bool match(JSCompartment* comp) { return !!comp->jitCompartment(); }
-        bool match(Zone* zone)          { return !!zone->jitZone(); }
         bool match(ZonesInState zbs)    { return zbs.runtime->hasJitRuntime(); }
         bool match(JSRuntime* runtime)  { return runtime->hasJitRuntime(); }
         bool match(AllCompilations all) { return true; }
@@ -255,7 +253,6 @@ IonBuilderMatches(const CompilationSelector& selector, jit::IonBuilder* builder)
 
         bool match(JSScript* script)    { return script == builder_->script(); }
         bool match(JSCompartment* comp) { return comp == builder_->script()->compartment(); }
-        bool match(Zone* zone)          { return zone == builder_->script()->zone(); }
         bool match(JSRuntime* runtime)  { return runtime == builder_->script()->runtimeFromAnyThread(); }
         bool match(AllCompilations all) { return true; }
         bool match(ZonesInState zbs)    {

js/src/vm/HelperThreads.h

@@ -519,7 +519,6 @@ struct CompilationsUsingNursery { JSRuntime* runtime; };
 
 using CompilationSelector = mozilla::Variant<JSScript*,
                                              JSCompartment*,
-                                             Zone*,
                                              ZonesInState,
                                              JSRuntime*,
                                              CompilationsUsingNursery,
@@ -543,12 +542,6 @@ CancelOffThreadIonCompile(JSCompartment* comp)
     CancelOffThreadIonCompile(CompilationSelector(comp), true);
 }
 
-inline void
-CancelOffThreadIonCompile(Zone* zone)
-{
-    CancelOffThreadIonCompile(CompilationSelector(zone), true);
-}
-
 inline void
 CancelOffThreadIonCompile(JSRuntime* runtime, JS::Zone::GCState state)
 {