Bug 944040 - Do not use the store buffer during moving GC; r=jonco

--HG-- extra : rebase_source : cca04b1eb34c733a615a8cab12fb1625e940a1c9
2013-11-25 14:06:56 -08:00 · 2013-11-25 14:06:56 -08:00 · bcf90db7e6
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@ -1103,29 +1103,50 @@ MapObject::mark(JSTracer *trc, JSObject *obj)
 }

 #ifdef JSGC_GENERATIONAL
+struct UnbarrieredHashPolicy {
+    typedef Value Lookup;
+    static HashNumber hash(const Lookup &v) { return v.asRawBits(); }
+    static bool match(const Value &k, const Lookup &l) { return k == l; }
+    static bool isEmpty(const Value &v) { return v.isMagic(JS_HASH_KEY_EMPTY); }
+    static void makeEmpty(Value *vp) { vp->setMagic(JS_HASH_KEY_EMPTY); }
+};
+
 template <typename TableType>
 class OrderedHashTableRef : public gc::BufferableRef
 {
    TableType *table;
-    HashableValue key;
+    Value key;

  public:
-    explicit OrderedHashTableRef(TableType *t, const HashableValue &k) : table(t), key(k) {}
+    explicit OrderedHashTableRef(TableType *t, const Value &k) : table(t), key(k) {}

    void mark(JSTracer *trc) {
-        HashableValue prior = key;
-        key = key.mark(trc);
+        JS_ASSERT(UnbarrieredHashPolicy::hash(key) ==
+                  HashableValue::Hasher::hash(*reinterpret_cast<HashableValue*>(&key)));
+        Value prior = key;
+        gc::MarkValueUnbarriered(trc, &key, "ordered hash table key");
        table->rekeyOneEntry(prior, key);
    }
 };
 #endif

-template <typename TableType>
 static void
-WriteBarrierPost(JSRuntime *rt, TableType *table, const HashableValue &key)
+WriteBarrierPost(JSRuntime *rt, ValueMap *map, const HashableValue &key)
 {
 #ifdef JSGC_GENERATIONAL
-    rt->gcStoreBuffer.putGeneric(OrderedHashTableRef<TableType>(table, key));
+    typedef OrderedHashMap<Value, Value, UnbarrieredHashPolicy, RuntimeAllocPolicy> UnbarrieredMap;
+    rt->gcStoreBuffer.putGeneric(OrderedHashTableRef<UnbarrieredMap>(
+                reinterpret_cast<UnbarrieredMap *>(map), key.get()));
+#endif
+}
+
+static void
+WriteBarrierPost(JSRuntime *rt, ValueSet *set, const HashableValue &key)
+{
+#ifdef JSGC_GENERATIONAL
+    typedef OrderedHashSet<Value, UnbarrieredHashPolicy, RuntimeAllocPolicy> UnbarrieredSet;
+    rt->gcStoreBuffer.putGeneric(OrderedHashTableRef<UnbarrieredSet>(
+                reinterpret_cast<UnbarrieredSet *>(set), key.get()));
 #endif
 }

--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@ -253,23 +253,6 @@ ZoneOfValueFromAnyThread(const JS::Value &value)
    return static_cast<js::gc::Cell *>(value.toGCThing())->tenuredZoneFromAnyThread();
 }

-/*
- * This is a post barrier for HashTables whose key is a GC pointer. Any
- * insertion into a HashTable not marked as part of the runtime, with a GC
- * pointer as a key, must call this immediately after each insertion.
- */
-template <class Map, class Key>
-inline void
-HashTableWriteBarrierPost(JSRuntime *rt, Map *map, const Key &key)
-{
-#ifdef JSGC_GENERATIONAL
-    if (key && IsInsideNursery(rt, key)) {
-        JS::shadow::Runtime *shadowRuntime = JS::shadow::Runtime::asShadowRuntime(rt);
-        shadowRuntime->gcStoreBufferPtr()->putGeneric(gc::HashKeyRef<Map, Key>(map, key));
-    }
-#endif
-}
-
 /*
 * Base class for barriered pointer types.
 */
@ -522,6 +505,7 @@ typedef HeapPtr<BaseShape> HeapPtrBaseShape;
 typedef HeapPtr<types::TypeObject> HeapPtrTypeObject;

 /* Useful for hashtables with a HeapPtr as key. */
+
 template <class T>
 struct HeapPtrHasher
 {
@ -1158,6 +1142,20 @@ class ReadBarrieredValue
    inline JSObject &toObject() const;
 };

+/*
+ * Operations on a Heap thing inside the GC need to strip the barriers from
+ * pointer operations. This template helps do that in contexts where the type
+ * is templatized.
+ */
+template <typename T> struct Unbarriered {};
+template <typename S> struct Unbarriered< EncapsulatedPtr<S> > { typedef S *type; };
+template <typename S> struct Unbarriered< RelocatablePtr<S> > { typedef S *type; };
+template <> struct Unbarriered<EncapsulatedValue> { typedef Value type; };
+template <> struct Unbarriered<RelocatableValue> { typedef Value type; };
+template <typename S> struct Unbarriered< DefaultHasher< EncapsulatedPtr<S> > > {
+    typedef DefaultHasher<S *> type;
+};
+
 } /* namespace js */

 #endif /* gc_Barrier_h */
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@ -268,6 +268,21 @@ TryPreserveReflector(JSContext *cx, HandleObject obj)
    return true;
 }

+static inline void
+WeakMapPostWriteBarrier(JSRuntime *rt, ObjectValueMap *map, JSObject *key)
+{
+#ifdef JSGC_GENERATIONAL
+    /*
+     * Strip the barriers from the type before inserting into the store buffer.
+     * This will automatically ensure that barriers do not fire during GC.
+     */
+    typedef WeakMap<JSObject *, Value> UnbarrieredObjectValueMap;
+    typedef HashKeyRef<UnbarrieredObjectValueMap, JSObject *> Ref;
+    if (key && IsInsideNursery(rt, key))
+        rt->gcStoreBuffer.putGeneric(Ref(reinterpret_cast<UnbarrieredObjectValueMap *>(map), key));
+#endif
+}
+
 JS_ALWAYS_INLINE bool
 WeakMap_set_impl(JSContext *cx, CallArgs args)
 {
@ -312,7 +327,7 @@ WeakMap_set_impl(JSContext *cx, CallArgs args)
        JS_ReportOutOfMemory(cx);
        return false;
    }
-    HashTableWriteBarrierPost(cx->runtime(), map, key.get());
+    WeakMapPostWriteBarrier(cx->runtime(), map, key.get());

    args.rval().setUndefined();
    return true;
--- a/js/src/jsweakmap.h
+++ b/js/src/jsweakmap.h
@ -131,6 +131,7 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
  public:
    typedef HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy> Base;
    typedef typename Base::Enum Enum;
+    typedef typename Base::Lookup Lookup;
    typedef typename Base::Range Range;

    explicit WeakMap(JSContext *cx, JSObject *memOf = nullptr)
@ -150,7 +151,7 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
            Key key(e.front().key);
            gc::Mark(trc, &key, "WeakMap entry key");
            if (key != e.front().key)
-                e.rekeyFront(key, key);
+                entryMoved(e, key);
        }
    }

@ -185,11 +186,11 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
                if (markValue(trc, &e.front().value))
                    markedAny = true;
                if (e.front().key != key)
-                    e.rekeyFront(key);
+                    entryMoved(e, key);
            } else if (keyNeedsMark(key)) {
                gc::Mark(trc, const_cast<Key *>(&key), "proxy-preserved WeakMap entry key");
                if (e.front().key != key)
-                    e.rekeyFront(key);
+                    entryMoved(e, key);
                gc::Mark(trc, &e.front().value, "WeakMap entry value");
                markedAny = true;
            }
@ -205,7 +206,7 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
            if (gc::IsAboutToBeFinalized(&k))
                e.removeFront();
            else if (k != e.front().key)
-                e.rekeyFront(k, k);
+                entryMoved(e, k);
        }
        /*
         * Once we've swept, all remaining edges should stay within the
@ -227,6 +228,16 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
        }
    }

+    /* Rekey an entry when moved, ensuring we do not trigger barriers. */
+    void entryMoved(Enum &eArg, const Key &k) {
+        typedef typename HashMap<typename Unbarriered<Key>::type,
+                                 typename Unbarriered<Value>::type,
+                                 typename Unbarriered<HashPolicy>::type,
+                                 RuntimeAllocPolicy>::Enum UnbarrieredEnum;
+        UnbarrieredEnum &e = reinterpret_cast<UnbarrieredEnum &>(eArg);
+        e.rekeyFront(reinterpret_cast<const typename Unbarriered<Key>::type &>(k));
+    }
+
 protected:
    void assertEntriesNotAboutToBeFinalized() {
 #if DEBUG
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@ -1528,6 +1528,31 @@ js_IsDebugScopeSlow(ProxyObject *proxy)

 /*****************************************************************************/

+/* static */ JS_ALWAYS_INLINE void
+DebugScopes::proxiedScopesPostWriteBarrier(JSRuntime *rt, ObjectWeakMap *map,
+                                           const EncapsulatedPtr<JSObject> &key)
+{
+#ifdef JSGC_GENERATIONAL
+    /*
+     * Strip the barriers from the type before inserting into the store buffer.
+     * This will automatically ensure that barriers do not fire during GC.
+     */
+    typedef WeakMap<JSObject *, JSObject *> UnbarrieredMap;
+    typedef gc::HashKeyRef<UnbarrieredMap, JSObject *> Ref;
+    if (key && IsInsideNursery(rt, key))
+        rt->gcStoreBuffer.putGeneric(Ref(reinterpret_cast<UnbarrieredMap *>(map), key.get()));
+#endif
+}
+
+/* static */ JS_ALWAYS_INLINE void
+DebugScopes::liveScopesPostWriteBarrier(JSRuntime *rt, LiveScopeMap *map, ScopeObject *key)
+{
+#ifdef JSGC_GENERATIONAL
+    if (key && IsInsideNursery(rt, key))
+        rt->gcStoreBuffer.putGeneric(gc::HashKeyRef<LiveScopeMap, ScopeObject *>(map, key));
+#endif
+}
+
 DebugScopes::DebugScopes(JSContext *cx)
 : proxiedScopes(cx),
   missingScopes(cx->runtime()),
@ -1661,7 +1686,7 @@ DebugScopes::addDebugScope(JSContext *cx, ScopeObject &scope, DebugScopeObject &
        return false;
    }

-    HashTableWriteBarrierPost(cx->runtime(), &scopes->proxiedScopes, &scope);
+    proxiedScopesPostWriteBarrier(cx->runtime(), &scopes->proxiedScopes, &scope);
    return true;
 }

@ -1705,7 +1730,7 @@ DebugScopes::addDebugScope(JSContext *cx, const ScopeIter &si, DebugScopeObject
        js_ReportOutOfMemory(cx);
        return false;
    }
-    HashTableWriteBarrierPost(cx->runtime(), &scopes->liveScopes, &debugScope.scope());
+    liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &debugScope.scope());

    return true;
 }
@ -1859,7 +1884,7 @@ DebugScopes::onGeneratorFrameChange(AbstractFramePtr from, AbstractFramePtr to,
                livePtr->value = to;
            } else {
                scopes->liveScopes.add(livePtr, &toIter.scope(), to);  // OOM here?
-                HashTableWriteBarrierPost(cx->runtime(), &scopes->liveScopes, &toIter.scope());
+                liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &toIter.scope());
            }
        } else {
            ScopeIter si(toIter, from, cx);
@ -1921,7 +1946,7 @@ DebugScopes::updateLiveScopes(JSContext *cx)
                    return false;
                if (!scopes->liveScopes.put(&si.scope(), frame))
                    return false;
-                HashTableWriteBarrierPost(cx->runtime(), &scopes->liveScopes, &si.scope());
+                liveScopesPostWriteBarrier(cx->runtime(), &scopes->liveScopes, &si.scope());
            }
        }

--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@ -669,6 +669,8 @@ class DebugScopes
    /* The map from (non-debug) scopes to debug scopes. */
    typedef WeakMap<EncapsulatedPtrObject, RelocatablePtrObject> ObjectWeakMap;
    ObjectWeakMap proxiedScopes;
+    static JS_ALWAYS_INLINE void proxiedScopesPostWriteBarrier(JSRuntime *rt, ObjectWeakMap *map,
+                                                               const EncapsulatedPtrObject &key);

    /*
     * The map from live frames which have optimized-away scopes to the
@ -692,6 +694,8 @@ class DebugScopes
                    DefaultHasher<ScopeObject *>,
                    RuntimeAllocPolicy> LiveScopeMap;
    LiveScopeMap liveScopes;
+    static JS_ALWAYS_INLINE void liveScopesPostWriteBarrier(JSRuntime *rt, LiveScopeMap *map,
+                                                            ScopeObject *key);

  public:
    DebugScopes(JSContext *c);