Merge Debugger::addGeneratorFrame into DebuggerFrame::setGenerator, and expand
the role of clearGenerator to fully undo the effect of setGenerator.
The association between a Debugger.Frame referring to a generator or async call
and the underlying generator object must be recorded in five separate places, as
a transaction: either all or present, or none are present. To ensure this is
true, this patch places sole responsibility for emplacing all those relations in
a single function (setGenerator), with another function to tear down those
relations (clearGenerator) as its inverse/antidote/complement/antagonist (in the
anatomical sense)/what-have-you.
Actually, when a Debugger.Frame is GC'd, we cannot reliably undo some of the
connections, and in fact can let the GC take care of those for us, so the
tear-down function clearGenerator is split into two overloads, one which is
suitable for use from a finalizer and the other which takes care of the entire
task.
Differential Revision: https://phabricator.services.mozilla.com/D35607
--HG--
extra : moz-landing-system : lando
Later in this patch series, we will be gathering up all the code to manage the
association between DebuggerFrame and AbstractGeneratorFrame objects into a pair
of functions, one to establish a relation and the other to tear it down. The
removeif method combines iteration and entry removal, but we would rather have
entry removal live next to the code that tears down the rest of the association.
In preparation for that, this changeset replaces the sole use of removeIf with
its (not very large) definition, so that the entry removal can be more readily
moved into another function.
Differential Revision: https://phabricator.services.mozilla.com/D35606
--HG--
extra : moz-landing-system : lando
Without this patch, addGeneratorFrame may be called from any realm, and enters
the debugger's realm to call DebuggerFrame::setGenerator. However, we would like
to merge addGeneratorFrame and setGenerator, and call the combined from various
points which are already in the debugger's realm, so it would be a little nicer
to simply make the function assume it is called from the debugger's realm.
Differential Revision: https://phabricator.services.mozilla.com/D35605
--HG--
extra : moz-landing-system : lando
The hand-written assembly for libffi on aarch64/windows doesn't emit
unwind information. If we ever tried to unwind through these functions,
they'd look like leaf functions, which is decidedly not true and would
cause great pain.
For whatever reason, the original aarch64 libffi functions used
x21/x22/x23/x24 as their (callee-saved) scratch registers. This
convention works on windows as well, but the unwind information on
windows mandates that we start saving callee-saved registers starting
from x19, rather than x21. Rather than rewriting the assembly to use
x19/x20 instead of x21/x22, which would be a large change, we chose
instead to simply save/restore extra registers in the prolog/epilog.
This change does make the stack frame sizes slightly bigger, but an
extra 16 bytes in libffi stack frames should not matter.
The `-TC` change is necessary to make the compiler play nicely with .asm
file suffixes.
Differential Revision: https://phabricator.services.mozilla.com/D35714
--HG--
extra : moz-landing-system : lando
If optional arrays of SharedScriptData are empty, avoid storing their
offset in order to save memory. This is done by deduplicating offsets
and storing this variably-sized set of offsets as a trailing array. A
uint32_t for each non-empty array. These offsets are analogous to the
array length we would naively consider storing but with careful encoding
for performance.
Differential Revision: https://phabricator.services.mozilla.com/D34791
--HG--
extra : moz-landing-system : lando
Add a flag into the byte array area. It is inserted before code() so it
will be at a fixed offset once atoms are removed. This will be used to
store flags about optional trailing arrays.
Differential Revision: https://phabricator.services.mozilla.com/D34789
--HG--
extra : moz-landing-system : lando
Now that PrivateScriptData contains a single array, the PackedSpan
mechanism for packing multiple trailing arrays can be removed.
Differential Revision: https://phabricator.services.mozilla.com/D35817
--HG--
extra : moz-landing-system : lando
These arrays contain only relocatable, cloneable data and should be made
shareable. The API they now expose in SharedScriptData uses Span.
Differential Revision: https://phabricator.services.mozilla.com/D34790
--HG--
extra : moz-landing-system : lando
Pad the source notes with SRC_NULL such that the code and notes arrays
together maintain uint32_t alignment. This is will later be used to add
optional trailing arrays with uint32_t alignment. The allocator would
already be rounding up our allocation so actually memory usage should be
neutral.
Differential Revision: https://phabricator.services.mozilla.com/D34788
--HG--
extra : moz-landing-system : lando
Make access to trailing arrays more consistent with other data
structures and better encapsulate the reinterpret_casts.
Differential Revision: https://phabricator.services.mozilla.com/D34787
--HG--
extra : moz-landing-system : lando
As PrivateScriptData contains less data, we need to make this test have
more complicated functions so that the test is not sensistive to
allocator rounding. This also removes the binjs variant of test until
they next time they are regenerated.
Differential Revision: https://phabricator.services.mozilla.com/D35840
--HG--
extra : moz-landing-system : lando
Gary noticed we can't build without NSPR on Windows due to this unused #include
inside #ifdef XP_WIN. This patch fixes the build.
Differential Revision: https://phabricator.services.mozilla.com/D35494
--HG--
extra : moz-landing-system : lando
Merge Debugger::addGeneratorFrame into DebuggerFrame::setGenerator, and expand
the role of clearGenerator to fully undo the effect of setGenerator.
The association between a Debugger.Frame referring to a generator or async call
and the underlying generator object must be recorded in five separate places, as
a transaction: either all or present, or none are present. To ensure this is
true, this patch places sole responsibility for emplacing all those relations in
a single function (setGenerator), with another function to tear down those
relations (clearGenerator) as its inverse/antidote/complement/antagonist (in the
anatomical sense)/what-have-you.
Actually, when a Debugger.Frame is GC'd, we cannot reliably undo some of the
connections, and in fact can let the GC take care of those for us, so the
tear-down function clearGenerator is split into two overloads, one which is
suitable for use from a finalizer and the other which takes care of the entire
task.
Differential Revision: https://phabricator.services.mozilla.com/D35607
--HG--
extra : moz-landing-system : lando
Later in this patch series, we will be gathering up all the code to manage the
association between DebuggerFrame and AbstractGeneratorFrame objects into a pair
of functions, one to establish a relation and the other to tear it down. The
removeif method combines iteration and entry removal, but we would rather have
entry removal live next to the code that tears down the rest of the association.
In preparation for that, this changeset replaces the sole use of removeIf with
its (not very large) definition, so that the entry removal can be more readily
moved into another function.
Differential Revision: https://phabricator.services.mozilla.com/D35606
--HG--
extra : moz-landing-system : lando
Without this patch, addGeneratorFrame may be called from any realm, and enters
the debugger's realm to call DebuggerFrame::setGenerator. However, we would like
to merge addGeneratorFrame and setGenerator, and call the combined from various
points which are already in the debugger's realm, so it would be a little nicer
to simply make the function assume it is called from the debugger's realm.
Differential Revision: https://phabricator.services.mozilla.com/D35605
--HG--
extra : moz-landing-system : lando
Update the memory pressure observers for main thread and workers to call the new JS API to set/clear the low memory state.
Differential Revision: https://phabricator.services.mozilla.com/D35682
Add a lowMemoryState field to GCRuntime and an API set set it. Use it to restict the nursery size when resizing the nursery.
Differential Revision: https://phabricator.services.mozilla.com/D35680
This adds tracking of malloc memory to WasmInstanceObject, WasmGlobalObject, WasmMemoryObject and ResolveResponseClosure (the straightforward cases).
Differential Revision: https://phabricator.services.mozilla.com/D35485
Created a hook in Runtime to expose the helper thread dispatch method to js, which is set by XPCJSRUntime::init.
Differential Revision: https://phabricator.services.mozilla.com/D27818
--HG--
extra : moz-landing-system : lando
Added HelperThreadPool & HelperThreadTaskHandler classes to hold and manage an nsThreadPool. Initialized thread pool in XPCJSRuntime.
Differential Revision: https://phabricator.services.mozilla.com/D27817
--HG--
extra : moz-landing-system : lando
Toolchains that support wasm threads will soon start relying on bulk
memory being available (as Chrome more or less ships both proposals
already). Currently we have bulk memory on Nightly under an ifdef,
but shared memory in all channels under a flag; as a result, we are
not compatible on non-Nightly with code that will soon come out of
these toolchains.
This patch keeps bulk memory enabled on Nightly but additionally
enables it on other channels if shared memory has been enabled by the
flag.
Mostly this is straightforward: we always enable decoding of bulk
memory operations, but will subsequently fail compilation for these
ops if bulk memory has not been enabled by the ifdef and shared memory
has not been enabled by the flag.
The only tricky part is really that the bulk memory proposal changes
the bounds checking for memory.init and table.init from eager to lazy,
so here the combinations of flags selects the bounds checking
behavior.
Once we ship bulk memory all of this complexity disappears.
Differential Revision: https://phabricator.services.mozilla.com/D36302
--HG--
extra : moz-landing-system : lando
This allows us to run the poisoning code after resizing the nursery,
ensuring that the correct region of that chunk is poisoned, fixing the bug.
This also simplifies the logic around how much of the nursery to poison, we
always poison the valid region of the nursery regardless of how much was
used (removing an earlier optimisation).
Differential Revision: https://phabricator.services.mozilla.com/D36315
--HG--
extra : moz-landing-system : lando
Because the return address cannot be used to uniquely identify script/pc, this
is unfortunately quite different from what we do for Baseline/Ion code.
The strategy is as follows:
* When the profiler is enabled, ensure each JitScript has a pointer to the
profile string (released when the script is finalized).
* The BaselineInterpreter code is registered with the JitcodeMap.
* The profiler code treats interpreter frames like C++ Interpreter frames,
instead of doing the return address based mapping.
Differential Revision: https://phabricator.services.mozilla.com/D31052
--HG--
extra : moz-landing-system : lando
Removed helperthread_ and its associated functions since they are no longer used & cleaned up a few missed checks that used it. Changed helperThread()->parseTask() checks to look for cx->parseTask() instead.
Differential Revision: https://phabricator.services.mozilla.com/D35491
--HG--
extra : moz-landing-system : lando
Added a ParseTask pointer to JSContext, set/removed during ParseTask::runTask
Differential Revision: https://phabricator.services.mozilla.com/D35365
--HG--
extra : moz-landing-system : lando
One problem with using shared memory instead of files for MemMapSnapshot
is that AutoMemMap was trying to use fstat() to obtain the object size;
that doesn't work with ashmem on Android and was causing problems with
the Mac sandbox, but it's not necessary, because we already know the
size. This patch changes it to not do that.
Depends on D26743
Differential Revision: https://phabricator.services.mozilla.com/D26744
--HG--
extra : moz-landing-system : lando
This refactors freeing stubs and adds memory tracking. It also adds a back pointer to the JSObject to ForOfPIC::Chain which is slightly annoying, but I think there's only one per global so this shouldn't be too bad.
Differential Revision: https://phabricator.services.mozilla.com/D35348
One problem with using shared memory instead of files for MemMapSnapshot
is that AutoMemMap was trying to use fstat() to obtain the object size;
that doesn't work with ashmem on Android and was causing problems with
the Mac sandbox, but it's not necessary, because we already know the
size. This patch changes it to not do that.
Depends on D26743
Differential Revision: https://phabricator.services.mozilla.com/D26744
--HG--
extra : moz-landing-system : lando
Once the other data is moved out of PrivateScriptData, this GC-thing array will be stored
at a fixed offset. At that point we can simplify PrivateScriptData and get fast indexing
into this array, important for the Baseline Interpreter.
Differential Revision: https://phabricator.services.mozilla.com/D34902
--HG--
extra : moz-landing-system : lando
As per previous commit the warning isn't emitted anymore, so no need to guard
against it.
Also in this case the warning was actually right, so we need to make sure that
we track similar ones.
Depends on D35292
Differential Revision: https://phabricator.services.mozilla.com/D35293
--HG--
extra : moz-landing-system : lando
Under GCC, the type attributes can't be set more than once, and when this happens
only the firt definition they are ignored.
Since MovableCellHasher<JSObject*> is used in various headers g++ implicitly set
the symbol visibility to default (and thus hidden), making this symbol not to be
exported as it should be.
Move the template specialization with type attributes to Barrier.h, so that this
might happen before any other definition, muting the warning and making the symbol
to be really exported
Fixes https://gcc.gnu.org/bugzilla/show_bug.cgi?id=39159
Differential Revision: https://phabricator.services.mozilla.com/D35292
--HG--
extra : moz-landing-system : lando
Check VM and Realm options that may disable syntax parsing up front in
the CompileOptions constructor. This is needed to make the frontend
closer to a pure-function.
Differential Revision: https://phabricator.services.mozilla.com/D35214
--HG--
extra : moz-landing-system : lando
Check realm flags at when creating CompileOptions rather than during
compilation. This is helpful for pre-compiling self-hosting code.
Differential Revision: https://phabricator.services.mozilla.com/D34976
--HG--
extra : moz-landing-system : lando
All uses of OwningCompileOptions now are initialized from copy() so
remove the now-unused setters.
Differential Revision: https://phabricator.services.mozilla.com/D35080
--HG--
extra : moz-landing-system : lando
Initializing OwningCompileOptions directly will soon be deprecated in
order to have consistent defaults. This results in more consistent
behavior of experimental features that are enabled based on realm flags.
Differential Revision: https://phabricator.services.mozilla.com/D35071
--HG--
extra : moz-landing-system : lando
Added isHelperThreadContext() to check that cx runs on a helper thread, similar to isMainThreadContext(). Replaced null-checks meant to look for helper threads with isHelperThreadContext(), leaving instances where helperthread() is checked in order to access the actual helper thread.
Differential Revision: https://phabricator.services.mozilla.com/D34937
--HG--
extra : moz-landing-system : lando
When I wrote my prior patch, I forgot that a DebuggerFrame object's
ONSTEP_HANDLER_SLOT holds, not a JavaScript object, but a private value pointing
to an OnStepHandler, which must be explicitly freed.
Differential Revision: https://phabricator.services.mozilla.com/D34978
--HG--
extra : moz-landing-system : lando
Check realm flags at when creating CompileOptions rather than during
compilation. This is helpful for pre-compiling self-hosting code.
Differential Revision: https://phabricator.services.mozilla.com/D34976
--HG--
extra : moz-landing-system : lando
This changes the format of the trace list from using -1 as a delimter to storing the list lengths up front so that we have length information.
Differential Revision: https://phabricator.services.mozilla.com/D34731
Note that we only track the for typed arrays that are not backed by an ArrayBuffer as the memory is tracked there from then on.
Differential Revision: https://phabricator.services.mozilla.com/D34729
I had to store the length as the first word of the bytecode. I also shuffled RegExpShared fields around to make the class a little smaller.
Differential Revision: https://phabricator.services.mozilla.com/D34726
Some kinds of memory use (e.g. reg exp byte code) require multiple memory associations for a single cell. This patch adds machinery to let that happen for specific uses.
Differential Revision: https://phabricator.services.mozilla.com/D34723
I wanted to make VectorMatchPairs use ZoneAllocPolicy but this is also used in a bunch of places where it's not attached to a GC thing, so I left this as a todo.
Differential Revision: https://phabricator.services.mozilla.com/D34556
Use memory tracking APIs to track malloc memory associated with NativeIterator objects. I had to store the initial propery count as propertiesEnd can change during the lifetime of this object.
Differential Revision: https://phabricator.services.mozilla.com/D34554
Patch to use std::move when passing AllocPolicy instances to constructors. This also fixes HashTable move constuction/assignment that previously PodAssigned the whole object including the AllocPolicy base.
Differential Revision: https://phabricator.services.mozilla.com/D36175
Nursery objects can have slots buffers in the nursery or in malloc memory; tenured objects always have their slots buffers in malloc memory. When a nursery object has a pointer to a malloced buffer it is present in the Nursery::mallocedBuffers set. The patch checks whether an object is tenured when freeing its slots buffer because if so this tells us that its buffer is malloced and can't be in the nursery's mallocedBuffers set.
This also gets rid of a call to Nursery::isInside() call (linear in the number of nursery chunks) when we know the object is tenured and hence can't reference nursery memory.
Differential Revision: https://phabricator.services.mozilla.com/D36211
The args count needs to be set before the LazyScript takes hold of the
functionbox, or else some code that references lazy functions can get the wrong
number of arguments (ie, CloneFunctionObjectIfNotSingleton on a lazy function)
Differential Revision: https://phabricator.services.mozilla.com/D34586
--HG--
extra : moz-landing-system : lando
In some cases, the nsIScriptError is initialized with zero innerWindowId, but is from chrome context.
For cases, this patch adds an optional aFromChromeContext parameter to nsIScriptError::InitWithWindowID, which default value is false.
Differential Revision: https://phabricator.services.mozilla.com/D34508
--HG--
extra : moz-landing-system : lando
IsMarkingTracer no-longer exists, so remove one comment that refers to it
and fix another comment.
Differential Revision: https://phabricator.services.mozilla.com/D34674
--HG--
extra : moz-landing-system : lando
Member variables `calledPrepareVMCall_` and `inStubFrame_` served the same purpose for their classes.
Unified them in CacheIRCompiler.
Differential Revision: https://phabricator.services.mozilla.com/D33526
--HG--
extra : moz-landing-system : lando
Base commit for bug 1467191. Moves declarations of BaselineCacheIRCompiler and IonCacheIRCompiler
into their respective header files.
Differential Revision: https://phabricator.services.mozilla.com/D33521
--HG--
extra : moz-landing-system : lando
Base commit for patch for bug 1467191 that fixes inconsistencies in
namespace use between BaselineCacheIRCompiler and IonCacheIRCompiler.
Differential Revision: https://phabricator.services.mozilla.com/D33516
--HG--
extra : moz-landing-system : lando
Since bug 1535137 the consts array only stores `BigIntValues` so we can change
it to a `BigInt` array. This will also make it easier to fix bug 1535154.
Differential Revision: https://phabricator.services.mozilla.com/D34712
--HG--
extra : moz-landing-system : lando
IsMarkingTracer no-longer exists, so remove one comment that refers to it
and fix another comment.
Differential Revision: https://phabricator.services.mozilla.com/D34674
--HG--
extra : moz-landing-system : lando
We've been relying on frame pointers being indirectly enabled via things
like --enable-profiling for some time, but this doesn't scale because
some things may want frame pointers while wanting --disable-profiling.
So we move MOZ_FRAMEPTR_FLAGS to python configure and add a new option
to decide whether to enable frame pointers or not.
Differential Revision: https://phabricator.services.mozilla.com/D34117
--HG--
extra : moz-landing-system : lando
Use memory tracking APIs to track malloc memory associated with module IndirectBindingMap. These are attached to ModuleObjects and ModuleNamespaceObjects.
Differential Revision: https://phabricator.services.mozilla.com/D34551
Use memory tracking APIs to track malloc memory associated with Shapes. I had to thread FreeOp and BaseShape through in various places so there's enough context.
Differential Revision: https://phabricator.services.mozilla.com/D34377
Use memory tracking APIs to track malloc memory associated with the different ctypes objects.
I ended up creating new public APIs because ctypes currently mostly uses our public APIs, but I actaully don't know why. I don't think it can be built standalone. Maybe this should use the internal APIs instead.
Differential Revision: https://phabricator.services.mozilla.com/D34375
Previously I rolled the malloc byte count into a total byte count for each zone but this may adversely affect GC scheduling (e.g. by triggering more non-incremental GCs because allocation volumes appear higher with this change). So that we can land this machinery without disturbing benchmarks too much, this patch splits out the new malloc memory accounting into a separate counter and uses the maxMallocBytes setting as the threshold (default value is 128MB vs 30MB for the GC heap threshold) and a growth factor of 2. This should make the behaviour closer to the original behaviour for now. We can go back and adjust the parameters later to obtain the desired behaviour.
Differential Revision: https://phabricator.services.mozilla.com/D34181
The change to split out ZoneAllocator messed up the MemoryTracker code that prints out what failed to be removed by making it run after the Zone destructor which will already assert in the case (but without printing useful information first).
Differential Revision: https://phabricator.services.mozilla.com/D33974
Our ultimate goal in this bug is to include information about yields and awaits
in the completion value passed to the `onPop` handler. This means that detecting
when a frame is being suspended becomes just another step in building a
completion value. That change becomes a little clearer if those two steps happen
next to each other.
Differential Revision: https://phabricator.services.mozilla.com/D24996
--HG--
extra : moz-landing-system : lando
When a Debugger.Frame refers to a generator/async call, the generator's script
must be marked as a debuggee, so that if the call is resumed, the
JSOP_AFTERYIELD bytecode is compiled to the instrumentation that re-associates
the extant Debugger.Frame with the new concrete frame.
This extends DebugScript with a new field `generatorObserverCount`, akin to
`stepperCount`, which tracks the number of Debugger.Frames referring to the
script if it is a generator script. This count is adjusted when the
`GeneratorInfo` structure is attached to a `DebuggerFrame`, cleared, and
finalized.
Differential Revision: https://phabricator.services.mozilla.com/D32394
--HG--
extra : moz-landing-system : lando
The new export Pattern.OBJECT_WITH_EXACTLY is like the ordinary Pattern
constructor, but also fails to match if the actual value has any extra
properties.
The default behavior of object matching (to ignore additional properties) is
left unchanged, since there are too many extant tests that rely on this behavior
to be worth fixing.
Differential Revision: https://phabricator.services.mozilla.com/D32880
--HG--
extra : moz-landing-system : lando
A Debugger.Frame for a generator or async call continues to refer to the same
call across suspensions (awaits and yields). This means that, even as the
underlying concrete frames (InterpreterFrame, BaselineFrame) come and go, the
Debugger.Frame retains its relationship with a particular
AbstractGeneratorObject. When that generator is resumed, the Debugger.Frame
acquires the new concrete frame as its new referent.
Normally, when a stack frame is popped, if it had a Debugger.Frame with an
onStep handler, we decrement the frame's script's stepper count, since that
Debugger.Frame's onStep handler is obviously not going to fire any more; the
frame is dead. But in the case of a generator or async frame, the generator call
may be resumed at some point, so for such frames, we leave the script's stepper
count incremented until the generator call returns, throws, or otherwise exits
permanently.
This means that if a Debugger.Frame and its AbstractGeneratorObject are GC'd, we
must decrement the generator's script's stepper count. Of course, the script
itself may also be being GC'd, in which case we need not do anything.
This patch makes DebuggerFrame::clearGenerator solely responsible for dropping
the stepper count on generator frames. Since DebuggerFrame::finalize already
clears the frame's generator, this takes care of the stepper count automatically.
Differential Revision: https://phabricator.services.mozilla.com/D32273
--HG--
extra : moz-landing-system : lando
In later patches in the series, DebuggerFrame needs to be able to access a
generator's script even when the generator object itself is being finalized, so
it's simpler to just hold a reference to it directly.
Differential Revision: https://phabricator.services.mozilla.com/D32272
--HG--
extra : moz-landing-system : lando
Since GetGeneratorObjectForFrame is a bit involved (it looks up the identifier
'.generator' on the scope chain) and not entirely reliable (it returns nullptr
between the GENERATOR and SETALIASEDVAR .generator opcodes), it's better to
simply fetch the generator from the DebuggerFrame, when one is available.
Since a DebuggerFrame has a generator exactly when there is an entry in
generatorFrames going the other direction, from generator to DebuggerFrame, this
means that Debugger::removeFromFrameMapsAndClearBreakpointsIn can actually do
its job reliably, which lets us remove certain kinky conditions in The Famous
Step Count Assertion of 1874.
In other cases, GetGeneratorObjectForFrame is the only option, and its flakiness
doesn't matter; document those a bit better.
Differential Revision: https://phabricator.services.mozilla.com/D32271
--HG--
extra : moz-landing-system : lando
The profiler will require non-fuzzed timers for accuracy. Making the switch early will avoid surprises when FuzzyFox is enabled.
Differential Revision: https://phabricator.services.mozilla.com/D31010
--HG--
extra : moz-landing-system : lando
IsCanonical was only used in StructuredCloneReader::CheckDouble. Two of CheckDouble's three uses already canonicalized the double before checking it, and the third *should* have already done so.
Differential Revision: https://phabricator.services.mozilla.com/D29870
--HG--
extra : moz-landing-system : lando