Bug 1622969 - Improve assertions about when compacting GC can update pointers on background threads r=sfink
authorJon Coppeard <jcoppeard@mozilla.com>
Tue, 24 Mar 2020 14:42:20 +0000
changeset 520252 260943877d936455d836d5e1c967365bccc7ece2
parent 520251 1a5a1a5858ae395278ef0ea6b69324fd0eb8a690
child 520253 5792d602f984aa75939eac8f73ae06babb19b312
push id37246
push useropoprus@mozilla.com
push dateWed, 25 Mar 2020 03:40:33 +0000
treeherdermozilla-central@14b59d4adc95 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs1622969
milestone76.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1622969 - Improve assertions about when compacting GC can update pointers on background threads r=sfink Not a fix for the issue, just a diagnostic patch. Differential Revision: https://phabricator.services.mozilla.com/D68022
js/src/gc/GC.cpp
--- a/js/src/gc/GC.cpp
+++ b/js/src/gc/GC.cpp
@@ -2177,22 +2177,34 @@ static inline void UpdateCellPointers(Mo
 
 template <typename T>
 static void UpdateArenaPointersTyped(MovingTracer* trc, Arena* arena) {
   for (ArenaCellIterUnderGC i(arena); !i.done(); i.next()) {
     UpdateCellPointers(trc, reinterpret_cast<T*>(i.getCell()));
   }
 }
 
+static bool CanUpdateKindInBackground(AllocKind kind) {
+  // We try to update as many GC things in parallel as we can, but there are
+  // kinds for which this might not be safe:
+  //  - we assume JSObjects that are foreground finalized are not safe to
+  //    update in parallel
+  //  - updating a shape touches child shapes in fixupShapeTreeAfterMovingGC()
+  return js::gc::IsBackgroundFinalized(kind) && !IsShapeAllocKind(kind);
+}
+
 /*
  * Update the internal pointers for all cells in an arena.
  */
 static void UpdateArenaPointers(MovingTracer* trc, Arena* arena) {
   AllocKind kind = arena->getAllocKind();
 
+  MOZ_ASSERT_IF(!CanUpdateKindInBackground(kind),
+                CurrentThreadCanAccessRuntime(trc->runtime()));
+
   switch (kind) {
 #define EXPAND_CASE(allocKind, traceKind, type, sizedType, bgFinal, nursery, \
                     compact)                                                 \
   case AllocKind::allocKind:                                                 \
     UpdateArenaPointersTyped<type>(trc, arena);                              \
     return;
     FOR_EACH_ALLOCKIND(EXPAND_CASE)
 #undef EXPAND_CASE
@@ -2305,29 +2317,16 @@ void ArenasToUpdate::next() {
     findSegmentEnd();
     return;
   }
 
   kind = nextAllocKind(kind);
   settle();
 }
 
-static bool CanUpdateKindInBackground(AllocKind kind) {
-  // We try to update as many GC things in parallel as we can, but there are
-  // kinds for which this might not be safe:
-  //  - we assume JSObjects that are foreground finalized are not safe to
-  //    update in parallel
-  //  - updating a shape touches child shapes in fixupShapeTreeAfterMovingGC()
-  if (!js::gc::IsBackgroundFinalized(kind) || IsShapeAllocKind(kind)) {
-    return false;
-  }
-
-  return true;
-}
-
 static AllocKinds ForegroundUpdateKinds(AllocKinds kinds) {
   AllocKinds result;
   for (AllocKind kind : kinds) {
     if (!CanUpdateKindInBackground(kind)) {
       result += kind;
     }
   }
   return result;