Bug 1479603 - [Part 8] Remove Ion Fallback stub space r=jandem
authorMatthew Gaudet <mgaudet@mozilla.com>
Mon, 20 Aug 2018 11:02:43 -0400
changeset 831136 c594e6a343778c1c0fb27466b5554ca788c97252
parent 831135 652d157c6c62c1b24ffd3db5f08d04c3393e2b4c
child 831137 b733b2488363f3f2bdd6e14cc9df1694f7f8ae3a
push id118868
push userbmo:zjz@zjz.name
push dateFri, 24 Aug 2018 07:04:39 +0000
reviewersjandem
bugs1479603
milestone63.0a1
Bug 1479603 - [Part 8] Remove Ion Fallback stub space r=jandem
js/src/jit/CodeGenerator.cpp
js/src/jit/Ion.cpp
js/src/jit/IonCode.h
js/src/jit/SharedIC.h
js/src/jit/shared/CodeGenerator-shared.cpp
js/src/jit/shared/CodeGenerator-shared.h
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -10458,19 +10458,16 @@ CodeGenerator::link(JSContext* cx, Compi
 
     // If the Gecko Profiler is enabled, mark IonScript as having been
     // instrumented accordingly.
     if (isProfilerInstrumentationEnabled())
         ionScript->setHasProfilingInstrumentation();
 
     script->setIonScript(cx->runtime(), ionScript);
 
-    // Adopt fallback shared stubs from the compiler into the ion script.
-    ionScript->adoptFallbackStubs(&stubSpace_);
-
     Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, invalidateEpilogueData_),
                                        ImmPtr(ionScript),
                                        ImmPtr((void*)-1));
 
     for (size_t i = 0; i < ionScriptLabels_.length(); i++) {
         Assembler::PatchDataWithValueCheck(CodeLocationLabel(code, ionScriptLabels_[i]),
                                            ImmPtr(ionScript),
                                            ImmPtr((void*)-1));
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -828,18 +828,17 @@ IonScript::IonScript(IonCompilationId co
     snapshotsRVATableSize_(0),
     recovers_(0),
     recoversSize_(0),
     constantTable_(0),
     constantEntries_(0),
     invalidationCount_(0),
     compilationId_(compilationId),
     optimizationLevel_(OptimizationLevel::Normal),
-    osrPcMismatchCounter_(0),
-    fallbackStubSpace_()
+    osrPcMismatchCounter_(0)
 {
 }
 
 IonScript*
 IonScript::New(JSContext* cx, IonCompilationId compilationId,
                uint32_t frameSlots, uint32_t argumentSlots, uint32_t frameSize,
                size_t snapshotsListSize, size_t snapshotsRVATableSize,
                size_t recoversSize, size_t bailoutEntries,
@@ -929,23 +928,16 @@ IonScript::New(JSContext* cx, IonCompila
     script->frameSize_ = frameSize;
 
     script->optimizationLevel_ = optimizationLevel;
 
     return script;
 }
 
 void
-IonScript::adoptFallbackStubs(FallbackICStubSpace* stubSpace)
-
-{
-    fallbackStubSpace()->adoptFrom(stubSpace);
-}
-
-void
 IonScript::trace(JSTracer* trc)
 {
     if (method_)
         TraceEdge(trc, &method_, "method");
 
     for (size_t i = 0; i < numConstants(); i++)
         TraceEdge(trc, &getConstant(i), "constant");
 
@@ -1112,26 +1104,16 @@ IonScript::Trace(JSTracer* trc, IonScrip
 {
     if (script != ION_DISABLED_SCRIPT)
         script->trace(trc);
 }
 
 void
 IonScript::Destroy(FreeOp* fop, IonScript* script)
 {
-    /*
-     * When the script contains pointers to nursery things, the store buffer can
-     * contain entries that point into the fallback stub space. Since we can
-     * destroy scripts outside the context of a GC, this situation could result
-     * in us trying to mark invalid store buffer entries.
-     *
-     * Defer freeing any allocated blocks until after the next minor GC.
-     */
-    script->fallbackStubSpace_.freeAllAfterMinorGC(script->method()->zone());
-
     fop->delete_(script);
 }
 
 void
 JS::DeletePolicy<js::jit::IonScript>::operator()(const js::jit::IonScript* script)
 {
     IonScript::Destroy(rt_->defaultFreeOp(), const_cast<IonScript*>(script));
 }
--- a/js/src/jit/IonCode.h
+++ b/js/src/jit/IonCode.h
@@ -265,19 +265,16 @@ struct IonScript
 
     // The optimization level this script was compiled in.
     OptimizationLevel optimizationLevel_;
 
     // Number of times we tried to enter this script via OSR but failed due to
     // a LOOPENTRY pc other than osrPc_.
     uint32_t osrPcMismatchCounter_;
 
-    // Allocated space for fallback stubs.
-    FallbackICStubSpace fallbackStubSpace_;
-
     // TraceLogger events that are baked into the IonScript.
     TraceLoggerEventVector traceLoggerEvents_;
 
   private:
     inline uint8_t* bottomBuffer() {
         return reinterpret_cast<uint8_t*>(this);
     }
     inline const uint8_t* bottomBuffer() const {
@@ -313,22 +310,16 @@ struct IonScript
 
   private:
     void trace(JSTracer* trc);
 
   public:
     // Do not call directly, use IonScript::New. This is public for cx->new_.
     explicit IonScript(IonCompilationId compilationId);
 
-    ~IonScript() {
-        // The contents of the fallback stub space are removed and freed
-        // separately after the next minor GC. See IonScript::Destroy.
-        MOZ_ASSERT(fallbackStubSpace_.isEmpty());
-    }
-
     static IonScript* New(JSContext* cx, IonCompilationId compilationId,
                           uint32_t frameSlots, uint32_t argumentSlots, uint32_t frameSize,
                           size_t snapshotsListSize, size_t snapshotsRVATableSize,
                           size_t recoversSize, size_t bailoutEntries,
                           size_t constants, size_t safepointIndexEntries,
                           size_t osiIndexEntries, size_t icEntries,
                           size_t runtimeSize, size_t safepointsSize,
                           OptimizationLevel optimizationLevel);
@@ -539,21 +530,16 @@ struct IonScript
     bool isRecompiling() const {
         return recompiling_;
     }
 
     void clearRecompiling() {
         recompiling_ = false;
     }
 
-    FallbackICStubSpace* fallbackStubSpace() {
-        return &fallbackStubSpace_;
-    }
-    void adoptFallbackStubs(FallbackICStubSpace* stubSpace);
-
     enum ShouldIncreaseAge {
         IncreaseAge = true,
         KeepAge = false
     };
 
     static void writeBarrierPre(Zone* zone, IonScript* ionScript);
 };
 
--- a/js/src/jit/SharedIC.h
+++ b/js/src/jit/SharedIC.h
@@ -1098,19 +1098,18 @@ class ICStubCompiler
         return ICStub::New<T>(cx, std::forward<Args>(args)...);
     }
 
   public:
     virtual ICStub* getStub(ICStubSpace* space) = 0;
 
     static ICStubSpace* StubSpaceForStub(bool makesGCCalls, JSScript* outerScript, Engine engine) {
         if (makesGCCalls) {
-            if (engine == ICStubCompiler::Engine::Baseline)
-                return outerScript->baselineScript()->fallbackStubSpace();
-            return outerScript->ionScript()->fallbackStubSpace();
+            MOZ_ASSERT(engine == ICStubCompiler::Engine::Baseline);
+            return outerScript->baselineScript()->fallbackStubSpace();
         }
         return outerScript->zone()->jitZone()->optimizedStubSpace();
     }
     ICStubSpace* getStubSpace(JSScript* outerScript) {
         return StubSpaceForStub(ICStub::NonCacheIRStubMakesGCCalls(kind), outerScript, engine_);
     }
 };
 
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -53,17 +53,16 @@ CodeGeneratorShared::CodeGeneratorShared
     recovers_(),
     deoptTable_(),
 #ifdef DEBUG
     pushedArgs_(0),
 #endif
     lastOsiPointOffset_(0),
     safepoints_(graph->totalSlotCount(), (gen->info().nargs() + 1) * sizeof(Value)),
     returnLabel_(),
-    stubSpace_(),
     nativeToBytecodeMap_(nullptr),
     nativeToBytecodeMapSize_(0),
     nativeToBytecodeTableOffset_(0),
     nativeToBytecodeNumRegions_(0),
     nativeToBytecodeScriptList_(nullptr),
     nativeToBytecodeScriptListLength_(0),
     trackedOptimizationsMap_(nullptr),
     trackedOptimizationsMapSize_(0),
--- a/js/src/jit/shared/CodeGenerator-shared.h
+++ b/js/src/jit/shared/CodeGenerator-shared.h
@@ -63,18 +63,16 @@ class CodeGeneratorShared : public LElem
     uint32_t lastOsiPointOffset_;
     SafepointWriter safepoints_;
     Label invalidate_;
     CodeOffset invalidateEpilogueData_;
 
     // Label for the common return path.
     NonAssertingLabel returnLabel_;
 
-    FallbackICStubSpace stubSpace_;
-
     js::Vector<SafepointIndex, 0, SystemAllocPolicy> safepointIndices_;
     js::Vector<OsiIndex, 0, SystemAllocPolicy> osiIndices_;
 
     // Mapping from bailout table ID to an offset in the snapshot buffer.
     js::Vector<SnapshotOffset, 0, SystemAllocPolicy> bailouts_;
 
     // Allocated data space needed at runtime.
     js::Vector<uint8_t, 0, SystemAllocPolicy> runtimeData_;