Bug 827396 - rm TypeObject::CONTRIBUTION_LIMIT and TypeObject::contribution. r=bhackett
authorTill Schneidereit <till@tillschneidereit.net>
Tue, 16 Jul 2013 20:42:44 +0200
changeset 138744 e1536ff0cb92585361c3f8f26b64e2dcdcfe77ba
parent 138743 7f177c80f3b977a2a6941446685519557f4ad8d8
child 138745 eb9dcbb4b46d860fbabb775bbd54b54584bcf120
push idunknown
push userunknown
push dateunknown
reviewersbhackett
bugs827396
milestone25.0a1
Bug 827396 - rm TypeObject::CONTRIBUTION_LIMIT and TypeObject::contribution. r=bhackett
js/src/jsinfer.cpp
js/src/jsinfer.h
js/src/jsinferinlines.h
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -6283,22 +6283,16 @@ TypeObject::clearProperties()
  * compartment to fixup weak references: property type sets referencing dead
  * JS and type objects, and singleton JS objects whose type is not referenced
  * elsewhere. This also releases memory associated with dead type objects,
  * so that type objects do not need later finalization.
  */
 inline void
 TypeObject::sweep(FreeOp *fop)
 {
-    /*
-     * We may be regenerating existing type sets containing this object,
-     * so reset contributions on each GC to avoid tripping the limit.
-     */
-    contribution = 0;
-
     if (singleton) {
         JS_ASSERT(!newScript);
 
         /*
          * All properties can be discarded. We will regenerate them as needed
          * as code gets reanalyzed.
          */
         clearProperties();
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -282,17 +282,17 @@ enum {
     TYPE_FLAG_LAZYARGS  = 0x40,
     TYPE_FLAG_ANYOBJECT = 0x80,
 
     /* Mask containing all primitives */
     TYPE_FLAG_PRIMITIVE = TYPE_FLAG_UNDEFINED | TYPE_FLAG_NULL | TYPE_FLAG_BOOLEAN |
                           TYPE_FLAG_INT32 | TYPE_FLAG_DOUBLE | TYPE_FLAG_STRING,
 
     /* Mask/shift for the number of objects in objectSet */
-    TYPE_FLAG_OBJECT_COUNT_MASK   = 0xff00,
+    TYPE_FLAG_OBJECT_COUNT_MASK   = 0x1f00,
     TYPE_FLAG_OBJECT_COUNT_SHIFT  = 8,
     TYPE_FLAG_OBJECT_COUNT_LIMIT  =
         TYPE_FLAG_OBJECT_COUNT_MASK >> TYPE_FLAG_OBJECT_COUNT_SHIFT,
 
     /* Whether the contents of this type set are totally unknown. */
     TYPE_FLAG_UNKNOWN             = 0x00010000,
 
     /* Mask of normal type flags on a type set. */
@@ -967,30 +967,16 @@ struct TypeObject : gc::Cell
     bool lazy() const { return singleton == (JSObject *) LAZY_SINGLETON; }
 
     /* Flags for this object. */
     TypeObjectFlags flags;
 
     static inline size_t offsetOfFlags() { return offsetof(TypeObject, flags); }
 
     /*
-     * Estimate of the contribution of this object to the type sets it appears in.
-     * This is the sum of the sizes of those sets at the point when the object
-     * was added.
-     *
-     * When the contribution exceeds the CONTRIBUTION_LIMIT, any type sets the
-     * object is added to are instead marked as unknown. If we get to this point
-     * we are probably not adding types which will let us do meaningful optimization
-     * later, and we want to ensure in such cases that our time/space complexity
-     * is linear, not worst-case cubic as it would otherwise be.
-     */
-    uint32_t contribution;
-    static const uint32_t CONTRIBUTION_LIMIT = 2000;
-
-    /*
      * If non-NULL, objects of this type have always been constructed using
      * 'new' on the specified script, which adds some number of properties to
      * the object in a definite order before the object escapes.
      */
     HeapPtr<TypeNewScript> newScript;
 
     /*
      * Properties of this object. This may contain JSID_VOID, representing the
@@ -1022,16 +1008,20 @@ struct TypeObject : gc::Cell
      * defineProperty which are on native properties, and by using the inference
      * analysis to determine the side effects of code which is JIT-compiled.
      */
     Property **propertySet;
 
     /* If this is an interpreted function, the function object. */
     HeapPtrFunction interpretedFunction;
 
+#if JS_BITS_PER_WORD == 32
+    uint32_t padding;
+#endif
+
     inline TypeObject(Class *clasp, TaggedProto proto, bool isFunction, bool unknown);
 
     bool isFunction() { return !!(flags & OBJECT_FLAG_FUNCTION); }
 
     bool hasAnyFlags(TypeObjectFlags flags) {
         JS_ASSERT((flags & OBJECT_FLAG_DYNAMIC_MASK) == flags);
         return !!(this->flags & flags);
     }
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -1360,24 +1360,16 @@ TypeSet::addType(JSContext *cx, Type typ
         if (objectCount == TYPE_FLAG_OBJECT_COUNT_LIMIT)
             goto unknownObject;
 
         if (type.isTypeObject()) {
             TypeObject *nobject = type.typeObject();
             JS_ASSERT(!nobject->singleton);
             if (nobject->unknownProperties())
                 goto unknownObject;
-            if (objectCount > 1) {
-                nobject->contribution += (objectCount - 1) * (objectCount - 1);
-                if (nobject->contribution >= TypeObject::CONTRIBUTION_LIMIT) {
-                    InferSpew(ISpewOps, "limitUnknown: %sT%p%s",
-                              InferSpewColor(this), this, InferSpewColorReset());
-                    goto unknownObject;
-                }
-            }
         }
     }
 
     if (false) {
     unknownObject:
         type = Type::AnyObjectType();
         flags |= TYPE_FLAG_ANYOBJECT;
         clearObjects();