Bug 1521127 - Part 2: Remove more preliminary objects tracking for array objects. r=jandem
☠☠ backed out by 1f92e62a285c ☠ ☠
authorAndré Bargull <andre.bargull@gmail.com>
Tue, 22 Jan 2019 05:02:45 -0800
changeset 515089 232668044fbfc003f8ab57e80f0acddda67b2f31
parent 515088 6ac126ad6e18cdc00fc6b0b15a1242c1028a135f
child 515090 10f6f2e55f095b42b71617da52b1c99245dbfb75
push id1953
push userffxbld-merge
push dateMon, 11 Mar 2019 12:10:20 +0000
treeherdermozilla-release@9c35dcbaa899 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1521127
milestone66.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1521127 - Part 2: Remove more preliminary objects tracking for array objects. r=jandem
js/src/jit/BaselineIC.cpp
js/src/jit/CacheIR.cpp
js/src/jit/MCallOptimize.cpp
js/src/vm/Interpreter.cpp
js/src/vm/UnboxedObject.cpp
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -3289,18 +3289,17 @@ static bool TryAttachFunCallStub(JSConte
     return true;
   }
 
   return true;
 }
 
 static bool GetTemplateObjectForNative(JSContext* cx, HandleFunction target,
                                        const CallArgs& args,
-                                       MutableHandleObject res,
-                                       bool* skipAttach) {
+                                       MutableHandleObject res) {
   Native native = target->native();
 
   // Check for natives to which template objects can be attached. This is
   // done to provide templates to Ion for inlining these natives later on.
 
   if (native == ArrayConstructor || native == array_construct) {
     // Note: the template array won't be used if its length is inaccurately
     // computed here.  (We allocate here because compilation may occur on a
@@ -3309,26 +3308,16 @@ static bool GetTemplateObjectForNative(J
     if (args.length() != 1) {
       count = args.length();
     } else if (args.length() == 1 && args[0].isInt32() &&
                args[0].toInt32() >= 0) {
       count = args[0].toInt32();
     }
 
     if (count <= ArrayObject::EagerAllocationMaxLength) {
-      ObjectGroup* group =
-          ObjectGroup::callingAllocationSiteGroup(cx, JSProto_Array);
-      if (!group) {
-        return false;
-      }
-      if (group->maybePreliminaryObjectsDontCheckGeneration()) {
-        *skipAttach = true;
-        return true;
-      }
-
       // With this and other array templates, analyze the group so that
       // we don't end up with a template whose structure might change later.
       res.set(NewFullyAllocatedArrayForCallingAllocationSite(cx, count,
                                                              TenuredObject));
       return !!res;
     }
   }
 
@@ -3346,20 +3335,16 @@ static bool GetTemplateObjectForNative(J
       return true;
     }
   }
 
   if (native == js::array_slice) {
     if (args.thisv().isObject()) {
       RootedObject obj(cx, &args.thisv().toObject());
       if (!obj->isSingleton()) {
-        if (obj->group()->maybePreliminaryObjectsDontCheckGeneration()) {
-          *skipAttach = true;
-          return true;
-        }
         res.set(NewFullyAllocatedArrayTryReuseGroup(cx, obj, 0, TenuredObject));
         return !!res;
       }
     }
   }
 
   if (native == StringConstructor) {
     RootedString emptyString(cx, cx->runtime()->emptyString);
@@ -3689,26 +3674,20 @@ static bool TryAttachCallStub(JSContext*
               "  Megamorphic Call_Native stubs. TODO: add Call_AnyNative!");
       return true;
     }
 
     bool isCrossRealm = cx->realm() != fun->realm();
 
     RootedObject templateObject(cx);
     if (MOZ_LIKELY(!isSpread && !isSuper && !isCrossRealm)) {
-      bool skipAttach = false;
       CallArgs args = CallArgsFromVp(argc, vp);
-      if (!GetTemplateObjectForNative(cx, fun, args, &templateObject,
-                                      &skipAttach)) {
+      if (!GetTemplateObjectForNative(cx, fun, args, &templateObject)) {
         return false;
       }
-      if (skipAttach) {
-        *handled = true;
-        return true;
-      }
       MOZ_ASSERT_IF(templateObject,
                     !templateObject->group()
                          ->maybePreliminaryObjectsDontCheckGeneration());
     }
 
     bool ignoresReturnValue =
         op == JSOP_CALL_IGNORES_RV && fun->isNative() && fun->hasJitInfo() &&
         fun->jitInfo()->type() == JSJitInfo::IgnoresReturnValueNative;
@@ -6067,18 +6046,17 @@ static bool DoNewArray(JSContext* cx, Ba
     RootedScript script(cx, frame->script());
     jsbytecode* pc = stub->icEntry()->pc(script);
 
     obj = NewArrayOperation(cx, script, pc, length);
     if (!obj) {
       return false;
     }
 
-    if (!obj->isSingleton() &&
-        !obj->group()->maybePreliminaryObjectsDontCheckGeneration()) {
+    if (!obj->isSingleton()) {
       JSObject* templateObject =
           NewArrayOperation(cx, script, pc, length, TenuredObject);
       if (!templateObject) {
         return false;
       }
       stub->setTemplateObject(templateObject);
     }
   }
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -4976,22 +4976,16 @@ bool CallIRGenerator::tryAttachArrayPush
   }
 
   if (thisobj->hasLazyGroup()) {
     return false;
   }
 
   RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
 
-  // And the object group for the array is not collecting preliminary objects.
-  AutoSweepObjectGroup sweep(thisobj->group());
-  if (thisobj->group()->maybePreliminaryObjects(sweep)) {
-    return false;
-  }
-
   // Check for other indexed properties or class hooks.
   if (!CanAttachAddElement(thisarray, /* isInit = */ false)) {
     return false;
   }
 
   // Can't add new elements to arrays with non-writable length.
   if (!thisarray->lengthIsWritable()) {
     return false;
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1836,20 +1836,16 @@ IonBuilder::InliningResult IonBuilder::i
     return resultConstStringSplit;
   }
 
   JSContext* cx = TlsContext.get();
   ObjectGroup* group = ObjectGroupRealm::getStringSplitStringGroup(cx);
   if (!group) {
     return InliningStatus_NotInlined;
   }
-  AutoSweepObjectGroup sweep(group);
-  if (group->maybePreliminaryObjects(sweep)) {
-    return InliningStatus_NotInlined;
-  }
 
   TypeSet::ObjectKey* retKey = TypeSet::ObjectKey::get(group);
   if (retKey->unknownProperties()) {
     return InliningStatus_NotInlined;
   }
 
   HeapTypeSetKey key = retKey->property(JSID_VOID);
   if (!key.maybeTypes()) {
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -5228,23 +5228,19 @@ JSObject* js::NewArrayOperation(JSContex
   RootedObjectGroup group(cx);
   if (ObjectGroup::useSingletonForAllocationSite(script, pc, JSProto_Array)) {
     newKind = SingletonObject;
   } else {
     group = ObjectGroup::allocationSiteGroup(cx, script, pc, JSProto_Array);
     if (!group) {
       return nullptr;
     }
+
     AutoSweepObjectGroup sweep(group);
-    if (group->maybePreliminaryObjects(sweep)) {
-      group->maybePreliminaryObjects(sweep)->maybeAnalyze(cx, group);
-    }
-
-    if (group->shouldPreTenure(sweep) ||
-        group->maybePreliminaryObjects(sweep)) {
+    if (group->shouldPreTenure(sweep)) {
       newKind = TenuredObject;
     }
   }
 
   ArrayObject* obj = NewDenseFullyAllocatedArray(cx, length, nullptr, newKind);
   if (!obj) {
     return nullptr;
   }
--- a/js/src/vm/UnboxedObject.cpp
+++ b/js/src/vm/UnboxedObject.cpp
@@ -1457,19 +1457,17 @@ bool js::TryConvertToUnboxedLayout(JSCon
                                       properties)) {
       return true;
     }
   }
 
   size_t layoutSize = 0;
   if (objectCount <= 1) {
     // If only one of the objects has been created, it is more likely
-    // to have new properties added later. This heuristic is not used
-    // for array objects, where we might want an unboxed representation
-    // even if there is only one large array.
+    // to have new properties added later.
     return true;
   }
 
   for (size_t i = 0; i < templateShape->slotSpan(); i++) {
     // We can't use an unboxed representation if e.g. all the objects have
     // a null value for one of the properties, as we can't decide what type
     // it is supposed to have.
     if (UnboxedTypeSize(properties[i].type) == 0) {