Bug 895177 - Inline object tracing for minor GC; r=jandem

--HG--
extra : rebase_source : 00086cacce4575d04595ca646777c8ce7403a06e

js/src/gc/Nursery.cpp

@@ -339,6 +339,66 @@ js::Nursery::forwardBufferPointer(HeapSlot **pSlotsElems)
     JS_ASSERT(!isInside(*pSlotsElems));
 }
 
+void
+js::Nursery::collectToFixedPoint(MinorCollectionTracer *trc)
+{
+    for (RelocationOverlay *p = trc->head; p; p = p->next()) {
+        JSObject *obj = static_cast<JSObject*>(p->forwardingAddress());
+        traceObject(trc, obj);
+    }
+}
+
+JS_ALWAYS_INLINE void
+js::Nursery::traceObject(MinorCollectionTracer *trc, JSObject *obj)
+{
+    Class *clasp = obj->getClass();
+    if (clasp->trace)
+        clasp->trace(trc, obj);
+
+    if (!obj->isNative())
+        return;
+
+    if (!obj->hasEmptyElements())
+        markSlots(trc, obj->getDenseElements(), obj->getDenseInitializedLength());
+
+    HeapSlot *fixedStart, *fixedEnd, *dynStart, *dynEnd;
+    obj->getSlotRange(0, obj->slotSpan(), &fixedStart, &fixedEnd, &dynStart, &dynEnd);
+    markSlots(trc, fixedStart, fixedEnd);
+    markSlots(trc, dynStart, dynEnd);
+}
+
+JS_ALWAYS_INLINE void
+js::Nursery::markSlots(MinorCollectionTracer *trc, HeapSlot *vp, uint32_t nslots)
+{
+    markSlots(trc, vp, vp + nslots);
+}
+
+JS_ALWAYS_INLINE void
+js::Nursery::markSlots(MinorCollectionTracer *trc, HeapSlot *vp, HeapSlot *end)
+{
+    for (; vp != end; ++vp)
+        markSlot(trc, vp);
+}
+
+JS_ALWAYS_INLINE void
+js::Nursery::markSlot(MinorCollectionTracer *trc, HeapSlot *slotp)
+{
+    if (!slotp->isObject())
+        return;
+
+    JSObject *obj = &slotp->toObject();
+    if (!isInside(obj))
+        return;
+
+    if (getForwardedPointer(&obj)) {
+        slotp->unsafeGet()->setObject(*obj);
+        return;
+    }
+
+    JSObject *tenured = static_cast<JSObject*>(moveToTenured(trc, obj));
+    slotp->unsafeGet()->setObject(*tenured);
+}
+
 void *
 js::Nursery::moveToTenured(MinorCollectionTracer *trc, JSObject *src)
 {
@@ -591,10 +651,7 @@ js::Nursery::collect(JSRuntime *rt, JS::gcreason::Reason reason)
      * to the nursery, then those nursery objects get moved as well, until no
      * objects are left to move. That is, we iterate to a fixed point.
      */
-    for (RelocationOverlay *p = trc.head; p; p = p->next()) {
-        JSObject *obj = static_cast<JSObject*>(p->forwardingAddress());
-        JS_TraceChildren(&trc, obj, MapAllocToTraceKind(obj->tenuredGetAllocKind()));
-    }
+    collectToFixedPoint(&trc);
 
     /* Resize the nursery. */
     double promotionRate = trc.tenuredSize / double(allocationEnd() - start());

js/src/gc/Nursery.h

@@ -206,6 +206,11 @@ class Nursery
      * Move the object at |src| in the Nursery to an already-allocated cell
      * |dst| in Tenured.
      */
+    void collectToFixedPoint(gc::MinorCollectionTracer *trc);
+    JS_ALWAYS_INLINE void traceObject(gc::MinorCollectionTracer *trc, JSObject *src);
+    JS_ALWAYS_INLINE void markSlots(gc::MinorCollectionTracer *trc, HeapSlot *vp, uint32_t nslots);
+    JS_ALWAYS_INLINE void markSlots(gc::MinorCollectionTracer *trc, HeapSlot *vp, HeapSlot *end);
+    JS_ALWAYS_INLINE void markSlot(gc::MinorCollectionTracer *trc, HeapSlot *slotp);
     void *moveToTenured(gc::MinorCollectionTracer *trc, JSObject *src);
     size_t moveObjectToTenured(JSObject *dst, JSObject *src, gc::AllocKind dstKind);
     size_t moveElementsToTenured(JSObject *dst, JSObject *src, gc::AllocKind dstKind);

js/src/vm/ObjectImpl.h

@@ -1305,6 +1305,8 @@ class ObjectImpl : public gc::Cell
     bool toDictionaryMode(ExclusiveContext *cx);
 
   private:
+    friend class Nursery;
+
     /*
      * Get internal pointers to the range of values starting at start and
      * running for length.