1 files changed, 55 insertions, 32 deletions

diff --git a/js/src/gc/Tenuring.h b/js/src/gc/Tenuring.h
index 3eca5f4bc3..8bb9efd4f8 100644
--- a/js/src/gc/Tenuring.h
+++ b/js/src/gc/Tenuring.h
@@ -26,6 +26,8 @@ class AnyRef;
 
 namespace gc {
 
+class AllocSite;
+class ArenaCellSet;
 class RelocationOverlay;
 class StringRelocationOverlay;
 
@@ -39,10 +41,10 @@ struct DeduplicationStringHasher {
 class TenuringTracer final : public JSTracer {
   Nursery& nursery_;
 
-  // Amount of data moved to the tenured generation during collection.
-  size_t tenuredSize = 0;
-  // Number of cells moved to the tenured generation.
-  size_t tenuredCells = 0;
+  // Size of data promoted during collection.
+  size_t promotedSize = 0;
+  // Number of cells promoted during collection.
+  size_t promotedCells = 0;
 
   // These lists are threaded through the Nursery using the space from
   // already moved things. The lists are used to fix up the moved things and
@@ -59,27 +61,34 @@ class TenuringTracer final : public JSTracer {
   // collection when out of memory to insert new entries.
   mozilla::Maybe<StringDeDupSet> stringDeDupSet;
 
+  bool tenureEverything;
+
+  // A flag set when a GC thing is promoted to the next nursery generation (as
+  // opposed to the tenured heap). This is used to check when we need to add an
+  // edge to the remembered set during nursery collection.
+  bool promotedToNursery = false;
+
 #define DEFINE_ON_EDGE_METHOD(name, type, _1, _2) \
   void on##name##Edge(type** thingp, const char* name) override;
   JS_FOR_EACH_TRACEKIND(DEFINE_ON_EDGE_METHOD)
 #undef DEFINE_ON_EDGE_METHOD
 
  public:
-  TenuringTracer(JSRuntime* rt, Nursery* nursery);
+  TenuringTracer(JSRuntime* rt, Nursery* nursery, bool tenureEverything);
 
   Nursery& nursery() { return nursery_; }
 
-  // Move all objects and everything they can reach to the tenured heap. Called
-  // after all roots have been traced.
+  // Promote all live objects and everything they can reach. Called after all
+  // roots have been traced.
   void collectToObjectFixedPoint();
 
-  // Move all strings and all strings they can reach to the tenured heap, and
-  // additionally do any fixups for when strings are pointing into memory that
-  // was deduplicated. Called after collectToObjectFixedPoint().
+  // Promote all live strings and all strings they can reach, and additionally
+  // do any fixups for when strings are pointing into memory that was
+  // deduplicated. Called after collectToObjectFixedPoint().
   void collectToStringFixedPoint();
 
-  size_t getTenuredSize() const;
-  size_t getTenuredCells() const;
+  size_t getPromotedSize() const;
+  size_t getPromotedCells() const;
 
   void traverse(JS::Value* thingp);
   void traverse(wasm::AnyRef* thingp);
@@ -87,14 +96,26 @@ class TenuringTracer final : public JSTracer {
   // The store buffers need to be able to call these directly.
   void traceObject(JSObject* obj);
   void traceObjectSlots(NativeObject* nobj, uint32_t start, uint32_t end);
-  void traceSlots(JS::Value* vp, uint32_t nslots);
+  void traceObjectElements(JS::Value* vp, uint32_t count);
   void traceString(JSString* str);
   void traceBigInt(JS::BigInt* bi);
 
+  // Methods to promote a live cell or get the pointer to its new location if
+  // that has already happened. The store buffers call these.
+  JSObject* promoteOrForward(JSObject* obj);
+  JSString* promoteOrForward(JSString* str);
+  JS::BigInt* promoteOrForward(JS::BigInt* bip);
+
+  // Returns whether any cells in the arena require sweeping.
+  template <typename T>
+  bool traceBufferedCells(Arena* arena, ArenaCellSet* cells);
+
+  class AutoPromotedAnyToNursery;
+
  private:
-  MOZ_ALWAYS_INLINE void onNonForwardedNurseryObjectEdge(JSObject** objp);
-  MOZ_ALWAYS_INLINE void onNonForwardedNurseryStringEdge(JSString** strp);
-  MOZ_ALWAYS_INLINE void onNonForwardedNurseryBigIntEdge(JS::BigInt** bip);
+  MOZ_ALWAYS_INLINE JSObject* onNonForwardedNurseryObject(JSObject* obj);
+  MOZ_ALWAYS_INLINE JSString* onNonForwardedNurseryString(JSString* str);
+  MOZ_ALWAYS_INLINE JS::BigInt* onNonForwardedNurseryBigInt(JS::BigInt* bi);
 
   // The dependent string chars needs to be relocated if the base which it's
   // using chars from has been deduplicated.
@@ -109,22 +130,24 @@ class TenuringTracer final : public JSTracer {
   inline void insertIntoStringFixupList(gc::StringRelocationOverlay* entry);
 
   template <typename T>
-  inline T* allocTenured(JS::Zone* zone, gc::AllocKind kind);
-  JSString* allocTenuredString(JSString* src, JS::Zone* zone,
-                               gc::AllocKind dstKind);
-
-  inline JSObject* movePlainObjectToTenured(PlainObject* src);
-  JSObject* moveToTenuredSlow(JSObject* src);
-  JSString* moveToTenured(JSString* src);
-  JS::BigInt* moveToTenured(JS::BigInt* src);
-
-  size_t moveElementsToTenured(NativeObject* dst, NativeObject* src,
-                               gc::AllocKind dstKind);
-  size_t moveSlotsToTenured(NativeObject* dst, NativeObject* src);
-  size_t moveStringToTenured(JSString* dst, JSString* src,
-                             gc::AllocKind dstKind);
-  size_t moveBigIntToTenured(JS::BigInt* dst, JS::BigInt* src,
-                             gc::AllocKind dstKind);
+  T* alloc(JS::Zone* zone, gc::AllocKind kind, gc::Cell* src);
+  template <JS::TraceKind traceKind>
+  void* allocCell(JS::Zone* zone, gc::AllocKind allocKind, gc::AllocSite* site,
+                  gc::Cell* src);
+  JSString* allocString(JSString* src, JS::Zone* zone, gc::AllocKind dstKind);
+
+  bool shouldTenure(Zone* zone, JS::TraceKind traceKind, Cell* cell);
+
+  inline JSObject* promotePlainObject(PlainObject* src);
+  JSObject* promoteObjectSlow(JSObject* src);
+  JSString* promoteString(JSString* src);
+  JS::BigInt* promoteBigInt(JS::BigInt* src);
+
+  size_t moveElements(NativeObject* dst, NativeObject* src,
+                      gc::AllocKind dstKind);
+  size_t moveSlots(NativeObject* dst, NativeObject* src);
+  size_t moveString(JSString* dst, JSString* src, gc::AllocKind dstKind);
+  size_t moveBigInt(JS::BigInt* dst, JS::BigInt* src, gc::AllocKind dstKind);
 
   void traceSlots(JS::Value* vp, JS::Value* end);
 };