1133369 - Use consistent allocation kinds for new objects after converting an unboxed group

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

If we convert instances of an unboxed group to native objects, the new script information for the group is removed and a group will be created later for 'new' objects which is unrelated to the original unboxed group.  That replacement group might end up creating objects with a different allocation kind than the original unboxed group, which will lead to polymorphic behavior at allocation sites that access both the old and new objects.  For speed, it would be better if the objects created by calling 'new' on a script always have the same allocation kind.

This is the main cause of the regression when using --unboxed-objects on octane-box2d.  Fixing this, as the attached patch does, reduces the regression on box2d with unboxed objects to <2% on x86.

Comment 1

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/749acc7bbf71

Comment 2

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/749acc7bbf71