Title: [189707] releases/WebKitGTK/webkit-2.10/Source/_javascript_Core
- Revision
- 189707
- Author
- carlo...@webkit.org
- Date
- 2015-09-14 03:38:47 -0700 (Mon, 14 Sep 2015)
Log Message
Merge r188978 - [JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls.
<https://webkit.org/b/148478>
Reviewed by Geoffrey Garen.
Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers
when it's using the single-transition optimization and the Structure it transitioned
to has been GC'd.
This prevents Structures from keeping WeakBlocks alive longer than necessary when
they've been transitioned away from but are still in use themselves.
* runtime/Structure.cpp:
(JSC::singleSlotTransitionWeakOwner):
(JSC::StructureTransitionTable::singleTransition):
(JSC::StructureTransitionTable::setSingleTransition):
(JSC::StructureTransitionTable::add):
* runtime/StructureTransitionTable.h:
(JSC::StructureTransitionTable::singleTransition): Deleted.
(JSC::StructureTransitionTable::setSingleTransition): Deleted.
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/ChangeLog (189706 => 189707)
--- releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/ChangeLog 2015-09-14 10:10:53 UTC (rev 189706)
+++ releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/ChangeLog 2015-09-14 10:38:47 UTC (rev 189707)
@@ -1,3 +1,26 @@
+2015-08-26 Andreas Kling <akl...@apple.com>
+
+ [JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls.
+ <https://webkit.org/b/148478>
+
+ Reviewed by Geoffrey Garen.
+
+ Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers
+ when it's using the single-transition optimization and the Structure it transitioned
+ to has been GC'd.
+
+ This prevents Structures from keeping WeakBlocks alive longer than necessary when
+ they've been transitioned away from but are still in use themselves.
+
+ * runtime/Structure.cpp:
+ (JSC::singleSlotTransitionWeakOwner):
+ (JSC::StructureTransitionTable::singleTransition):
+ (JSC::StructureTransitionTable::setSingleTransition):
+ (JSC::StructureTransitionTable::add):
+ * runtime/StructureTransitionTable.h:
+ (JSC::StructureTransitionTable::singleTransition): Deleted.
+ (JSC::StructureTransitionTable::setSingleTransition): Deleted.
+
2015-08-23 Benjamin Poulain <bpoul...@apple.com>
[JSC] Reduce the memory usage of BytecodeLivenessAnalysis
Modified: releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/runtime/Structure.cpp (189706 => 189707)
--- releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/runtime/Structure.cpp 2015-09-14 10:10:53 UTC (rev 189706)
+++ releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/runtime/Structure.cpp 2015-09-14 10:38:47 UTC (rev 189707)
@@ -38,6 +38,7 @@
#include "StructureRareDataInlines.h"
#include "WeakGCMapInlines.h"
#include <wtf/CommaPrinter.h>
+#include <wtf/NeverDestroyed.h>
#include <wtf/ProcessID.h>
#include <wtf/RefCountedLeakCounter.h>
#include <wtf/RefPtr.h>
@@ -60,6 +61,41 @@
static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
#endif
+class SingleSlotTransitionWeakOwner final : public WeakHandleOwner {
+ void finalize(Handle<Unknown>, void* context) override
+ {
+ StructureTransitionTable* table = reinterpret_cast<StructureTransitionTable*>(context);
+ ASSERT(table->isUsingSingleSlot());
+ WeakSet::deallocate(table->weakImpl());
+ table->m_data = StructureTransitionTable::UsingSingleSlotFlag;
+ }
+};
+
+static SingleSlotTransitionWeakOwner& singleSlotTransitionWeakOwner()
+{
+ static NeverDestroyed<SingleSlotTransitionWeakOwner> owner;
+ return owner;
+}
+
+inline Structure* StructureTransitionTable::singleTransition() const
+{
+ ASSERT(isUsingSingleSlot());
+ if (WeakImpl* impl = this->weakImpl()) {
+ if (impl->state() == WeakImpl::Live)
+ return jsCast<Structure*>(impl->jsValue().asCell());
+ }
+ return nullptr;
+}
+
+inline void StructureTransitionTable::setSingleTransition(Structure* structure)
+{
+ ASSERT(isUsingSingleSlot());
+ if (WeakImpl* impl = this->weakImpl())
+ WeakSet::deallocate(impl);
+ WeakImpl* impl = WeakSet::allocate(structure, &singleSlotTransitionWeakOwner(), this);
+ m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
+}
+
bool StructureTransitionTable::contains(UniquedStringImpl* rep, unsigned attributes) const
{
if (isUsingSingleSlot()) {
@@ -85,7 +121,7 @@
// This handles the first transition being added.
if (!existingTransition) {
- setSingleTransition(vm, structure);
+ setSingleTransition(structure);
return;
}
Modified: releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/runtime/StructureTransitionTable.h (189706 => 189707)
--- releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/runtime/StructureTransitionTable.h 2015-09-14 10:10:53 UTC (rev 189706)
+++ releases/WebKitGTK/webkit-2.10/Source/_javascript_Core/runtime/StructureTransitionTable.h 2015-09-14 10:38:47 UTC (rev 189707)
@@ -134,6 +134,8 @@
Structure* get(UniquedStringImpl*, unsigned attributes) const;
private:
+ friend class SingleSlotTransitionWeakOwner;
+
bool isUsingSingleSlot() const
{
return m_data & UsingSingleSlotFlag;
@@ -164,24 +166,8 @@
ASSERT(!isUsingSingleSlot());
}
- Structure* singleTransition() const
- {
- ASSERT(isUsingSingleSlot());
- if (WeakImpl* impl = this->weakImpl()) {
- if (impl->state() == WeakImpl::Live)
- return reinterpret_cast<Structure*>(impl->jsValue().asCell());
- }
- return 0;
- }
-
- void setSingleTransition(VM&, Structure* structure)
- {
- ASSERT(isUsingSingleSlot());
- if (WeakImpl* impl = this->weakImpl())
- WeakSet::deallocate(impl);
- WeakImpl* impl = WeakSet::allocate(reinterpret_cast<JSCell*>(structure));
- m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
- }
+ Structure* singleTransition() const;
+ void setSingleTransition(Structure*);
intptr_t m_data;
};
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
