Revision: 21983
Author: [email protected]
Date: Tue Jun 24 14:53:48 2014 UTC
Log: More set_map() calls replaced with MigrateToMap().
[email protected]
Review URL: https://codereview.chromium.org/338793004
http://code.google.com/p/v8/source/detail?r=21983
Modified:
/branches/bleeding_edge/src/api.cc
/branches/bleeding_edge/src/bootstrapper.cc
/branches/bleeding_edge/src/factory.cc
/branches/bleeding_edge/src/objects.cc
=======================================
--- /branches/bleeding_edge/src/api.cc Mon Jun 23 13:52:17 2014 UTC
+++ /branches/bleeding_edge/src/api.cc Tue Jun 24 14:53:48 2014 UTC
@@ -3600,7 +3600,7 @@
i::Handle<i::Map> new_map = i::Map::Copy(i::Handle<i::Map>(obj->map()));
new_map->set_is_access_check_needed(true);
- obj->set_map(*new_map);
+ i::JSObject::MigrateToMap(obj, new_map);
}
=======================================
--- /branches/bleeding_edge/src/bootstrapper.cc Fri Jun 20 08:40:11 2014 UTC
+++ /branches/bleeding_edge/src/bootstrapper.cc Tue Jun 24 14:53:48 2014 UTC
@@ -342,10 +342,10 @@
static void SetObjectPrototype(Handle<JSObject> object, Handle<Object>
proto) {
// object.__proto__ = proto;
- Handle<Map> old_to_map = Handle<Map>(object->map());
- Handle<Map> new_to_map = Map::Copy(old_to_map);
- new_to_map->set_prototype(*proto);
- object->set_map(*new_to_map);
+ Handle<Map> old_map = Handle<Map>(object->map());
+ Handle<Map> new_map = Map::Copy(old_map);
+ new_map->set_prototype(*proto);
+ JSObject::MigrateToMap(object, new_map);
}
@@ -2540,10 +2540,8 @@
TransferIndexedProperties(from, to);
// Transfer the prototype (new map is needed).
- Handle<Map> old_to_map = Handle<Map>(to->map());
- Handle<Map> new_to_map = Map::Copy(old_to_map);
- new_to_map->set_prototype(from->map()->prototype());
- to->set_map(*new_to_map);
+ Handle<Object> proto(from->map()->prototype(), isolate());
+ SetObjectPrototype(to, proto);
}
=======================================
--- /branches/bleeding_edge/src/factory.cc Mon Jun 23 09:02:16 2014 UTC
+++ /branches/bleeding_edge/src/factory.cc Tue Jun 24 14:53:48 2014 UTC
@@ -1817,9 +1817,16 @@
// In order to keep heap in consistent state there must be no allocations
// before object re-initialization is finished and filler object is
installed.
DisallowHeapAllocation no_allocation;
+
+ // Put in filler if the new object is smaller than the old.
+ if (size_difference > 0) {
+ Address address = object->address() + map->instance_size();
+ heap->CreateFillerObjectAt(address, size_difference);
+ heap->AdjustLiveBytes(address, -size_difference, Heap::FROM_MUTATOR);
+ }
// Reset the map for the object.
- object->set_map(*map);
+ object->synchronized_set_map(*map);
Handle<JSObject> jsobj = Handle<JSObject>::cast(object);
// Reinitialize the object from the constructor map.
@@ -1832,12 +1839,6 @@
Handle<Context> context(isolate()->context()->native_context());
InitializeFunction(js_function, shared.ToHandleChecked(), context);
}
-
- // Put in filler if the new object is smaller than the old.
- if (size_difference > 0) {
- heap->CreateFillerObjectAt(
- object->address() + map->instance_size(), size_difference);
- }
}
@@ -1863,7 +1864,7 @@
DisallowHeapAllocation no_allocation;
// Reset the map for the object.
- object->set_map(constructor->initial_map());
+ object->synchronized_set_map(*map);
Heap* heap = isolate()->heap();
// Reinitialize the object from the constructor map.
=======================================
--- /branches/bleeding_edge/src/objects.cc Tue Jun 24 14:03:24 2014 UTC
+++ /branches/bleeding_edge/src/objects.cc Tue Jun 24 14:53:48 2014 UTC
@@ -761,7 +761,7 @@
// the hole value.
Handle<Map> new_map =
Map::CopyDropDescriptors(handle(object->map()));
ASSERT(new_map->is_dictionary_map());
- object->set_map(*new_map);
+ JSObject::MigrateToMap(object, new_map);
}
Handle<PropertyCell>
cell(PropertyCell::cast(dictionary->ValueAt(entry)));
Handle<Object> value = isolate->factory()->the_hole_value();
@@ -2130,8 +2130,6 @@
// converted to doubles.
if (!old_map->InstancesNeedRewriting(
*new_map, number_of_fields, inobject, unused)) {
- // Writing the new map here does not require synchronization since it
does
- // not change the actual object size.
object->synchronized_set_map(*new_map);
return;
}
@@ -2165,9 +2163,7 @@
// Set the new property value and do the map transition.
object->set_properties(*new_storage);
- // Writing the new map here does not require synchronization since it
does
- // not change the actual object size.
- object->set_map(*new_map);
+ object->synchronized_set_map(*new_map);
return;
}
Handle<FixedArray> array = isolate->factory()->NewFixedArray(total_size);
@@ -2239,24 +2235,21 @@
ASSERT(instance_size_delta >= 0);
Address address = object->address() + new_instance_size;
- // The trimming is performed on a newly allocated object, which is on a
- // freshly allocated page or on an already swept page. Hence, the sweeper
- // thread can not get confused with the filler creation. No
synchronization
- // needed.
- isolate->heap()->CreateFillerObjectAt(address, instance_size_delta);
+ Heap* heap = isolate->heap();
// If there are properties in the new backing store, trim it to the
correct
// size and install the backing store into the object.
if (external > 0) {
- RightTrimFixedArray<Heap::FROM_MUTATOR>(isolate->heap(), *array,
inobject);
+ RightTrimFixedArray<Heap::FROM_MUTATOR>(heap, *array, inobject);
object->set_properties(*array);
}
- // The trimming is performed on a newly allocated object, which is on a
- // freshly allocated page or on an already swept page. Hence, the sweeper
- // thread can not get confused with the filler creation. No
synchronization
- // needed.
- object->set_map(*new_map);
+ heap->CreateFillerObjectAt(address, instance_size_delta);
+ heap->AdjustLiveBytes(address, -instance_size_delta, Heap::FROM_MUTATOR);
+
+ // We are storing the new map using release store after creating a
filler for
+ // the left-over space to avoid races with the sweeper thread.
+ object->synchronized_set_map(*new_map);
}
@@ -4703,7 +4696,7 @@
ASSERT_LE(unused_property_fields, inobject_props);
// Transform the object.
new_map->set_unused_property_fields(inobject_props);
- object->set_map(*new_map);
+ object->synchronized_set_map(*new_map);
object->set_properties(isolate->heap()->empty_fixed_array());
// Check that it really works.
ASSERT(object->HasFastProperties());
@@ -4784,7 +4777,7 @@
new_map->set_unused_property_fields(unused_property_fields);
// Transform the object.
- object->set_map(*new_map);
+ object->synchronized_set_map(*new_map);
object->set_properties(*fields);
ASSERT(object->IsJSObject());
@@ -6626,7 +6619,7 @@
if (object->IsGlobalObject()) {
Handle<Map> new_map = Map::CopyDropDescriptors(handle(object->map()));
ASSERT(new_map->is_dictionary_map());
- object->set_map(*new_map);
+ JSObject::MigrateToMap(object, new_map);
// When running crankshaft, changing the map is not enough. We
// need to deoptimize all functions that rely on this global
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
