Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (225367 => 225368)
--- trunk/Source/_javascript_Core/ChangeLog 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-12-01 00:14:34 UTC (rev 225368)
@@ -1,3 +1,17 @@
+2017-11-30 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r225362.
+ https://bugs.webkit.org/show_bug.cgi?id=180225
+
+ removeIf predicate function can touch remove target set
+ (Requested by yusukesuzuki on #webkit).
+
+ Reverted changeset:
+
+ "[JSC] Remove easy toRemove & map.remove() use"
+ https://bugs.webkit.org/show_bug.cgi?id=180208
+ https://trac.webkit.org/changeset/225362
+
2017-11-30 Yusuke Suzuki <[email protected]>
[JSC] Use AllocatorIfExists for MaterializeNewObject
Modified: trunk/Source/_javascript_Core/b3/B3MoveConstants.cpp (225367 => 225368)
--- trunk/Source/_javascript_Core/b3/B3MoveConstants.cpp 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/_javascript_Core/b3/B3MoveConstants.cpp 2017-12-01 00:14:34 UTC (rev 225368)
@@ -342,8 +342,10 @@
}
Procedure& m_proc;
+ Vector<Value*> m_toRemove;
HashMap<ValueKey, unsigned> m_constTable;
int64_t* m_dataSection;
+ HashMap<ValueKey, Value*> m_constants;
InsertionSet m_insertionSet;
};
Modified: trunk/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp (225367 => 225368)
--- trunk/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/_javascript_Core/dfg/DFGArgumentsEliminationPhase.cpp 2017-12-01 00:14:34 UTC (rev 225368)
@@ -192,10 +192,20 @@
{
bool changed;
do {
- changed = m_candidates.removeIf(
- [&] (Node* candidate) {
- return !isStillValidCandidate(candidate);
- });
+ changed = false;
+ Vector<Node*, 1> toRemove;
+
+ for (Node* candidate : m_candidates) {
+ if (!isStillValidCandidate(candidate))
+ toRemove.append(candidate);
+ }
+
+ if (toRemove.size()) {
+ changed = true;
+ for (Node* node : toRemove)
+ m_candidates.remove(node);
+ }
+
} while (changed);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp (225367 => 225368)
--- trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2017-12-01 00:14:34 UTC (rev 225368)
@@ -507,10 +507,14 @@
void pruneByLiveness(const NodeSet& live)
{
- m_pointers.removeIf(
- [&] (const auto& entry) {
- return !live.contains(entry.key);
- });
+ Vector<Node*> toRemove;
+ for (const auto& entry : m_pointers) {
+ if (!live.contains(entry.key))
+ toRemove.append(entry.key);
+ }
+ for (Node* node : toRemove)
+ m_pointers.remove(node);
+
prune();
}
@@ -678,10 +682,15 @@
}
// Remove unreachable allocations
- m_allocations.removeIf(
- [&] (const auto& entry) {
- return !reachable.contains(entry.key);
- });
+ {
+ Vector<Node*> toRemove;
+ for (const auto& entry : m_allocations) {
+ if (!reachable.contains(entry.key))
+ toRemove.append(entry.key);
+ }
+ for (Node* identifier : toRemove)
+ m_allocations.remove(identifier);
+ }
}
bool m_reached = false;
@@ -1240,10 +1249,14 @@
{
// We don't create materializations if the escapee is not a
// sink candidate
- escapees.removeIf(
- [&] (const auto& entry) {
- return !m_sinkCandidates.contains(entry.key);
- });
+ Vector<Node*> toRemove;
+ for (const auto& entry : escapees) {
+ if (!m_sinkCandidates.contains(entry.key))
+ toRemove.append(entry.key);
+ }
+ for (Node* identifier : toRemove)
+ escapees.remove(identifier);
+
if (escapees.isEmpty())
return;
Modified: trunk/Source/_javascript_Core/wasm/WasmSignature.cpp (225367 => 225368)
--- trunk/Source/_javascript_Core/wasm/WasmSignature.cpp 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/_javascript_Core/wasm/WasmSignature.cpp 2017-12-01 00:14:34 UTC (rev 225368)
@@ -144,18 +144,20 @@
SignatureInformation& info = singleton();
LockHolder lock(info.m_lock);
- info.m_indexMap.removeIf(
- [&] (const auto& pair) {
- const Ref<Signature>& signature = pair.value;
- if (signature->refCount() == 1) {
- // We're the only owner.
- bool removed = info.m_signatureMap.remove(SignatureHash { signature.ptr() });
- ASSERT_UNUSED(removed, removed);
- return true;
- }
- return false;
- });
-
+ Vector<std::pair<SignatureIndex, Signature*>> toRemove;
+ for (const auto& pair : info.m_indexMap) {
+ const Ref<Signature>& signature = pair.value;
+ if (signature->refCount() == 1) {
+ // We're the only owner.
+ toRemove.append(std::make_pair(pair.key, signature.ptr()));
+ }
+ }
+ for (const auto& pair : toRemove) {
+ bool removed = info.m_signatureMap.remove(SignatureHash { pair.second });
+ ASSERT_UNUSED(removed, removed);
+ removed = info.m_indexMap.remove(pair.first);
+ ASSERT_UNUSED(removed, removed);
+ }
if (info.m_signatureMap.isEmpty()) {
ASSERT(info.m_indexMap.isEmpty());
info.m_nextIndex = Signature::firstValidIndex;
Modified: trunk/Source/WTF/ChangeLog (225367 => 225368)
--- trunk/Source/WTF/ChangeLog 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/WTF/ChangeLog 2017-12-01 00:14:34 UTC (rev 225368)
@@ -1,3 +1,17 @@
+2017-11-30 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r225362.
+ https://bugs.webkit.org/show_bug.cgi?id=180225
+
+ removeIf predicate function can touch remove target set
+ (Requested by yusukesuzuki on #webkit).
+
+ Reverted changeset:
+
+ "[JSC] Remove easy toRemove & map.remove() use"
+ https://bugs.webkit.org/show_bug.cgi?id=180208
+ https://trac.webkit.org/changeset/225362
+
2017-11-30 Mark Lam <[email protected]>
Let's scramble MacroAssemblerCodePtr values.
Modified: trunk/Source/WTF/wtf/HashMap.h (225367 => 225368)
--- trunk/Source/WTF/wtf/HashMap.h 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/WTF/wtf/HashMap.h 2017-12-01 00:14:34 UTC (rev 225368)
@@ -135,7 +135,7 @@
bool remove(const KeyType&);
bool remove(iterator);
template<typename Functor>
- bool removeIf(Functor&&);
+ void removeIf(Functor&&);
void clear();
MappedTakeType take(const KeyType&); // efficient combination of get with remove
@@ -443,9 +443,9 @@
template<typename T, typename U, typename V, typename W, typename X>
template<typename Functor>
-inline bool HashMap<T, U, V, W, X>::removeIf(Functor&& functor)
+inline void HashMap<T, U, V, W, X>::removeIf(Functor&& functor)
{
- return m_impl.removeIf(std::forward<Functor>(functor));
+ m_impl.removeIf(std::forward<Functor>(functor));
}
template<typename T, typename U, typename V, typename W, typename X>
Modified: trunk/Source/WTF/wtf/HashSet.h (225367 => 225368)
--- trunk/Source/WTF/wtf/HashSet.h 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/WTF/wtf/HashSet.h 2017-12-01 00:14:34 UTC (rev 225368)
@@ -105,7 +105,7 @@
bool remove(const ValueType&);
bool remove(iterator);
template<typename Functor>
- bool removeIf(const Functor&);
+ void removeIf(const Functor&);
void clear();
TakeType take(const ValueType&);
@@ -275,9 +275,9 @@
template<typename T, typename U, typename V>
template<typename Functor>
-inline bool HashSet<T, U, V>::removeIf(const Functor& functor)
+inline void HashSet<T, U, V>::removeIf(const Functor& functor)
{
- return m_impl.removeIf(functor);
+ m_impl.removeIf(functor);
}
template<typename T, typename U, typename V>
Modified: trunk/Source/WTF/wtf/HashTable.h (225367 => 225368)
--- trunk/Source/WTF/wtf/HashTable.h 2017-12-01 00:11:39 UTC (rev 225367)
+++ trunk/Source/WTF/wtf/HashTable.h 2017-12-01 00:14:34 UTC (rev 225368)
@@ -405,7 +405,7 @@
void removeWithoutEntryConsistencyCheck(iterator);
void removeWithoutEntryConsistencyCheck(const_iterator);
template<typename Functor>
- bool removeIf(const Functor&);
+ void removeIf(const Functor&);
void clear();
static bool isEmptyBucket(const ValueType& value) { return isHashTraitsEmptyValue<KeyTraits>(Extractor::extract(value)); }
@@ -1108,7 +1108,7 @@
template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
template<typename Functor>
- inline bool HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::removeIf(const Functor& functor)
+ inline void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::removeIf(const Functor& functor)
{
// We must use local copies in case "functor" or "deleteBucket"
// make a function call, which prevents the compiler from keeping
@@ -1134,7 +1134,6 @@
shrink();
internalCheckTableConsistency();
- return removedBucketCount;
}
template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
