Diff
Modified: trunk/Source/_javascript_Core/CMakeLists.txt (243278 => 243279)
--- trunk/Source/_javascript_Core/CMakeLists.txt 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/CMakeLists.txt 2019-03-21 07:00:24 UTC (rev 243279)
@@ -871,7 +871,6 @@
runtime/JSScriptFetchParameters.h
runtime/JSScriptFetcher.h
runtime/JSSegmentedVariableObject.h
- runtime/JSSegmentedVariableObjectHeapCellType.h
runtime/JSSet.h
runtime/JSSetIterator.h
runtime/JSSourceCode.h
Modified: trunk/Source/_javascript_Core/ChangeLog (243278 => 243279)
--- trunk/Source/_javascript_Core/ChangeLog 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-03-21 07:00:24 UTC (rev 243279)
@@ -1,3 +1,39 @@
+2019-03-20 Yusuke Suzuki <[email protected]>
+
+ [JSC] Use finalizer in JSGlobalLexicalEnvironment and JSGlobalObject
+ https://bugs.webkit.org/show_bug.cgi?id=195992
+
+ Reviewed by Keith Miller and Mark Lam.
+
+ JSGlobalLexicalEnvironment and JSGlobalObject have their own CompleteSubspace to call destructors while they are not inheriting JSDestructibleObject.
+ But it is too costly since (1) it requires CompleteSubspace in VM, (2) both objects allocate MarkedBlocks while # of them are really small.
+
+ Instead of using CompleteSubspace, we just set finalizers for them. Since these objects are rarely allocated, setting finalizers does not show
+ memory / performance problems (actually, previously we used finalizer for ArrayPrototype due to the same reason, and it does not show any problems).
+
+ And we also add following two changes to JSSegmentedVariableObject.
+
+ 1. Remove one boolean used for debugging in Release build. It enlarges sizeof(JSSegmentedVariableObject) and allocates one more MarkedBlock.
+ 2. Use cellLock() instead.
+
+ * CMakeLists.txt:
+ * _javascript_Core.xcodeproj/project.pbxproj:
+ * Sources.txt:
+ * runtime/JSSegmentedVariableObject.cpp:
+ (JSC::JSSegmentedVariableObject::findVariableIndex):
+ (JSC::JSSegmentedVariableObject::addVariables):
+ (JSC::JSSegmentedVariableObject::visitChildren):
+ (JSC::JSSegmentedVariableObject::~JSSegmentedVariableObject):
+ (JSC::JSSegmentedVariableObject::finishCreation):
+ * runtime/JSSegmentedVariableObject.h:
+ (JSC::JSSegmentedVariableObject::subspaceFor): Deleted.
+ * runtime/JSSegmentedVariableObjectHeapCellType.cpp: Removed.
+ * runtime/JSSegmentedVariableObjectHeapCellType.h: Removed.
+ * runtime/StringIteratorPrototype.cpp:
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ * runtime/VM.h:
+
2019-03-20 Saam Barati <[email protected]>
DFG::AbstractValue::validateOSREntry is wrong when isHeapTop and the incoming value is Empty
Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (243278 => 243279)
--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2019-03-21 07:00:24 UTC (rev 243279)
@@ -349,7 +349,6 @@
0F4F11E8209BCDAB00709654 /* CompilerTimingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F11E6209BCDA100709654 /* CompilerTimingScope.h */; };
0F4F11EB209D426600709654 /* DFGAbstractValueClobberEpoch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */; };
0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; };
- 0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; };
0F4F828C1E31B9760075184C /* StochasticSpaceTimeMutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */; };
0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */; };
0F5513A61D5A682C00C32BD8 /* FreeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5513A51D5A682A00C32BD8 /* FreeList.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2441,8 +2440,6 @@
0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractValueClobberEpoch.h; path = dfg/DFGAbstractValueClobberEpoch.h; sourceTree = "<group>"; };
0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = "<group>"; };
0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = "<group>"; };
- 0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSegmentedVariableObjectHeapCellType.cpp; sourceTree = "<group>"; };
- 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSegmentedVariableObjectHeapCellType.h; sourceTree = "<group>"; };
0F4F82891E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StochasticSpaceTimeMutatorScheduler.cpp; sourceTree = "<group>"; };
0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StochasticSpaceTimeMutatorScheduler.h; sourceTree = "<group>"; };
0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureClobberState.h; path = dfg/DFGStructureClobberState.h; sourceTree = "<group>"; };
@@ -6996,8 +6993,6 @@
E38D060B1F8E814100649CF2 /* JSScriptFetchParameters.h */,
0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */,
0F919D0F157F3327004A4E7D /* JSSegmentedVariableObject.h */,
- 0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.cpp */,
- 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */,
A7299D9B17D12837005F5FF9 /* JSSet.cpp */,
A7299D9C17D12837005F5FF9 /* JSSet.h */,
A790DD69182F499700588807 /* JSSetIterator.cpp */,
@@ -8505,6 +8500,7 @@
79A228361D35D71F00D8E067 /* ArithProfile.h in Headers */,
0F6B1CB91861244C00845D97 /* ArityCheckMode.h in Headers */,
A1A009C11831A26E00CF8711 /* ARM64Assembler.h in Headers */,
+ FE1E2C402240DD6200F6B729 /* ARM64EAssembler.h in Headers */,
86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */,
A7A8AF3517ADB5F3005AB174 /* ArrayBuffer.h in Headers */,
@@ -8546,7 +8542,6 @@
0F2C63B01E60AE4300C13839 /* B3Bank.h in Headers */,
0FEC85011BDACDAC0080FF74 /* B3BasicBlock.h in Headers */,
0FEC85021BDACDAC0080FF74 /* B3BasicBlockInlines.h in Headers */,
- FE1E2C3F2240DD5800F6B729 /* MacroAssemblerARM64E.h in Headers */,
0FEC85031BDACDAC0080FF74 /* B3BasicBlockUtils.h in Headers */,
0F338E1C1BF286EA0013C88F /* B3BlockInsertionSet.h in Headers */,
0FEC85041BDACDAC0080FF74 /* B3BlockWorklist.h in Headers */,
@@ -8626,7 +8621,6 @@
0FEC853A1BDACDAC0080FF74 /* B3SwitchValue.h in Headers */,
0F4570411BE584CA0062A629 /* B3TimingScope.h in Headers */,
0FEC853C1BDACDAC0080FF74 /* B3Type.h in Headers */,
- FE1E2C402240DD6200F6B729 /* ARM64EAssembler.h in Headers */,
DCFDFBDA1D1F5D9E00FE3D72 /* B3TypeMap.h in Headers */,
0FEC853E1BDACDAC0080FF74 /* B3UpsilonValue.h in Headers */,
0FEC85401BDACDAC0080FF74 /* B3UseCounts.h in Headers */,
@@ -9404,7 +9398,6 @@
A7C0C4AC168103020017011D /* JSScriptRefPrivate.h in Headers */,
14D01A7721FB351F00BC54E9 /* JSScriptSourceProvider.h in Headers */,
0F919D11157F332C004A4E7D /* JSSegmentedVariableObject.h in Headers */,
- 0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectHeapCellType.h in Headers */,
A7299D9E17D12837005F5FF9 /* JSSet.h in Headers */,
A790DD70182F499700588807 /* JSSetIterator.h in Headers */,
BDFCB2BBE90F41349E1B0BED /* JSSourceCode.h in Headers */,
@@ -9495,6 +9488,7 @@
14B723B812D7DA6F003BD5ED /* MachineStackMarker.h in Headers */,
86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */,
A1A009C01831A22D00CF8711 /* MacroAssemblerARM64.h in Headers */,
+ FE1E2C3F2240DD5800F6B729 /* MacroAssemblerARM64E.h in Headers */,
86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */,
863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */,
E32AB2441DCD75F400D7533A /* MacroAssemblerHelpers.h in Headers */,
Modified: trunk/Source/_javascript_Core/Sources.txt (243278 => 243279)
--- trunk/Source/_javascript_Core/Sources.txt 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/Sources.txt 2019-03-21 07:00:24 UTC (rev 243279)
@@ -846,7 +846,6 @@
runtime/JSScriptFetcher.cpp
runtime/JSScriptFetchParameters.cpp
runtime/JSSegmentedVariableObject.cpp
-runtime/JSSegmentedVariableObjectHeapCellType.cpp
runtime/JSSet.cpp
runtime/JSSetIterator.cpp
runtime/JSSourceCode.cpp
Modified: trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObject.cpp (243278 => 243279)
--- trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObject.cpp 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObject.cpp 2019-03-21 07:00:24 UTC (rev 243279)
@@ -38,7 +38,7 @@
ScopeOffset JSSegmentedVariableObject::findVariableIndex(void* variableAddress)
{
- ConcurrentJSLocker locker(m_lock);
+ auto locker = holdLock(cellLock());
for (unsigned i = m_variables.size(); i--;) {
if (&m_variables[i] != variableAddress)
@@ -51,7 +51,7 @@
ScopeOffset JSSegmentedVariableObject::addVariables(unsigned numberOfVariablesToAdd, JSValue initialValue)
{
- ConcurrentJSLocker locker(m_lock);
+ auto locker = holdLock(cellLock());
size_t oldSize = m_variables.size();
m_variables.grow(oldSize + numberOfVariablesToAdd);
@@ -70,7 +70,7 @@
// FIXME: We could avoid locking here if SegmentedVector was lock-free. It could be made lock-free
// relatively easily.
- auto locker = holdLock(thisObject->m_lock);
+ auto locker = holdLock(thisObject->cellLock());
for (unsigned i = thisObject->m_variables.size(); i--;)
slotVisitor.appendHidden(thisObject->m_variables[i]);
}
@@ -108,8 +108,10 @@
JSSegmentedVariableObject::~JSSegmentedVariableObject()
{
- RELEASE_ASSERT(!m_alreadyDestroyed);
+#ifndef NDEBUG
+ ASSERT(!m_alreadyDestroyed);
m_alreadyDestroyed = true;
+#endif
}
void JSSegmentedVariableObject::finishCreation(VM& vm)
@@ -116,6 +118,9 @@
{
Base::finishCreation(vm);
setSymbolTable(vm, SymbolTable::create(vm));
+ vm.heap.addFinalizer(this, [] (JSCell* cell) {
+ static_cast<JSSegmentedVariableObject*>(cell)->classInfo()->methodTable.destroy(cell);
+ });
}
} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObject.h (243278 => 243279)
--- trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObject.h 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObject.h 2019-03-21 07:00:24 UTC (rev 243279)
@@ -47,8 +47,6 @@
// JSSegmentedVariableObject has its own GC tracing functionality, since it knows the
// exact dimensions of the variables array at all times.
-// Except for JSGlobalObject, subclasses of this don't call the destructor and leak memory.
-
class JSSegmentedVariableObject : public JSSymbolTableObject {
friend class JIT;
friend class LLIntOffsetsExtractor;
@@ -58,6 +56,14 @@
DECLARE_INFO;
+ static const bool needsDestruction = true;
+
+ template<typename CellType, SubspaceAccess>
+ static CompleteSubspace* subspaceFor(VM& vm)
+ {
+ return &vm.cellSpace;
+ }
+
bool isValidScopeOffset(ScopeOffset offset)
{
return !!offset && offset.offset() < m_variables.size();
@@ -90,12 +96,6 @@
static void destroy(JSCell*);
- template<typename, SubspaceAccess>
- static CompleteSubspace* subspaceFor(VM& vm)
- {
- return &vm.segmentedVariableObjectSpace;
- }
-
const ClassInfo* classInfo() const { return m_classInfo; }
protected:
@@ -108,8 +108,9 @@
private:
SegmentedVector<WriteBarrier<Unknown>, 16> m_variables;
const ClassInfo* m_classInfo;
- ConcurrentJSLock m_lock;
+#ifndef NDEBUG
bool m_alreadyDestroyed { false }; // We use these assertions to check that we aren't doing ancient hacks that result in this being destroyed more than once.
+#endif
};
} // namespace JSC
Deleted: trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObjectHeapCellType.cpp (243278 => 243279)
--- trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObjectHeapCellType.cpp 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObjectHeapCellType.cpp 2019-03-21 07:00:24 UTC (rev 243279)
@@ -1,61 +0,0 @@
-/*
- * Copyright (C) 2017-2018 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSSegmentedVariableObjectHeapCellType.h"
-
-#include "JSCInlines.h"
-#include "MarkedBlockInlines.h"
-
-namespace JSC {
-
-struct JSSegmentedVariableObjectDestroyFunc {
- ALWAYS_INLINE void operator()(VM&, JSCell* cell) const
- {
- static_cast<JSSegmentedVariableObject*>(cell)->classInfo()->methodTable.destroy(cell);
- }
-};
-
-JSSegmentedVariableObjectHeapCellType::JSSegmentedVariableObjectHeapCellType()
- : HeapCellType(CellAttributes(NeedsDestruction, HeapCell::JSCell))
-{
-}
-
-JSSegmentedVariableObjectHeapCellType::~JSSegmentedVariableObjectHeapCellType()
-{
-}
-
-void JSSegmentedVariableObjectHeapCellType::finishSweep(MarkedBlock::Handle& handle, FreeList* freeList)
-{
- handle.finishSweepKnowingHeapCellType(freeList, JSSegmentedVariableObjectDestroyFunc());
-}
-
-void JSSegmentedVariableObjectHeapCellType::destroy(VM& vm, JSCell* cell)
-{
- JSSegmentedVariableObjectDestroyFunc()(vm, cell);
-}
-
-} // namespace JSC
-
Deleted: trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObjectHeapCellType.h (243278 => 243279)
--- trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObjectHeapCellType.h 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/runtime/JSSegmentedVariableObjectHeapCellType.h 2019-03-21 07:00:24 UTC (rev 243279)
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2017 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include "HeapCellType.h"
-
-namespace JSC {
-
-class JSSegmentedVariableObjectHeapCellType : public HeapCellType {
-public:
- JS_EXPORT_PRIVATE JSSegmentedVariableObjectHeapCellType();
- JS_EXPORT_PRIVATE virtual ~JSSegmentedVariableObjectHeapCellType();
-
- void finishSweep(MarkedBlock::Handle&, FreeList*) override;
- void destroy(VM&, JSCell*) override;
-};
-
-} // namespace JSC
-
Modified: trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.cpp (243278 => 243279)
--- trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.cpp 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.cpp 2019-03-21 07:00:24 UTC (rev 243279)
@@ -27,6 +27,7 @@
#include "config.h"
#include "StringIteratorPrototype.h"
+#include "JSCBuiltins.h"
#include "JSCInlines.h"
#include "JSGlobalObject.h"
#include "JSStringIterator.h"
Modified: trunk/Source/_javascript_Core/runtime/VM.cpp (243278 => 243279)
--- trunk/Source/_javascript_Core/runtime/VM.cpp 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/runtime/VM.cpp 2019-03-21 07:00:24 UTC (rev 243279)
@@ -91,7 +91,6 @@
#include "JSMapIterator.h"
#include "JSPromiseDeferred.h"
#include "JSPropertyNameEnumerator.h"
-#include "JSSegmentedVariableObjectHeapCellType.h"
#include "JSScriptFetchParameters.h"
#include "JSScriptFetcher.h"
#include "JSSet.h"
@@ -274,7 +273,6 @@
, destructibleCellHeapCellType(std::make_unique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
, stringHeapCellType(std::make_unique<JSStringHeapCellType>())
, destructibleObjectHeapCellType(std::make_unique<JSDestructibleObjectHeapCellType>())
- , segmentedVariableObjectHeapCellType(std::make_unique<JSSegmentedVariableObjectHeapCellType>())
#if ENABLE(WEBASSEMBLY)
, webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
#endif
@@ -287,7 +285,6 @@
, stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
, destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
, eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
- , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap, segmentedVariableObjectHeapCellType.get(), fastMallocAllocator.get())
, executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge)
, functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction)
, internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
Modified: trunk/Source/_javascript_Core/runtime/VM.h (243278 => 243279)
--- trunk/Source/_javascript_Core/runtime/VM.h 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/_javascript_Core/runtime/VM.h 2019-03-21 07:00:24 UTC (rev 243279)
@@ -123,7 +123,6 @@
class JSGlobalObject;
class JSObject;
class JSRunLoopTimer;
-class JSSegmentedVariableObjectHeapCellType;
class JSStringHeapCellType;
class JSWebAssemblyCodeBlockHeapCellType;
class JSWebAssemblyInstance;
@@ -329,7 +328,6 @@
std::unique_ptr<HeapCellType> destructibleCellHeapCellType;
std::unique_ptr<JSStringHeapCellType> stringHeapCellType;
std::unique_ptr<JSDestructibleObjectHeapCellType> destructibleObjectHeapCellType;
- std::unique_ptr<JSSegmentedVariableObjectHeapCellType> segmentedVariableObjectHeapCellType;
#if ENABLE(WEBASSEMBLY)
std::unique_ptr<JSWebAssemblyCodeBlockHeapCellType> webAssemblyCodeBlockHeapCellType;
#endif
@@ -365,7 +363,6 @@
CompleteSubspace stringSpace;
CompleteSubspace destructibleObjectSpace;
CompleteSubspace eagerlySweptDestructibleObjectSpace;
- CompleteSubspace segmentedVariableObjectSpace;
IsoSubspace executableToCodeBlockEdgeSpace;
IsoSubspace functionSpace;
Modified: trunk/Source/WebCore/ChangeLog (243278 => 243279)
--- trunk/Source/WebCore/ChangeLog 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/WebCore/ChangeLog 2019-03-21 07:00:24 UTC (rev 243279)
@@ -1,3 +1,15 @@
+2019-03-20 Yusuke Suzuki <[email protected]>
+
+ [JSC] Use finalizer in JSGlobalLexicalEnvironment and JSGlobalObject
+ https://bugs.webkit.org/show_bug.cgi?id=195992
+
+ Reviewed by Keith Miller and Mark Lam.
+
+ Use cellHeapCellType since JSSegmentedVariableObject already set finalizer.
+
+ * bindings/js/WebCoreJSClientData.cpp:
+ (WebCore::JSVMClientData::JSVMClientData):
+
2019-03-20 Youenn Fablet <[email protected]>
Compute quota after network process restart based on default quota and space used
Modified: trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp (243278 => 243279)
--- trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp 2019-03-21 05:43:08 UTC (rev 243278)
+++ trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp 2019-03-21 07:00:24 UTC (rev 243279)
@@ -31,7 +31,6 @@
#include <_javascript_Core/FastMallocAlignedMemoryAllocator.h>
#include <_javascript_Core/HeapInlines.h>
#include <_javascript_Core/JSDestructibleObjectHeapCellType.h>
-#include <_javascript_Core/JSSegmentedVariableObjectHeapCellType.h>
#include <_javascript_Core/MarkingConstraint.h>
#include <_javascript_Core/SubspaceInlines.h>
#include <_javascript_Core/VM.h>
@@ -46,7 +45,7 @@
, m_builtinNames(&vm)
, m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType.get(), RuntimeMethod)
, m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap, vm.destructibleObjectHeapCellType.get(), vm.fastMallocAllocator.get())
- , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.segmentedVariableObjectHeapCellType.get(), vm.fastMallocAllocator.get())
+ , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.cellHeapCellType.get(), vm.fastMallocAllocator.get())
{
}
