Title: [254393] trunk
- Revision
- 254393
- Author
- [email protected]
- Date
- 2020-01-10 22:54:45 -0800 (Fri, 10 Jan 2020)
Log Message
[JSC] Flush old tables in End phase
https://bugs.webkit.org/show_bug.cgi?id=206120
<rdar://problem/58039989>
Reviewed by Mark Lam.
JSTests:
* stress/create-many-realms.js: Added.
(foo):
Source/_javascript_Core:
stopThePeriphery is stopping compiler threads and main thread (mutator), which means making m_worldIsStopped = true.
It is not for stopping all heap threads including a concurrent marker. The concurrent collector can work while executing
stopThePeriphery. This means that concurrent collectors can access to the old StructureIDTable while it is destroyed
in stopThePeriphery. Destroying old StructureIDTable in GC End phase, this is appropriate phase that we can ensure no
other threads (accessing to heap) are working including concurrent markers, mutator, and compiler threads.
* heap/Heap.cpp:
(JSC::Heap::runEndPhase):
(JSC::Heap::stopThePeriphery):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (254392 => 254393)
--- trunk/JSTests/ChangeLog 2020-01-11 05:32:23 UTC (rev 254392)
+++ trunk/JSTests/ChangeLog 2020-01-11 06:54:45 UTC (rev 254393)
@@ -1,3 +1,14 @@
+2020-01-10 Yusuke Suzuki <[email protected]>
+
+ [JSC] Flush old tables in End phase
+ https://bugs.webkit.org/show_bug.cgi?id=206120
+ <rdar://problem/58039989>
+
+ Reviewed by Mark Lam.
+
+ * stress/create-many-realms.js: Added.
+ (foo):
+
2020-01-10 Caitlin Potter <[email protected]> and Alexey Shvayka <[email protected]>
Object.keys should throw if called on module namespace object with uninitialized binding
Added: trunk/JSTests/stress/create-many-realms.js (0 => 254393)
--- trunk/JSTests/stress/create-many-realms.js (rev 0)
+++ trunk/JSTests/stress/create-many-realms.js 2020-01-11 06:54:45 UTC (rev 254393)
@@ -0,0 +1,9 @@
+ //@ runDefault("--collectContinuously=1", "--collectContinuouslyPeriodMS=20", "--useGenerationalGC=0", "--useStochasticMutatorScheduler=0", "--useDFGJIT=0", "--useFTLJIT=0", "--maxPerThreadStackUsage=1000000")
+
+function foo(count) {
+ const x = createGlobalObject();
+ if (count === 100)
+ return;
+ return foo(count + 1);
+}
+foo(0);
Modified: trunk/Source/_javascript_Core/ChangeLog (254392 => 254393)
--- trunk/Source/_javascript_Core/ChangeLog 2020-01-11 05:32:23 UTC (rev 254392)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-01-11 06:54:45 UTC (rev 254393)
@@ -1,3 +1,21 @@
+2020-01-10 Yusuke Suzuki <[email protected]>
+
+ [JSC] Flush old tables in End phase
+ https://bugs.webkit.org/show_bug.cgi?id=206120
+ <rdar://problem/58039989>
+
+ Reviewed by Mark Lam.
+
+ stopThePeriphery is stopping compiler threads and main thread (mutator), which means making m_worldIsStopped = true.
+ It is not for stopping all heap threads including a concurrent marker. The concurrent collector can work while executing
+ stopThePeriphery. This means that concurrent collectors can access to the old StructureIDTable while it is destroyed
+ in stopThePeriphery. Destroying old StructureIDTable in GC End phase, this is appropriate phase that we can ensure no
+ other threads (accessing to heap) are working including concurrent markers, mutator, and compiler threads.
+
+ * heap/Heap.cpp:
+ (JSC::Heap::runEndPhase):
+ (JSC::Heap::stopThePeriphery):
+
2020-01-10 Caitlin Potter <[email protected]> and Alexey Shvayka <[email protected]>
Object.keys should throw if called on module namespace object with uninitialized binding
Modified: trunk/Source/_javascript_Core/heap/Heap.cpp (254392 => 254393)
--- trunk/Source/_javascript_Core/heap/Heap.cpp 2020-01-11 05:32:23 UTC (rev 254392)
+++ trunk/Source/_javascript_Core/heap/Heap.cpp 2020-01-11 06:54:45 UTC (rev 254393)
@@ -1516,6 +1516,8 @@
if (vm().typeProfiler())
vm().typeProfiler()->invalidateTypeSetCache(vm());
+ m_structureIDTable.flushOldTables();
+
reapWeakHandles();
pruneStaleEntriesFromWeakGCMaps();
sweepArrayBuffers();
@@ -1663,7 +1665,6 @@
if (auto* shadowChicken = vm().shadowChicken())
shadowChicken->update(vm(), vm().topCallFrame);
- m_structureIDTable.flushOldTables();
m_objectSpace.stopAllocating();
m_stopTime = MonotonicTime::now();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
