[webkit-changes] [WebKit/WebKit] b98b78: [JSC] Allocate DFG types using SequesteredArenaAll...

Marcus Plutowski Thu, 27 Feb 2025 07:37:23 -0800

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: b98b780e9b20f7c4ffb1a35b02909a241357769f
      
https://github.com/WebKit/WebKit/commit/b98b780e9b20f7c4ffb1a35b02909a241357769f
  Author: Marcus Plutowski <[email protected]>
  Date:   2025-02-27 (Thu, 27 Feb 2025)


  Changed paths:
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp
    M Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h
    M Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h
    M Source/JavaScriptCore/dfg/DFGBackwardsCFG.h
    M Source/JavaScriptCore/dfg/DFGBackwardsDominators.h
    M Source/JavaScriptCore/dfg/DFGBasicBlock.cpp
    M Source/JavaScriptCore/dfg/DFGBasicBlock.h
    M Source/JavaScriptCore/dfg/DFGBlockMap.h
    M Source/JavaScriptCore/dfg/DFGCFG.h
    M Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
    M Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h
    M Source/JavaScriptCore/dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h
    M Source/JavaScriptCore/dfg/DFGControlEquivalenceAnalysis.h
    M Source/JavaScriptCore/dfg/DFGDisassembler.cpp
    M Source/JavaScriptCore/dfg/DFGDisassembler.h
    M Source/JavaScriptCore/dfg/DFGDominators.h
    M Source/JavaScriptCore/dfg/DFGFlowIndexing.cpp
    M Source/JavaScriptCore/dfg/DFGFlowIndexing.h
    M Source/JavaScriptCore/dfg/DFGFlowMap.h
    M Source/JavaScriptCore/dfg/DFGGraph.cpp
    M Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp
    M Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h
    M Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
    M Source/JavaScriptCore/dfg/DFGJITCompiler.h
    M Source/JavaScriptCore/dfg/DFGNaturalLoops.h
    M Source/JavaScriptCore/dfg/DFGNullAbstractState.h
    M Source/JavaScriptCore/dfg/DFGOSRExit.cpp
    M Source/JavaScriptCore/dfg/DFGOSRExit.h
    M Source/JavaScriptCore/dfg/DFGPhiChildren.cpp
    M Source/JavaScriptCore/dfg/DFGPhiChildren.h
    M Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h
    M Source/JavaScriptCore/dfg/DFGSlowPathGenerator.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp
    M Source/JavaScriptCore/dfg/DFGTZoneImpls.cpp
    M Source/JavaScriptCore/dfg/DFGVariableAccessData.h

  Log Message:
  -----------
  [JSC] Allocate DFG types using SequesteredArenaAllocator
https://bugs.webkit.org/show_bug.cgi?id=288628
rdar://145675264

Reviewed by Keith Miller.

This covers all of the DFG-internal types whose lifetimes do not extend
past that of a compilation job. Allocating these out of the arena is
intended to improve security and performance.  Note that this does not
yet cover all bytes used by DFG: components which themselves allocate
(e.g. Vector) need to be handled separately.  This patch just ensures
that when the top-level types are allocated directly, they're allocated
using SequesteredArenaMalloc.

* Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::AbstractInterpreter):
* Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:
* Source/JavaScriptCore/dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h:
* Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h:
* Source/JavaScriptCore/dfg/DFGBackwardsCFG.h:
* Source/JavaScriptCore/dfg/DFGBackwardsDominators.h:
* Source/JavaScriptCore/dfg/DFGBasicBlock.cpp:
* Source/JavaScriptCore/dfg/DFGBasicBlock.h:
* Source/JavaScriptCore/dfg/DFGBlockMap.h:
* Source/JavaScriptCore/dfg/DFGCFG.h:
* Source/JavaScriptCore/dfg/DFGCSEPhase.cpp:
* Source/JavaScriptCore/dfg/DFGCallArrayAllocatorSlowPathGenerator.h:
* Source/JavaScriptCore/dfg/DFGCallCreateDirectArgumentsSlowPathGenerator.h:
* Source/JavaScriptCore/dfg/DFGControlEquivalenceAnalysis.h:
* Source/JavaScriptCore/dfg/DFGDisassembler.cpp:
* Source/JavaScriptCore/dfg/DFGDisassembler.h:
* Source/JavaScriptCore/dfg/DFGDominators.h:
* Source/JavaScriptCore/dfg/DFGFinalizer.h:
* Source/JavaScriptCore/dfg/DFGFlowIndexing.cpp:
* Source/JavaScriptCore/dfg/DFGFlowIndexing.h:
* Source/JavaScriptCore/dfg/DFGFlowMap.h:
* Source/JavaScriptCore/dfg/DFGGraph.cpp:
(JSC::DFG::Graph::Graph):
(JSC::DFG::Graph::ensureCPSDominators):
(JSC::DFG::Graph::ensureSSADominators):
(JSC::DFG::Graph::ensureCPSNaturalLoops):
(JSC::DFG::Graph::ensureSSANaturalLoops):
(JSC::DFG::Graph::ensureBackwardsCFG):
(JSC::DFG::Graph::ensureBackwardsDominators):
(JSC::DFG::Graph::ensureControlEquivalenceAnalysis):
* Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp:
* Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h:
* Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::JITCompiler):
* Source/JavaScriptCore/dfg/DFGJITCompiler.h:
* Source/JavaScriptCore/dfg/DFGNaturalLoops.h:
* Source/JavaScriptCore/dfg/DFGNullAbstractState.h:
* Source/JavaScriptCore/dfg/DFGOSRExit.cpp:
(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):
* Source/JavaScriptCore/dfg/DFGOSRExit.h:
* Source/JavaScriptCore/dfg/DFGPhiChildren.cpp:
* Source/JavaScriptCore/dfg/DFGPhiChildren.h:
* Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp:
(JSC::DFG::SSAConversionPhase::run):
* Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h:
* Source/JavaScriptCore/dfg/DFGSlowPathGenerator.h:
(JSC::DFG::slowPathMove):
(JSC::DFG::slowPathCall):
(JSC::DFG::slowPathICCall):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileFunction):
(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
(JSC::DFG::SpeculativeJIT::arrayify):
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:
* Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp:
* Source/JavaScriptCore/dfg/DFGTZoneImpls.cpp:
* Source/JavaScriptCore/dfg/DFGVariableAccessData.h:

Canonical link: https://commits.webkit.org/291219@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [WebKit/WebKit] b98b78: [JSC] Allocate DFG types using SequesteredArenaAll...

Reply via email to