Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 75a1e77857c2ebe9d5286f24bbfbf4acdb832698
https://github.com/WebKit/WebKit/commit/75a1e77857c2ebe9d5286f24bbfbf4acdb832698
Author: Dan Hecht <[email protected]>
Date: 2026-10-08 (Thu, 08 Oct 2026)
Changed paths:
M Source/JavaScriptCore/heap/Collector.cpp
M Source/JavaScriptCore/heap/Collector.h
M Source/JavaScriptCore/heap/Heap.cpp
M Source/JavaScriptCore/heap/Heap.h
M Source/JavaScriptCore/heap/VerifierSlotVisitor.cpp
M Source/JavaScriptCore/heap/VerifierSlotVisitorScope.h
Log Message:
-----------
[JSC] Make the GC verifier work on collections of several heaps
https://bugs.webkit.org/show_bug.cgi?id=326742
rdar://189453874
Reviewed by Yusuke Suzuki.
The GC verifier (--verifyGC) does a second, full marking after the real one,
synchronously and with the world stopped, from the same marking constraints, and
checks that every cell it reaches was marked. Currently each Heap owns a
verifier and runs it in its own End step, against its own mark bits, so it can
only check a collection of that one heap. A global collection should be checked
the same way.
Move it to the Collector: one verifier per collection, created at Begin with
the real visitors, running every constraint in the Collector's set and checking
each cell against its own heap. End's per-heap step is split around it, so that
it runs after every heap has finished marking and before any heap prunes what
marking found dead. While it marks, every member heap is flagged as being
verified; its block memos are cleared across every member heap; and its
auxiliary-cell assert checks that the cell's heap is one of the Collector's.
The debugging aids, dumpVerifierMarkerData() and VerifierSlotVisitorScope,
move with it. HeapVerifier (--verifyHeap) stays per heap, and
Heap::verifyMarking(), which now only runs it, becomes verifyHeapAfterMarking().
No change in behavior.
* Source/JavaScriptCore/heap/Collector.cpp:
(JSC::Collector::runBeginPhase):
(JSC::Collector::setUpVisitors):
(JSC::Collector::endCollectionInEachHeap):
(JSC::Collector::verifyGC):
(JSC::Collector::verifierMark):
(JSC::Collector::clearVerifierSlotVisitor):
(JSC::Collector::dumpVerifierMarkerData):
* Source/JavaScriptCore/heap/Collector.h:
(JSC::Collector::hasHeap const):
(JSC::Collector::setKeepVerifierSlotVisitor):
* Source/JavaScriptCore/heap/Heap.cpp:
(JSC::Heap::verifyHeapAfterMarking):
(JSC::Heap::clearConcurrentRetainedDataIfPossible):
(JSC::Heap::verifyMarking): Deleted.
* Source/JavaScriptCore/heap/Heap.h:
* Source/JavaScriptCore/heap/VerifierSlotVisitor.cpp:
(JSC::VerifierSlotVisitor::~VerifierSlotVisitor):
(JSC::VerifierSlotVisitor::markAuxiliary):
* Source/JavaScriptCore/heap/VerifierSlotVisitorScope.h:
(JSC::VerifierSlotVisitorScope::VerifierSlotVisitorScope):
(JSC::VerifierSlotVisitorScope::~VerifierSlotVisitorScope):
Canonical link: https://commits.webkit.org/323113@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
