Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ddc9c7fbc6801a0bfd1bc773da29a75fc1a3a17b
https://github.com/WebKit/WebKit/commit/ddc9c7fbc6801a0bfd1bc773da29a75fc1a3a17b
Author: Dan Hecht <[email protected]>
Date: 2026-10-12 (Mon, 12 Oct 2026)
Changed paths:
M Source/JavaScriptCore/heap/AbstractSlotVisitor.h
M Source/JavaScriptCore/heap/AbstractSlotVisitorInlines.h
M Source/JavaScriptCore/heap/Collector.cpp
M Source/JavaScriptCore/heap/SlotVisitor.cpp
M Source/JavaScriptCore/heap/SlotVisitor.h
M Source/JavaScriptCore/heap/SlotVisitorInlines.h
M Source/JavaScriptCore/heap/WeakBlock.cpp
M Source/JavaScriptCore/runtime/Structure.cpp
Log Message:
-----------
[JSC] Make heap analysis work for collections of several heaps
https://bugs.webkit.org/show_bug.cgi?id=327206
rdar://189780433
Reviewed by Yusuke Suzuki.
A heap analyzer, such as a heap snapshot or the inspector's holder finder,
belongs to one VM and describes that VM's heap. Currently, the visitors copy the
analyzer of the Collector's first heap when marking starts, so in a collection
of several heaps every heap's cells would be recorded by that one VM's analyzer.
The visitors now record only whether any of the collection's heaps is being
analyzed, and each cell is handed to its own VM's analyzer: an edge to the
target cell's VM, a node to the visited cell's VM, and a weak block's
reachability reasons to its block's VM. The append fast path still tests a
single visitor field, so collections with nothing to analyze do no extra work.
That field now sits with the visitor's other one-byte fields, which shrinks
AbstractSlotVisitor by 8 bytes and puts it on the same cache line as the marking
version the fast path also reads. Structure keeps its property table whenever
any heap is being analyzed, which is always safe. A FIXME notes that an edge
between cells of different heaps would appear in neither VM's snapshot.
No new tests: with one heap per collection, behavior is unchanged, and a
collection can't cover several heaps yet.
* Source/JavaScriptCore/heap/AbstractSlotVisitor.h:
(JSC::AbstractSlotVisitor::isAnalyzingHeap const):
(JSC::AbstractSlotVisitor::heapAnalyzer const): Deleted.
* Source/JavaScriptCore/heap/AbstractSlotVisitorInlines.h:
(JSC::AbstractSlotVisitor::didStartMarking):
(JSC::AbstractSlotVisitor::reset):
* Source/JavaScriptCore/heap/Collector.cpp:
(JSC::Collector::setUpVisitors):
* Source/JavaScriptCore/heap/SlotVisitor.cpp:
(JSC::SlotVisitor::didStartMarking):
(JSC::SlotVisitor::appendSlow):
(JSC::SlotVisitor::visitChildren):
* Source/JavaScriptCore/heap/SlotVisitor.h:
* Source/JavaScriptCore/heap/SlotVisitorInlines.h:
(JSC::SlotVisitor::appendUnbarriered):
* Source/JavaScriptCore/heap/WeakBlock.cpp:
(JSC::WeakBlock::specializedVisit):
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::visitChildrenImpl):
Canonical link: https://commits.webkit.org/323477@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
