Title: [243467] trunk/Source/_javascript_Core
Revision
243467
Author
[email protected]
Date
2019-03-25 15:40:58 -0700 (Mon, 25 Mar 2019)

Log Message

Heap::isMarked and friends should be instance methods
https://bugs.webkit.org/show_bug.cgi?id=179988

Reviewed by Saam Barati.

Almost all the callers of Heap::isMarked have VM& reference. We should make Heap::isMarked instance function instead of static function
so that we do not need to look up Heap from the cell.

* API/JSAPIWrapperObject.mm:
(JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
* API/JSMarkingConstraintPrivate.cpp:
(JSC::isMarked):
* API/glib/JSAPIWrapperObjectGLib.cpp:
(JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
* builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::finalizeUnconditionally):
* bytecode/AccessCase.cpp:
(JSC::AccessCase::visitWeak const):
(JSC::AccessCase::propagateTransitions const):
* bytecode/CallLinkInfo.cpp:
(JSC::CallLinkInfo::visitWeak):
* bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::finalize):
* bytecode/CallLinkStatus.h:
* bytecode/CallVariant.cpp:
(JSC::CallVariant::finalize):
* bytecode/CallVariant.h:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::shouldJettisonDueToWeakReference):
(JSC::CodeBlock::shouldJettisonDueToOldAge):
(JSC::shouldMarkTransition):
(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::determineLiveness):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::jettison):
* bytecode/CodeBlock.h:
* bytecode/ExecutableToCodeBlockEdge.cpp:
(JSC::ExecutableToCodeBlockEdge::visitChildren):
(JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally):
(JSC::ExecutableToCodeBlockEdge::runConstraint):
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::finalize):
* bytecode/GetByIdStatus.h:
* bytecode/GetByIdVariant.cpp:
(JSC::GetByIdVariant::finalize):
* bytecode/GetByIdVariant.h:
* bytecode/InByIdStatus.cpp:
(JSC::InByIdStatus::finalize):
* bytecode/InByIdStatus.h:
* bytecode/InByIdVariant.cpp:
(JSC::InByIdVariant::finalize):
* bytecode/InByIdVariant.h:
* bytecode/ObjectPropertyCondition.cpp:
(JSC::ObjectPropertyCondition::isStillLive const):
* bytecode/ObjectPropertyCondition.h:
* bytecode/ObjectPropertyConditionSet.cpp:
(JSC::ObjectPropertyConditionSet::areStillLive const):
* bytecode/ObjectPropertyConditionSet.h:
* bytecode/PolymorphicAccess.cpp:
(JSC::PolymorphicAccess::visitWeak const):
* bytecode/PropertyCondition.cpp:
(JSC::PropertyCondition::isStillLive const):
* bytecode/PropertyCondition.h:
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::finalize):
* bytecode/PutByIdStatus.h:
* bytecode/PutByIdVariant.cpp:
(JSC::PutByIdVariant::finalize):
* bytecode/PutByIdVariant.h:
* bytecode/RecordedStatuses.cpp:
(JSC::RecordedStatuses::finalizeWithoutDeleting):
(JSC::RecordedStatuses::finalize):
* bytecode/RecordedStatuses.h:
* bytecode/StructureSet.cpp:
(JSC::StructureSet::isStillAlive const):
* bytecode/StructureSet.h:
* bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::visitWeakReferences):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::finalizeInGC):
(JSC::DFG::Plan::isKnownToBeLiveDuringGC):
* heap/GCIncomingRefCounted.h:
* heap/GCIncomingRefCountedInlines.h:
(JSC::GCIncomingRefCounted<T>::filterIncomingReferences):
* heap/GCIncomingRefCountedSet.h:
* heap/GCIncomingRefCountedSetInlines.h:
(JSC::GCIncomingRefCountedSet<T>::lastChanceToFinalize):
(JSC::GCIncomingRefCountedSet<T>::sweep):
(JSC::GCIncomingRefCountedSet<T>::removeAll): Deleted.
(JSC::GCIncomingRefCountedSet<T>::removeDead): Deleted.
* heap/Heap.cpp:
(JSC::Heap::addToRememberedSet):
(JSC::Heap::runEndPhase):
(JSC::Heap::sweepArrayBuffers):
(JSC::Heap::addCoreConstraints):
* heap/Heap.h:
* heap/HeapInlines.h:
(JSC::Heap::isMarked):
* heap/HeapSnapshotBuilder.cpp:
(JSC::HeapSnapshotBuilder::appendNode):
* heap/SlotVisitor.cpp:
(JSC::SlotVisitor::appendToMarkStack):
(JSC::SlotVisitor::visitChildren):
* jit/PolymorphicCallStubRoutine.cpp:
(JSC::PolymorphicCallStubRoutine::visitWeak):
* runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::finalizeUnconditionally):
* runtime/InferredValueInlines.h:
(JSC::InferredValue::finalizeUnconditionally):
* runtime/StackFrame.h:
(JSC::StackFrame::isMarked const):
* runtime/Structure.cpp:
(JSC::Structure::isCheapDuringGC):
(JSC::Structure::markIfCheap):
* runtime/Structure.h:
* runtime/TypeProfiler.cpp:
(JSC::TypeProfiler::invalidateTypeSetCache):
* runtime/TypeProfiler.h:
* runtime/TypeSet.cpp:
(JSC::TypeSet::invalidateCache):
* runtime/TypeSet.h:
* runtime/WeakMapImpl.cpp:
(JSC::WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::visitOutputConstraints):
* runtime/WeakMapImplInlines.h:
(JSC::WeakMapImpl<WeakMapBucket>::finalizeUnconditionally):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/API/JSAPIWrapperObject.mm (243466 => 243467)


--- trunk/Source/_javascript_Core/API/JSAPIWrapperObject.mm	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/API/JSAPIWrapperObject.mm	2019-03-25 22:40:58 UTC (rev 243467)
@@ -63,7 +63,7 @@
     // the same Objective-C object in multiple global objects keeps all of the global objects alive.
     if (!wrapperObject->wrappedObject())
         return false;
-    return JSC::Heap::isMarked(wrapperObject->structure()->globalObject()) && visitor.containsOpaqueRoot(wrapperObject->wrappedObject());
+    return visitor.vm().heap.isMarked(wrapperObject->structure()->globalObject()) && visitor.containsOpaqueRoot(wrapperObject->wrappedObject());
 }
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/API/JSMarkingConstraintPrivate.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/API/JSMarkingConstraintPrivate.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/API/JSMarkingConstraintPrivate.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -40,12 +40,12 @@
     SlotVisitor* visitor;
 };
 
-bool isMarked(JSMarkerRef, JSObjectRef objectRef)
+bool isMarked(JSMarkerRef markerRef, JSObjectRef objectRef)
 {
     if (!objectRef)
         return true; // Null is an immortal object.
     
-    return Heap::isMarked(toJS(objectRef));
+    return static_cast<Marker*>(markerRef)->visitor->vm().heap.isMarked(toJS(objectRef));
 }
 
 void mark(JSMarkerRef markerRef, JSObjectRef objectRef)

Modified: trunk/Source/_javascript_Core/API/glib/JSAPIWrapperObjectGLib.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/API/glib/JSAPIWrapperObjectGLib.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/API/glib/JSAPIWrapperObjectGLib.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -62,7 +62,7 @@
     // the same wrapped object in multiple global objects keeps all of the global objects alive.
     if (!wrapperObject->wrappedObject())
         return false;
-    return JSC::Heap::isMarked(wrapperObject->structure()->globalObject()) && visitor.containsOpaqueRoot(wrapperObject->wrappedObject());
+    return visitor.vm().heap.isMarked(wrapperObject->structure()->globalObject()) && visitor.containsOpaqueRoot(wrapperObject->wrappedObject());
 }
 
 namespace JSC {

Modified: trunk/Source/_javascript_Core/ChangeLog (243466 => 243467)


--- trunk/Source/_javascript_Core/ChangeLog	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/ChangeLog	2019-03-25 22:40:58 UTC (rev 243467)
@@ -1,3 +1,132 @@
+2019-03-25  Yusuke Suzuki  <[email protected]>
+
+        Heap::isMarked and friends should be instance methods
+        https://bugs.webkit.org/show_bug.cgi?id=179988
+
+        Reviewed by Saam Barati.
+
+        Almost all the callers of Heap::isMarked have VM& reference. We should make Heap::isMarked instance function instead of static function
+        so that we do not need to look up Heap from the cell.
+
+        * API/JSAPIWrapperObject.mm:
+        (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
+        * API/JSMarkingConstraintPrivate.cpp:
+        (JSC::isMarked):
+        * API/glib/JSAPIWrapperObjectGLib.cpp:
+        (JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::finalizeUnconditionally):
+        * bytecode/AccessCase.cpp:
+        (JSC::AccessCase::visitWeak const):
+        (JSC::AccessCase::propagateTransitions const):
+        * bytecode/CallLinkInfo.cpp:
+        (JSC::CallLinkInfo::visitWeak):
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::finalize):
+        * bytecode/CallLinkStatus.h:
+        * bytecode/CallVariant.cpp:
+        (JSC::CallVariant::finalize):
+        * bytecode/CallVariant.h:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::shouldJettisonDueToWeakReference):
+        (JSC::CodeBlock::shouldJettisonDueToOldAge):
+        (JSC::shouldMarkTransition):
+        (JSC::CodeBlock::propagateTransitions):
+        (JSC::CodeBlock::determineLiveness):
+        (JSC::CodeBlock::finalizeLLIntInlineCaches):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::jettison):
+        * bytecode/CodeBlock.h:
+        * bytecode/ExecutableToCodeBlockEdge.cpp:
+        (JSC::ExecutableToCodeBlockEdge::visitChildren):
+        (JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally):
+        (JSC::ExecutableToCodeBlockEdge::runConstraint):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::finalize):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::finalize):
+        * bytecode/GetByIdVariant.h:
+        * bytecode/InByIdStatus.cpp:
+        (JSC::InByIdStatus::finalize):
+        * bytecode/InByIdStatus.h:
+        * bytecode/InByIdVariant.cpp:
+        (JSC::InByIdVariant::finalize):
+        * bytecode/InByIdVariant.h:
+        * bytecode/ObjectPropertyCondition.cpp:
+        (JSC::ObjectPropertyCondition::isStillLive const):
+        * bytecode/ObjectPropertyCondition.h:
+        * bytecode/ObjectPropertyConditionSet.cpp:
+        (JSC::ObjectPropertyConditionSet::areStillLive const):
+        * bytecode/ObjectPropertyConditionSet.h:
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::PolymorphicAccess::visitWeak const):
+        * bytecode/PropertyCondition.cpp:
+        (JSC::PropertyCondition::isStillLive const):
+        * bytecode/PropertyCondition.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::finalize):
+        * bytecode/PutByIdStatus.h:
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::finalize):
+        * bytecode/PutByIdVariant.h:
+        * bytecode/RecordedStatuses.cpp:
+        (JSC::RecordedStatuses::finalizeWithoutDeleting):
+        (JSC::RecordedStatuses::finalize):
+        * bytecode/RecordedStatuses.h:
+        * bytecode/StructureSet.cpp:
+        (JSC::StructureSet::isStillAlive const):
+        * bytecode/StructureSet.h:
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::visitWeakReferences):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::finalizeInGC):
+        (JSC::DFG::Plan::isKnownToBeLiveDuringGC):
+        * heap/GCIncomingRefCounted.h:
+        * heap/GCIncomingRefCountedInlines.h:
+        (JSC::GCIncomingRefCounted<T>::filterIncomingReferences):
+        * heap/GCIncomingRefCountedSet.h:
+        * heap/GCIncomingRefCountedSetInlines.h:
+        (JSC::GCIncomingRefCountedSet<T>::lastChanceToFinalize):
+        (JSC::GCIncomingRefCountedSet<T>::sweep):
+        (JSC::GCIncomingRefCountedSet<T>::removeAll): Deleted.
+        (JSC::GCIncomingRefCountedSet<T>::removeDead): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::addToRememberedSet):
+        (JSC::Heap::runEndPhase):
+        (JSC::Heap::sweepArrayBuffers):
+        (JSC::Heap::addCoreConstraints):
+        * heap/Heap.h:
+        * heap/HeapInlines.h:
+        (JSC::Heap::isMarked):
+        * heap/HeapSnapshotBuilder.cpp:
+        (JSC::HeapSnapshotBuilder::appendNode):
+        * heap/SlotVisitor.cpp:
+        (JSC::SlotVisitor::appendToMarkStack):
+        (JSC::SlotVisitor::visitChildren):
+        * jit/PolymorphicCallStubRoutine.cpp:
+        (JSC::PolymorphicCallStubRoutine::visitWeak):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finalizeUnconditionally):
+        * runtime/InferredValueInlines.h:
+        (JSC::InferredValue::finalizeUnconditionally):
+        * runtime/StackFrame.h:
+        (JSC::StackFrame::isMarked const):
+        * runtime/Structure.cpp:
+        (JSC::Structure::isCheapDuringGC):
+        (JSC::Structure::markIfCheap):
+        * runtime/Structure.h:
+        * runtime/TypeProfiler.cpp:
+        (JSC::TypeProfiler::invalidateTypeSetCache):
+        * runtime/TypeProfiler.h:
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::invalidateCache):
+        * runtime/TypeSet.h:
+        * runtime/WeakMapImpl.cpp:
+        (JSC::WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::visitOutputConstraints):
+        * runtime/WeakMapImplInlines.h:
+        (JSC::WeakMapImpl<WeakMapBucket>::finalizeUnconditionally):
+
 2019-03-25  Keith Miller  <[email protected]>
 
         ASSERTION FAILED: m_op == CompareStrictEq in JSC::DFG::Node::convertToCompareEqPtr(JSC::DFG::FrozenValue *, JSC::DFG::Edge)

Modified: trunk/Source/_javascript_Core/builtins/BuiltinExecutables.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/builtins/BuiltinExecutables.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/builtins/BuiltinExecutables.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -262,7 +262,7 @@
 void BuiltinExecutables::finalizeUnconditionally()
 {
     for (auto*& unlinkedExecutable : m_unlinkedExecutables) {
-        if (unlinkedExecutable && !Heap::isMarked(unlinkedExecutable))
+        if (unlinkedExecutable && !m_vm.heap.isMarked(unlinkedExecutable))
             unlinkedExecutable = nullptr;
     }
 }

Modified: trunk/Source/_javascript_Core/bytecode/AccessCase.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/AccessCase.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/AccessCase.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -323,34 +323,34 @@
 
 bool AccessCase::visitWeak(VM& vm) const
 {
-    if (m_structure && !Heap::isMarked(m_structure.get()))
+    if (m_structure && !vm.heap.isMarked(m_structure.get()))
         return false;
     if (m_polyProtoAccessChain) {
         for (Structure* structure : m_polyProtoAccessChain->chain()) {
-            if (!Heap::isMarked(structure))
+            if (!vm.heap.isMarked(structure))
                 return false;
         }
     }
-    if (!m_conditionSet.areStillLive())
+    if (!m_conditionSet.areStillLive(vm))
         return false;
     if (isAccessor()) {
         auto& accessor = this->as<GetterSetterAccessCase>();
         if (accessor.callLinkInfo())
             accessor.callLinkInfo()->visitWeak(vm);
-        if (accessor.customSlotBase() && !Heap::isMarked(accessor.customSlotBase()))
+        if (accessor.customSlotBase() && !vm.heap.isMarked(accessor.customSlotBase()))
             return false;
     } else if (type() == IntrinsicGetter) {
         auto& intrinsic = this->as<IntrinsicGetterAccessCase>();
-        if (intrinsic.intrinsicFunction() && !Heap::isMarked(intrinsic.intrinsicFunction()))
+        if (intrinsic.intrinsicFunction() && !vm.heap.isMarked(intrinsic.intrinsicFunction()))
             return false;
     } else if (type() == ModuleNamespaceLoad) {
         auto& accessCase = this->as<ModuleNamespaceAccessCase>();
-        if (accessCase.moduleNamespaceObject() && !Heap::isMarked(accessCase.moduleNamespaceObject()))
+        if (accessCase.moduleNamespaceObject() && !vm.heap.isMarked(accessCase.moduleNamespaceObject()))
             return false;
-        if (accessCase.moduleEnvironment() && !Heap::isMarked(accessCase.moduleEnvironment()))
+        if (accessCase.moduleEnvironment() && !vm.heap.isMarked(accessCase.moduleEnvironment()))
             return false;
     } else if (type() == InstanceOfHit || type() == InstanceOfMiss) {
-        if (as<InstanceOfAccessCase>().prototype() && !Heap::isMarked(as<InstanceOfAccessCase>().prototype()))
+        if (as<InstanceOfAccessCase>().prototype() && !vm.heap.isMarked(as<InstanceOfAccessCase>().prototype()))
             return false;
     }
 
@@ -371,7 +371,7 @@
 
     switch (m_type) {
     case Transition:
-        if (Heap::isMarked(m_structure->previousID()))
+        if (visitor.vm().heap.isMarked(m_structure->previousID()))
             visitor.appendUnbarriered(m_structure.get());
         else
             result = false;

Modified: trunk/Source/_javascript_Core/bytecode/CallLinkInfo.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/CallLinkInfo.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/CallLinkInfo.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -210,7 +210,7 @@
 void CallLinkInfo::visitWeak(VM& vm)
 {
     auto handleSpecificCallee = [&] (JSFunction* callee) {
-        if (Heap::isMarked(callee->executable()))
+        if (vm.heap.isMarked(callee->executable()))
             m_hasSeenClosure = true;
         else
             m_clearedByGC = true;
@@ -228,7 +228,7 @@
                 unlink(vm);
                 m_clearedByGC = true;
             }
-        } else if (!Heap::isMarked(m_calleeOrCodeBlock.get())) {
+        } else if (!vm.heap.isMarked(m_calleeOrCodeBlock.get())) {
             if (isDirect()) {
                 if (Options::verboseOSR()) {
                     dataLog(
@@ -252,7 +252,7 @@
                 }
             }
             unlink(vm);
-        } else if (isDirect() && !Heap::isMarked(m_lastSeenCalleeOrExecutable.get())) {
+        } else if (isDirect() && !vm.heap.isMarked(m_lastSeenCalleeOrExecutable.get())) {
             if (Options::verboseOSR()) {
                 dataLog(
                     "Clearing call to ", RawPointer(executable()),
@@ -264,7 +264,7 @@
             m_lastSeenCalleeOrExecutable.clear();
         }
     }
-    if (!isDirect() && haveLastSeenCallee() && !Heap::isMarked(lastSeenCallee())) {
+    if (!isDirect() && haveLastSeenCallee() && !vm.heap.isMarked(lastSeenCallee())) {
         if (lastSeenCallee()->type() == JSFunctionType)
             handleSpecificCallee(jsCast<JSFunction*>(lastSeenCallee()));
         else

Modified: trunk/Source/_javascript_Core/bytecode/CallLinkStatus.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/CallLinkStatus.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/CallLinkStatus.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -418,10 +418,10 @@
     m_variants = despecifiedVariantList(m_variants);
 }
 
-bool CallLinkStatus::finalize()
+bool CallLinkStatus::finalize(VM& vm)
 {
     for (CallVariant& variant : m_variants) {
-        if (!variant.finalize())
+        if (!variant.finalize(vm))
             return false;
     }
     return true;

Modified: trunk/Source/_javascript_Core/bytecode/CallLinkStatus.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/CallLinkStatus.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/CallLinkStatus.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -106,7 +106,7 @@
     
     unsigned maxNumArguments() const { return m_maxNumArguments; }
     
-    bool finalize();
+    bool finalize(VM&);
     
     void merge(const CallLinkStatus&);
     

Modified: trunk/Source/_javascript_Core/bytecode/CallVariant.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/CallVariant.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/CallVariant.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -31,9 +31,9 @@
 
 namespace JSC {
 
-bool CallVariant::finalize()
+bool CallVariant::finalize(VM& vm)
 {
-    if (m_callee && !Heap::isMarked(m_callee))
+    if (m_callee && !vm.heap.isMarked(m_callee))
         return false;
     return true;
 }

Modified: trunk/Source/_javascript_Core/bytecode/CallVariant.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/CallVariant.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/CallVariant.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -137,7 +137,7 @@
         return nullptr;
     }
     
-    bool finalize();
+    bool finalize(VM&);
     
     bool merge(const CallVariant&);
     

Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -998,11 +998,11 @@
     return false;
 }
 
-bool CodeBlock::shouldJettisonDueToWeakReference()
+bool CodeBlock::shouldJettisonDueToWeakReference(VM& vm)
 {
     if (!JITCode::isOptimizingJIT(jitType()))
         return false;
-    return !Heap::isMarked(this);
+    return !vm.heap.isMarked(this);
 }
 
 static Seconds timeToLive(JITCode::JITType jitType)
@@ -1040,7 +1040,7 @@
 
 bool CodeBlock::shouldJettisonDueToOldAge(const ConcurrentJSLocker&)
 {
-    if (Heap::isMarked(this))
+    if (m_vm->heap.isMarked(this))
         return false;
 
     if (UNLIKELY(Options::forceCodeBlockToJettisonDueToOldAge()))
@@ -1053,12 +1053,12 @@
 }
 
 #if ENABLE(DFG_JIT)
-static bool shouldMarkTransition(DFG::WeakReferenceTransition& transition)
+static bool shouldMarkTransition(VM& vm, DFG::WeakReferenceTransition& transition)
 {
-    if (transition.m_codeOrigin && !Heap::isMarked(transition.m_codeOrigin.get()))
+    if (transition.m_codeOrigin && !vm.heap.isMarked(transition.m_codeOrigin.get()))
         return false;
     
-    if (!Heap::isMarked(transition.m_from.get()))
+    if (!vm.heap.isMarked(transition.m_from.get()))
         return false;
     
     return true;
@@ -1086,7 +1086,7 @@
                     vm.heap.structureIDTable().get(oldStructureID);
                 Structure* newStructure =
                     vm.heap.structureIDTable().get(newStructureID);
-                if (Heap::isMarked(oldStructure))
+                if (vm.heap.isMarked(oldStructure))
                     visitor.appendUnbarriered(newStructure);
                 continue;
             }
@@ -1112,7 +1112,7 @@
             weakReference->markIfCheap(visitor);
 
         for (auto& transition : dfgCommon->transitions) {
-            if (shouldMarkTransition(transition)) {
+            if (shouldMarkTransition(vm, transition)) {
                 // If the following three things are live, then the target of the
                 // transition is also live:
                 //
@@ -1144,7 +1144,8 @@
     UNUSED_PARAM(visitor);
     
 #if ENABLE(DFG_JIT)
-    if (Heap::isMarked(this))
+    VM& vm = *m_vm;
+    if (vm.heap.isMarked(this))
         return;
     
     // In rare and weird cases, this could be called on a baseline CodeBlock. One that I found was
@@ -1160,8 +1161,8 @@
     bool allAreLiveSoFar = true;
     for (unsigned i = 0; i < dfgCommon->weakReferences.size(); ++i) {
         JSCell* reference = dfgCommon->weakReferences[i].get();
-        ASSERT(!jsDynamicCast<CodeBlock*>(*reference->vm(), reference));
-        if (!Heap::isMarked(reference)) {
+        ASSERT(!jsDynamicCast<CodeBlock*>(vm, reference));
+        if (!vm.heap.isMarked(reference)) {
             allAreLiveSoFar = false;
             break;
         }
@@ -1168,7 +1169,7 @@
     }
     if (allAreLiveSoFar) {
         for (unsigned i = 0; i < dfgCommon->weakStructureReferences.size(); ++i) {
-            if (!Heap::isMarked(dfgCommon->weakStructureReferences[i].get())) {
+            if (!vm.heap.isMarked(dfgCommon->weakStructureReferences[i].get())) {
                 allAreLiveSoFar = false;
                 break;
             }
@@ -1191,13 +1192,13 @@
     VM& vm = *m_vm;
     const Vector<InstructionStream::Offset>& propertyAccessInstructions = m_unlinkedCode->propertyAccessInstructions();
 
-    auto handleGetPutFromScope = [](auto& metadata) {
+    auto handleGetPutFromScope = [&] (auto& metadata) {
         GetPutInfo getPutInfo = metadata.m_getPutInfo;
         if (getPutInfo.resolveType() == GlobalVar || getPutInfo.resolveType() == GlobalVarWithVarInjectionChecks 
             || getPutInfo.resolveType() == LocalClosureVar || getPutInfo.resolveType() == GlobalLexicalVar || getPutInfo.resolveType() == GlobalLexicalVarWithVarInjectionChecks)
             return;
         WriteBarrierBase<Structure>& structure = metadata.m_structure;
-        if (!structure || Heap::isMarked(structure.get()))
+        if (!structure || vm.heap.isMarked(structure.get()))
             return;
         if (Options::verboseOSR())
             dataLogF("Clearing scope access with structure %p.\n", structure.get());
@@ -1213,7 +1214,7 @@
             if (metadata.m_mode != GetByIdMode::Default)
                 break;
             StructureID oldStructureID = metadata.m_modeMetadata.defaultMode.structureID;
-            if (!oldStructureID || Heap::isMarked(vm.heap.structureIDTable().get(oldStructureID)))
+            if (!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                 break;
             if (Options::verboseOSR())
                 dataLogF("Clearing LLInt property access.\n");
@@ -1223,7 +1224,7 @@
         case op_get_by_id_direct: {
             auto& metadata = curInstruction->as<OpGetByIdDirect>().metadata(this);
             StructureID oldStructureID = metadata.m_structureID;
-            if (!oldStructureID || Heap::isMarked(vm.heap.structureIDTable().get(oldStructureID)))
+            if (!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
                 break;
             if (Options::verboseOSR())
                 dataLogF("Clearing LLInt property access.\n");
@@ -1236,9 +1237,9 @@
             StructureID oldStructureID = metadata.m_oldStructureID;
             StructureID newStructureID = metadata.m_newStructureID;
             StructureChain* chain = metadata.m_structureChain.get();
-            if ((!oldStructureID || Heap::isMarked(vm.heap.structureIDTable().get(oldStructureID)))
-                && (!newStructureID || Heap::isMarked(vm.heap.structureIDTable().get(newStructureID)))
-                && (!chain || Heap::isMarked(chain)))
+            if ((!oldStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(oldStructureID)))
+                && (!newStructureID || vm.heap.isMarked(vm.heap.structureIDTable().get(newStructureID)))
+                && (!chain || vm.heap.isMarked(chain)))
                 break;
             if (Options::verboseOSR())
                 dataLogF("Clearing LLInt put transition.\n");
@@ -1254,7 +1255,7 @@
             break;
         case op_to_this: {
             auto& metadata = curInstruction->as<OpToThis>().metadata(this);
-            if (!metadata.m_cachedStructure || Heap::isMarked(metadata.m_cachedStructure.get()))
+            if (!metadata.m_cachedStructure || vm.heap.isMarked(metadata.m_cachedStructure.get()))
                 break;
             if (Options::verboseOSR())
                 dataLogF("Clearing LLInt to_this with structure %p.\n", metadata.m_cachedStructure.get());
@@ -1268,7 +1269,7 @@
             if (!cacheWriteBarrier || cacheWriteBarrier.unvalidatedGet() == JSCell::seenMultipleCalleeObjects())
                 break;
             JSCell* cachedFunction = cacheWriteBarrier.get();
-            if (Heap::isMarked(cachedFunction))
+            if (vm.heap.isMarked(cachedFunction))
                 break;
             if (Options::verboseOSR())
                 dataLogF("Clearing LLInt create_this with cached callee %p.\n", cachedFunction);
@@ -1281,7 +1282,7 @@
             // to the symbol table strongly. But it's nice to be on the safe side.
             auto& metadata = curInstruction->as<OpResolveScope>().metadata(this);
             WriteBarrierBase<SymbolTable>& symbolTable = metadata.m_symbolTable;
-            if (!symbolTable || Heap::isMarked(symbolTable.get()))
+            if (!symbolTable || vm.heap.isMarked(symbolTable.get()))
                 break;
             if (Options::verboseOSR())
                 dataLogF("Clearing dead symbolTable %p.\n", symbolTable.get());
@@ -1314,11 +1315,11 @@
             return true;
         };
 
-        if (!Heap::isMarked(std::get<0>(pair.key)))
+        if (!vm.heap.isMarked(std::get<0>(pair.key)))
             return clear();
 
         for (const LLIntPrototypeLoadAdaptiveStructureWatchpoint* watchpoint : pair.value) {
-            if (!watchpoint->key().isStillLive())
+            if (!watchpoint->key().isStillLive(vm))
                 return clear();
         }
 
@@ -1326,12 +1327,12 @@
     });
 
     forEachLLIntCallLinkInfo([&](LLIntCallLinkInfo& callLinkInfo) {
-        if (callLinkInfo.isLinked() && !Heap::isMarked(callLinkInfo.callee.get())) {
+        if (callLinkInfo.isLinked() && !vm.heap.isMarked(callLinkInfo.callee.get())) {
             if (Options::verboseOSR())
                 dataLog("Clearing LLInt call from ", *this, "\n");
             callLinkInfo.unlink();
         }
-        if (!!callLinkInfo.lastSeenCallee && !Heap::isMarked(callLinkInfo.lastSeenCallee.get()))
+        if (!!callLinkInfo.lastSeenCallee && !vm.heap.isMarked(callLinkInfo.lastSeenCallee.get()))
             callLinkInfo.lastSeenCallee.clear();
     });
 }
@@ -1356,8 +1357,10 @@
 }
 #endif
 
-void CodeBlock::finalizeUnconditionally(VM&)
+void CodeBlock::finalizeUnconditionally(VM& vm)
 {
+    UNUSED_PARAM(vm);
+
     updateAllPredictions();
     
     if (JITCode::couldBeInterpreted(jitType()))
@@ -1371,7 +1374,7 @@
 #if ENABLE(DFG_JIT)
     if (JITCode::isOptimizingJIT(jitType())) {
         DFG::CommonData* dfgCommon = m_jitCode->dfgCommon();
-        dfgCommon->recordedStatuses.finalize();
+        dfgCommon->recordedStatuses.finalize(vm);
     }
 #endif // ENABLE(DFG_JIT)
 
@@ -1952,6 +1955,8 @@
     UNUSED_PARAM(mode);
     UNUSED_PARAM(detail);
 #endif
+
+    VM& vm = *m_vm;
     
     CODEBLOCK_LOG_EVENT(this, "jettison", ("due to ", reason, ", counting = ", mode == CountReoptimization, ", detail = ", pointerDump(detail)));
 
@@ -1976,13 +1981,13 @@
                 JSCell* origin = transition.m_codeOrigin.get();
                 JSCell* from = transition.m_from.get();
                 JSCell* to = transition.m_to.get();
-                if ((!origin || Heap::isMarked(origin)) && Heap::isMarked(from))
+                if ((!origin || vm.heap.isMarked(origin)) && vm.heap.isMarked(from))
                     continue;
                 dataLog("    Transition under ", RawPointer(origin), ", ", RawPointer(from), " -> ", RawPointer(to), ".\n");
             }
             for (unsigned i = 0; i < dfgCommon->weakReferences.size(); ++i) {
                 JSCell* weak = dfgCommon->weakReferences[i].get();
-                if (Heap::isMarked(weak))
+                if (vm.heap.isMarked(weak))
                     continue;
                 dataLog("    Weak reference ", RawPointer(weak), ".\n");
             }
@@ -1990,7 +1995,6 @@
     }
 #endif // ENABLE(DFG_JIT)
 
-    VM& vm = *m_vm;
     DeferGCForAWhile deferGC(*heap());
     
     // We want to accomplish two things here:
@@ -2010,7 +2014,7 @@
         // This accomplishes (1), and does its own book-keeping about whether it has already happened.
         if (!jitCode()->dfgCommon()->invalidate()) {
             // We've already been invalidated.
-            RELEASE_ASSERT(this != replacement() || (vm.heap.isCurrentThreadBusy() && !Heap::isMarked(ownerExecutable())));
+            RELEASE_ASSERT(this != replacement() || (vm.heap.isCurrentThreadBusy() && !vm.heap.isMarked(ownerExecutable())));
             return;
         }
     }
@@ -2042,7 +2046,7 @@
 
     // Jettison can happen during GC. We don't want to install code to a dead executable
     // because that would add a dead object to the remembered set.
-    if (vm.heap.isCurrentThreadBusy() && !Heap::isMarked(ownerExecutable()))
+    if (vm.heap.isCurrentThreadBusy() && !vm.heap.isMarked(ownerExecutable()))
         return;
 
     // This accomplishes (2).

Modified: trunk/Source/_javascript_Core/bytecode/CodeBlock.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/CodeBlock.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/CodeBlock.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -919,7 +919,7 @@
     }
 
     bool shouldVisitStrongly(const ConcurrentJSLocker&);
-    bool shouldJettisonDueToWeakReference();
+    bool shouldJettisonDueToWeakReference(VM&);
     bool shouldJettisonDueToOldAge(const ConcurrentJSLocker&);
     
     void propagateTransitions(const ConcurrentJSLocker&, SlotVisitor&);

Modified: trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -75,7 +75,7 @@
     if (codeBlock->shouldVisitStrongly(locker))
         visitor.appendUnbarriered(codeBlock);
     
-    if (!Heap::isMarked(codeBlock))
+    if (!vm.heap.isMarked(codeBlock))
         vm.executableToCodeBlockEdgesWithFinalizers.add(edge);
     
     if (JITCode::isOptimizingJIT(codeBlock->jitType())) {
@@ -125,8 +125,8 @@
 {
     CodeBlock* codeBlock = m_codeBlock.get();
     
-    if (!Heap::isMarked(codeBlock)) {
-        if (codeBlock->shouldJettisonDueToWeakReference())
+    if (!vm.heap.isMarked(codeBlock)) {
+        if (codeBlock->shouldJettisonDueToWeakReference(vm))
             codeBlock->jettison(Profiler::JettisonDueToWeakReference);
         else
             codeBlock->jettison(Profiler::JettisonDueToOldAge);
@@ -189,7 +189,7 @@
     codeBlock->propagateTransitions(locker, visitor);
     codeBlock->determineLiveness(locker, visitor);
     
-    if (Heap::isMarked(codeBlock))
+    if (vm.heap.isMarked(codeBlock))
         vm.executableToCodeBlockEdgesWithConstraints.remove(this);
 }
 

Modified: trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -476,15 +476,15 @@
         variant.markIfCheap(visitor);
 }
 
-bool GetByIdStatus::finalize()
+bool GetByIdStatus::finalize(VM& vm)
 {
     for (GetByIdVariant& variant : m_variants) {
-        if (!variant.finalize())
+        if (!variant.finalize(vm))
             return false;
     }
-    if (m_moduleNamespaceObject && !Heap::isMarked(m_moduleNamespaceObject))
+    if (m_moduleNamespaceObject && !vm.heap.isMarked(m_moduleNamespaceObject))
         return false;
-    if (m_moduleEnvironment && !Heap::isMarked(m_moduleEnvironment))
+    if (m_moduleEnvironment && !vm.heap.isMarked(m_moduleEnvironment))
         return false;
     return true;
 }

Modified: trunk/Source/_javascript_Core/bytecode/GetByIdStatus.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/GetByIdStatus.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdStatus.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -141,7 +141,7 @@
     ScopeOffset scopeOffset() const { return m_scopeOffset; }
     
     void markIfCheap(SlotVisitor&);
-    bool finalize(); // Return true if this gets to live.
+    bool finalize(VM&); // Return true if this gets to live.
     
     void dump(PrintStream&) const;
     

Modified: trunk/Source/_javascript_Core/bytecode/GetByIdVariant.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/GetByIdVariant.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdVariant.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -149,15 +149,15 @@
     m_structureSet.markIfCheap(visitor);
 }
 
-bool GetByIdVariant::finalize()
+bool GetByIdVariant::finalize(VM& vm)
 {
-    if (!m_structureSet.isStillAlive())
+    if (!m_structureSet.isStillAlive(vm))
         return false;
-    if (!m_conditionSet.areStillLive())
+    if (!m_conditionSet.areStillLive(vm))
         return false;
-    if (m_callLinkStatus && !m_callLinkStatus->finalize())
+    if (m_callLinkStatus && !m_callLinkStatus->finalize(vm))
         return false;
-    if (m_intrinsicFunction && !Heap::isMarked(m_intrinsicFunction))
+    if (m_intrinsicFunction && !vm.heap.isMarked(m_intrinsicFunction))
         return false;
     return true;
 }

Modified: trunk/Source/_javascript_Core/bytecode/GetByIdVariant.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/GetByIdVariant.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdVariant.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -74,7 +74,7 @@
     bool attemptToMerge(const GetByIdVariant& other);
     
     void markIfCheap(SlotVisitor&);
-    bool finalize();
+    bool finalize(VM&);
     
     void dump(PrintStream&) const;
     void dumpInContext(PrintStream&, DumpContext*) const;

Modified: trunk/Source/_javascript_Core/bytecode/InByIdStatus.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/InByIdStatus.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/InByIdStatus.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -258,10 +258,10 @@
         variant.markIfCheap(visitor);
 }
 
-bool InByIdStatus::finalize()
+bool InByIdStatus::finalize(VM& vm)
 {
     for (InByIdVariant& variant : m_variants) {
-        if (!variant.finalize())
+        if (!variant.finalize(vm))
             return false;
     }
     return true;

Modified: trunk/Source/_javascript_Core/bytecode/InByIdStatus.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/InByIdStatus.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/InByIdStatus.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -106,7 +106,7 @@
     void filter(const StructureSet&);
     
     void markIfCheap(SlotVisitor&);
-    bool finalize();
+    bool finalize(VM&);
 
     void dump(PrintStream&) const;
 

Modified: trunk/Source/_javascript_Core/bytecode/InByIdVariant.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/InByIdVariant.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/InByIdVariant.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -72,11 +72,11 @@
     m_structureSet.markIfCheap(visitor);
 }
 
-bool InByIdVariant::finalize()
+bool InByIdVariant::finalize(VM& vm)
 {
-    if (!m_structureSet.isStillAlive())
+    if (!m_structureSet.isStillAlive(vm))
         return false;
-    if (!m_conditionSet.areStillLive())
+    if (!m_conditionSet.areStillLive(vm))
         return false;
     return true;
 }

Modified: trunk/Source/_javascript_Core/bytecode/InByIdVariant.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/InByIdVariant.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/InByIdVariant.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -57,7 +57,7 @@
     bool attemptToMerge(const InByIdVariant& other);
     
     void markIfCheap(SlotVisitor&);
-    bool finalize();
+    bool finalize(VM&);
 
     void dump(PrintStream&) const;
     void dumpInContext(PrintStream&, DumpContext*) const;

Modified: trunk/Source/_javascript_Core/bytecode/ObjectPropertyCondition.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/ObjectPropertyCondition.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/ObjectPropertyCondition.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -142,15 +142,15 @@
     return isWatchable(m_object->structure(), effort);
 }
 
-bool ObjectPropertyCondition::isStillLive() const
+bool ObjectPropertyCondition::isStillLive(VM& vm) const
 {
     if (!*this)
         return false;
     
-    if (!Heap::isMarked(m_object))
+    if (!vm.heap.isMarked(m_object))
         return false;
     
-    return m_condition.isStillLive();
+    return m_condition.isStillLive(vm);
 }
 
 void ObjectPropertyCondition::validateReferences(const TrackedReferences& tracked) const

Modified: trunk/Source/_javascript_Core/bytecode/ObjectPropertyCondition.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/ObjectPropertyCondition.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/ObjectPropertyCondition.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -244,7 +244,7 @@
     }
     
     // This means that the objects involved in this are still live.
-    bool isStillLive() const;
+    bool isStillLive(VM&) const;
     
     void validateReferences(const TrackedReferences&) const;
 

Modified: trunk/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -141,10 +141,10 @@
     return false;
 }
 
-bool ObjectPropertyConditionSet::areStillLive() const
+bool ObjectPropertyConditionSet::areStillLive(VM& vm) const
 {
     for (const ObjectPropertyCondition& condition : *this) {
-        if (!condition.isStillLive())
+        if (!condition.isStillLive(vm))
             return false;
     }
     return true;

Modified: trunk/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/ObjectPropertyConditionSet.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -111,7 +111,7 @@
     bool structuresEnsureValidityAssumingImpurePropertyWatchpoint() const;
     
     bool needImpurePropertyWatchpoint() const;
-    bool areStillLive() const;
+    bool areStillLive(VM&) const;
     
     void dumpInContext(PrintStream&, DumpContext*) const;
     void dump(PrintStream&) const;

Modified: trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/PolymorphicAccess.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -324,7 +324,7 @@
     }
     if (Vector<WriteBarrier<JSCell>>* weakReferences = m_weakReferences.get()) {
         for (WriteBarrier<JSCell>& weakReference : *weakReferences) {
-            if (!Heap::isMarked(weakReference.get()))
+            if (!vm.heap.isMarked(weakReference.get()))
                 return false;
         }
     }

Modified: trunk/Source/_javascript_Core/bytecode/PropertyCondition.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/PropertyCondition.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/PropertyCondition.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -352,15 +352,15 @@
         && isWatchableWhenValid(structure, effort);
 }
 
-bool PropertyCondition::isStillLive() const
+bool PropertyCondition::isStillLive(VM& vm) const
 {
-    if (hasPrototype() && prototype() && !Heap::isMarked(prototype()))
+    if (hasPrototype() && prototype() && !vm.heap.isMarked(prototype()))
         return false;
     
     if (hasRequiredValue()
         && requiredValue()
         && requiredValue().isCell()
-        && !Heap::isMarked(requiredValue().asCell()))
+        && !vm.heap.isMarked(requiredValue().asCell()))
         return false;
     
     return true;

Modified: trunk/Source/_javascript_Core/bytecode/PropertyCondition.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/PropertyCondition.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/PropertyCondition.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -297,7 +297,7 @@
     }
     
     // This means that the objects involved in this are still live.
-    bool isStillLive() const;
+    bool isStillLive(VM&) const;
     
     void validateReferences(const TrackedReferences&) const;
 

Modified: trunk/Source/_javascript_Core/bytecode/PutByIdStatus.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/PutByIdStatus.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/PutByIdStatus.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -386,10 +386,10 @@
         variant.markIfCheap(visitor);
 }
 
-bool PutByIdStatus::finalize()
+bool PutByIdStatus::finalize(VM& vm)
 {
     for (PutByIdVariant& variant : m_variants) {
-        if (!variant.finalize())
+        if (!variant.finalize(vm))
             return false;
     }
     return true;

Modified: trunk/Source/_javascript_Core/bytecode/PutByIdStatus.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/PutByIdStatus.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/PutByIdStatus.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -116,7 +116,7 @@
     const PutByIdVariant& operator[](size_t index) const { return at(index); }
     
     void markIfCheap(SlotVisitor&);
-    bool finalize();
+    bool finalize(VM&);
     
     void merge(const PutByIdStatus&);
     

Modified: trunk/Source/_javascript_Core/bytecode/PutByIdVariant.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/PutByIdVariant.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/PutByIdVariant.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -270,15 +270,15 @@
         m_newStructure->markIfCheap(visitor);
 }
 
-bool PutByIdVariant::finalize()
+bool PutByIdVariant::finalize(VM& vm)
 {
-    if (!m_oldStructure.isStillAlive())
+    if (!m_oldStructure.isStillAlive(vm))
         return false;
-    if (m_newStructure && !Heap::isMarked(m_newStructure))
+    if (m_newStructure && !vm.heap.isMarked(m_newStructure))
         return false;
-    if (!m_conditionSet.areStillLive())
+    if (!m_conditionSet.areStillLive(vm))
         return false;
-    if (m_callLinkStatus && !m_callLinkStatus->finalize())
+    if (m_callLinkStatus && !m_callLinkStatus->finalize(vm))
         return false;
     return true;
 }

Modified: trunk/Source/_javascript_Core/bytecode/PutByIdVariant.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/PutByIdVariant.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/PutByIdVariant.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -132,7 +132,7 @@
     bool attemptToMerge(const PutByIdVariant& other);
     
     void markIfCheap(SlotVisitor&);
-    bool finalize();
+    bool finalize(VM&);
     
     void dump(PrintStream&) const;
     void dumpInContext(PrintStream&, DumpContext*) const;

Modified: trunk/Source/_javascript_Core/bytecode/RecordedStatuses.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/RecordedStatuses.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/RecordedStatuses.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -85,7 +85,7 @@
         pair.second->markIfCheap(slotVisitor);
 }
 
-void RecordedStatuses::finalizeWithoutDeleting()
+void RecordedStatuses::finalizeWithoutDeleting(VM& vm)
 {
     // This variant of finalize gets called from within graph safepoints -- so there may be DFG IR in
     // some compiler thread that points to the statuses. That thread is stopped at a safepoint so
@@ -92,9 +92,9 @@
     // it's OK to edit its data structure, but it's not OK to delete them. Hence we don't remove
     // anything from the vector or delete the unique_ptrs.
     
-    auto finalize = [] (auto& vector) {
+    auto finalize = [&] (auto& vector) {
         for (auto& pair : vector) {
-            if (!pair.second->finalize())
+            if (!pair.second->finalize(vm))
                 *pair.second = { };
         }
     };
@@ -101,12 +101,12 @@
     forEachVector(finalize);
 }
 
-void RecordedStatuses::finalize()
+void RecordedStatuses::finalize(VM& vm)
 {
-    auto finalize = [] (auto& vector) {
+    auto finalize = [&] (auto& vector) {
         vector.removeAllMatching(
             [&] (auto& pair) -> bool {
-                return !*pair.second || !pair.second->finalize();
+                return !*pair.second || !pair.second->finalize(vm);
             });
         vector.shrinkToFit();
     };

Modified: trunk/Source/_javascript_Core/bytecode/RecordedStatuses.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/RecordedStatuses.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/RecordedStatuses.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -50,8 +50,8 @@
     
     void markIfCheap(SlotVisitor& slotVisitor);
     
-    void finalizeWithoutDeleting();
-    void finalize();
+    void finalizeWithoutDeleting(VM&);
+    void finalize(VM&);
     
     void shrinkToFit();
     

Modified: trunk/Source/_javascript_Core/bytecode/StructureSet.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/StructureSet.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/StructureSet.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -37,10 +37,10 @@
         structure->markIfCheap(visitor);
 }
 
-bool StructureSet::isStillAlive() const
+bool StructureSet::isStillAlive(VM& vm) const
 {
     for (Structure* structure : *this) {
-        if (!Heap::isMarked(structure))
+        if (!vm.heap.isMarked(structure))
             return false;
     }
     return true;

Modified: trunk/Source/_javascript_Core/bytecode/StructureSet.h (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/StructureSet.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/StructureSet.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -55,7 +55,7 @@
     }
 
     void markIfCheap(SlotVisitor&) const;
-    bool isStillAlive() const;
+    bool isStillAlive(VM&) const;
     
     void dumpInContext(PrintStream&, DumpContext*) const;
     void dump(PrintStream&) const;

Modified: trunk/Source/_javascript_Core/bytecode/StructureStubInfo.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/bytecode/StructureStubInfo.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/bytecode/StructureStubInfo.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -272,7 +272,7 @@
     
     bufferedStructures.genericFilter(
         [&] (Structure* structure) -> bool {
-            return Heap::isMarked(structure);
+            return vm.heap.isMarked(structure);
         });
 
     switch (cacheType) {
@@ -279,7 +279,7 @@
     case CacheType::GetByIdSelf:
     case CacheType::PutByIdReplace:
     case CacheType::InByIdSelf:
-        if (Heap::isMarked(u.byIdSelf.baseObjectStructure.get()))
+        if (vm.heap.isMarked(u.byIdSelf.baseObjectStructure.get()))
             return;
         break;
     case CacheType::Stub:

Modified: trunk/Source/_javascript_Core/dfg/DFGPlan.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/dfg/DFGPlan.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/dfg/DFGPlan.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -664,7 +664,8 @@
 
 void Plan::finalizeInGC()
 {
-    m_recordedStatuses.finalizeWithoutDeleting();
+    ASSERT(m_vm);
+    m_recordedStatuses.finalizeWithoutDeleting(*m_vm);
 }
 
 bool Plan::isKnownToBeLiveDuringGC()
@@ -671,11 +672,11 @@
 {
     if (m_stage == Cancelled)
         return false;
-    if (!Heap::isMarked(m_codeBlock->ownerExecutable()))
+    if (!m_vm->heap.isMarked(m_codeBlock->ownerExecutable()))
         return false;
-    if (!Heap::isMarked(m_codeBlock->alternative()))
+    if (!m_vm->heap.isMarked(m_codeBlock->alternative()))
         return false;
-    if (!!m_profiledDFGCodeBlock && !Heap::isMarked(m_profiledDFGCodeBlock))
+    if (!!m_profiledDFGCodeBlock && !m_vm->heap.isMarked(m_profiledDFGCodeBlock))
         return false;
     return true;
 }

Modified: trunk/Source/_javascript_Core/heap/GCIncomingRefCounted.h (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/GCIncomingRefCounted.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/GCIncomingRefCounted.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -82,7 +82,7 @@
     // to use this with a filter function that can return false unless
     // you're also walking the GC's list.
     template<typename FilterFunctionType>
-    bool filterIncomingReferences(FilterFunctionType&);
+    bool filterIncomingReferences(FilterFunctionType&&);
     
 private:
     static uintptr_t singletonFlag() { return 1; }

Modified: trunk/Source/_javascript_Core/heap/GCIncomingRefCountedInlines.h (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/GCIncomingRefCountedInlines.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/GCIncomingRefCountedInlines.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -57,7 +57,7 @@
 
 template<typename T>
 template<typename FilterFunctionType>
-bool GCIncomingRefCounted<T>::filterIncomingReferences(FilterFunctionType& filterFunction)
+bool GCIncomingRefCounted<T>::filterIncomingReferences(FilterFunctionType&& filterFunction)
 {
     const bool verbose = false;
     

Modified: trunk/Source/_javascript_Core/heap/GCIncomingRefCountedSet.h (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/GCIncomingRefCountedSet.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/GCIncomingRefCountedSet.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -41,14 +41,11 @@
     // Returns true if the native object is new to this set.
     bool addReference(JSCell*, T*);
     
-    void sweep();
+    void sweep(VM&);
     
     size_t size() const { return m_bytes; };
     
 private:
-    static bool removeAll(JSCell*);
-    static bool removeDead(JSCell*);
-    
     Vector<T*> m_vector;
     size_t m_bytes;
 };

Modified: trunk/Source/_javascript_Core/heap/GCIncomingRefCountedSetInlines.h (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/GCIncomingRefCountedSetInlines.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/GCIncomingRefCountedSetInlines.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -40,7 +40,7 @@
 void GCIncomingRefCountedSet<T>::lastChanceToFinalize()
 {
     for (size_t i = m_vector.size(); i--;)
-        m_vector[i]->filterIncomingReferences(removeAll);
+        m_vector[i]->filterIncomingReferences([] (JSCell*) { return false; });
 }
 
 template<typename T>
@@ -59,7 +59,7 @@
 }
 
 template<typename T>
-void GCIncomingRefCountedSet<T>::sweep()
+void GCIncomingRefCountedSet<T>::sweep(VM& vm)
 {
     for (size_t i = 0; i < m_vector.size(); ++i) {
         T* object = m_vector[i];
@@ -66,7 +66,7 @@
         size_t size = object->gcSizeEstimateInBytes();
         ASSERT(object->isDeferred());
         ASSERT(object->numberOfIncomingReferences());
-        if (!object->filterIncomingReferences(removeDead))
+        if (!object->filterIncomingReferences([&] (JSCell* cell) { return vm.heap.isMarked(cell); }))
             continue;
         m_bytes -= size;
         m_vector[i--] = m_vector.last();
@@ -74,16 +74,4 @@
     }
 }
 
-template<typename T>
-bool GCIncomingRefCountedSet<T>::removeAll(JSCell*)
-{
-    return false;
-}
-
-template<typename T>
-bool GCIncomingRefCountedSet<T>::removeDead(JSCell* cell)
-{
-    return Heap::isMarked(cell);
-}
-
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/heap/Heap.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/Heap.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/Heap.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -1010,7 +1010,7 @@
             return;
         }
     } else
-        ASSERT(Heap::isMarked(cell));
+        ASSERT(isMarked(cell));
     // It could be that the object was *just* marked. This means that the collector may set the
     // state to DefinitelyGrey and then to PossiblyOldOrBlack at any time. It's OK for us to
     // race with the collector here. If we win then this is accurate because the object _will_
@@ -1494,7 +1494,7 @@
     }
         
     if (vm()->typeProfiler())
-        vm()->typeProfiler()->invalidateTypeSetCache();
+        vm()->typeProfiler()->invalidateTypeSetCache(*vm());
 
     reapWeakHandles();
     pruneStaleEntriesFromWeakGCMaps();
@@ -2212,7 +2212,7 @@
 
 void Heap::sweepArrayBuffers()
 {
-    m_arrayBuffers.sweep();
+    m_arrayBuffers.sweep(*vm());
 }
 
 void Heap::snapshotUnswept()
@@ -2833,7 +2833,7 @@
             iterateExecutingAndCompilingCodeBlocksWithoutHoldingLocks(
                 [&] (CodeBlock* codeBlock) {
                     // Visit the CodeBlock as a constraint only if it's black.
-                    if (Heap::isMarked(codeBlock)
+                    if (isMarked(codeBlock)
                         && codeBlock->cellState() == CellState::PossiblyBlack)
                         slotVisitor.visitAsConstraint(codeBlock);
                 });

Modified: trunk/Source/_javascript_Core/heap/Heap.h (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/Heap.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/Heap.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -123,7 +123,7 @@
     // our scan to run faster. 
     static const unsigned s_timeCheckResolution = 16;
 
-    static bool isMarked(const void*);
+    bool isMarked(const void*);
     static bool testAndSetMarked(HeapVersion, const void*);
     
     static size_t cellSize(const void*);

Modified: trunk/Source/_javascript_Core/heap/HeapInlines.h (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/HeapInlines.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/HeapInlines.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -68,8 +68,6 @@
     return m_worldIsStopped;
 }
 
-// FIXME: This should be an instance method, so that it can get the markingVersion() quickly.
-// https://bugs.webkit.org/show_bug.cgi?id=179988
 ALWAYS_INLINE bool Heap::isMarked(const void* rawCell)
 {
     HeapCell* cell = bitwise_cast<HeapCell*>(rawCell);
@@ -76,7 +74,7 @@
     if (cell->isLargeAllocation())
         return cell->largeAllocation().isMarked();
     MarkedBlock& block = cell->markedBlock();
-    return block.isMarked(block.vm()->heap.objectSpace().markingVersion(), cell);
+    return block.isMarked(m_objectSpace.markingVersion(), cell);
 }
 
 ALWAYS_INLINE bool Heap::testAndSetMarked(HeapVersion markingVersion, const void* rawCell)

Modified: trunk/Source/_javascript_Core/heap/HeapSnapshotBuilder.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/HeapSnapshotBuilder.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/HeapSnapshotBuilder.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -80,7 +80,7 @@
 {
     ASSERT(m_profiler.activeSnapshotBuilder() == this);
 
-    ASSERT(Heap::isMarked(cell));
+    ASSERT(m_profiler.vm().heap.isMarked(cell));
 
     NodeIdentifier identifier;
     if (previousSnapshotHasNodeForCell(cell, identifier))

Modified: trunk/Source/_javascript_Core/heap/SlotVisitor.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/heap/SlotVisitor.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/heap/SlotVisitor.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -285,7 +285,7 @@
 template<typename ContainerType>
 ALWAYS_INLINE void SlotVisitor::appendToMarkStack(ContainerType& container, JSCell* cell)
 {
-    ASSERT(Heap::isMarked(cell));
+    ASSERT(m_heap.isMarked(cell));
     ASSERT(!cell->isZapped());
     
     container.noteMarked();
@@ -354,7 +354,7 @@
 
 ALWAYS_INLINE void SlotVisitor::visitChildren(const JSCell* cell)
 {
-    ASSERT(Heap::isMarked(cell));
+    ASSERT(m_heap.isMarked(cell));
     
     SetCurrentCellScope currentCellScope(*this, cell);
     

Modified: trunk/Source/_javascript_Core/jit/PolymorphicCallStubRoutine.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/jit/PolymorphicCallStubRoutine.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/jit/PolymorphicCallStubRoutine.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -130,10 +130,10 @@
     }
 }
 
-bool PolymorphicCallStubRoutine::visitWeak(VM&)
+bool PolymorphicCallStubRoutine::visitWeak(VM& vm)
 {
     for (auto& variant : m_variants) {
-        if (!Heap::isMarked(variant.get()))
+        if (!vm.heap.isMarked(variant.get()))
             return false;
     }
     return true;

Modified: trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -212,7 +212,7 @@
     // If we did, we might end up keeping functions (and their global objects) alive that happened to
     // get caught in a trace.
     for (const auto& frame : *m_stackTrace.get()) {
-        if (!frame.isMarked()) {
+        if (!frame.isMarked(vm)) {
             computeErrorInfo(vm);
             return;
         }

Modified: trunk/Source/_javascript_Core/runtime/InferredValueInlines.h (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/InferredValueInlines.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/InferredValueInlines.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -34,7 +34,7 @@
     JSValue value = m_value.get();
     
     if (value && value.isCell()) {
-        if (Heap::isMarked(value.asCell()))
+        if (vm.heap.isMarked(value.asCell()))
             return;
         
         invalidate(vm, StringFireDetail("InferredValue clean-up during GC"));

Modified: trunk/Source/_javascript_Core/runtime/StackFrame.h (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/StackFrame.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/StackFrame.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -58,7 +58,7 @@
     }
     
     void visitChildren(SlotVisitor&);
-    bool isMarked() const { return (!m_callee || Heap::isMarked(m_callee.get())) && (!m_codeBlock || Heap::isMarked(m_codeBlock.get())); }
+    bool isMarked(VM& vm) const { return (!m_callee || vm.heap.isMarked(m_callee.get())) && (!m_codeBlock || vm.heap.isMarked(m_codeBlock.get())); }
 
 private:
     WriteBarrier<JSCell> m_callee { };

Modified: trunk/Source/_javascript_Core/runtime/Structure.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/Structure.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/Structure.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -1054,20 +1054,21 @@
         thisObject->m_propertyTableUnsafe.clear();
 }
 
-bool Structure::isCheapDuringGC()
+bool Structure::isCheapDuringGC(VM& vm)
 {
     // FIXME: We could make this even safer by returning false if this structure's property table
     // has any large property names.
     // https://bugs.webkit.org/show_bug.cgi?id=157334
     
-    return (!m_globalObject || Heap::isMarked(m_globalObject.get()))
-        && (hasPolyProto() || !storedPrototypeObject() || Heap::isMarked(storedPrototypeObject()));
+    return (!m_globalObject || vm.heap.isMarked(m_globalObject.get()))
+        && (hasPolyProto() || !storedPrototypeObject() || vm.heap.isMarked(storedPrototypeObject()));
 }
 
 bool Structure::markIfCheap(SlotVisitor& visitor)
 {
-    if (!isCheapDuringGC())
-        return Heap::isMarked(this);
+    VM& vm = visitor.vm();
+    if (!isCheapDuringGC(vm))
+        return vm.heap.isMarked(this);
     
     visitor.appendUnbarriered(this);
     return true;

Modified: trunk/Source/_javascript_Core/runtime/Structure.h (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/Structure.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/Structure.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -299,7 +299,7 @@
     // increase in footprint because no other object refers to that global object. This method
     // returns true if all user-controlled (and hence unbounded in size) objects referenced from the
     // Structure are already marked.
-    bool isCheapDuringGC();
+    bool isCheapDuringGC(VM&);
     
     // Returns true if this structure is now marked.
     bool markIfCheap(SlotVisitor&);

Modified: trunk/Source/_javascript_Core/runtime/TypeProfiler.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/TypeProfiler.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/TypeProfiler.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -148,13 +148,13 @@
     return m_typeLocationInfo.add(); 
 }
 
-void TypeProfiler::invalidateTypeSetCache()
+void TypeProfiler::invalidateTypeSetCache(VM& vm)
 {
     for (Bag<TypeLocation>::iterator iter = m_typeLocationInfo.begin(); !!iter; ++iter) {
         TypeLocation* location = *iter;
-        location->m_instructionTypeSet->invalidateCache();
+        location->m_instructionTypeSet->invalidateCache(vm);
         if (location->m_globalTypeSet)
-            location->m_globalTypeSet->invalidateCache();
+            location->m_globalTypeSet->invalidateCache(vm);
     }
 }
 

Modified: trunk/Source/_javascript_Core/runtime/TypeProfiler.h (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/TypeProfiler.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/TypeProfiler.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -124,7 +124,7 @@
     TypeLocation* findLocation(unsigned divot, intptr_t sourceID, TypeProfilerSearchDescriptor, VM&);
     GlobalVariableID getNextUniqueVariableID() { return m_nextUniqueVariableID++; }
     TypeLocation* nextTypeLocation();
-    void invalidateTypeSetCache();
+    void invalidateTypeSetCache(VM&);
     void dumpTypeProfilerData(VM&);
     
 private:

Modified: trunk/Source/_javascript_Core/runtime/TypeSet.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/TypeSet.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/TypeSet.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -79,10 +79,12 @@
     }
 }
 
-void TypeSet::invalidateCache()
+void TypeSet::invalidateCache(VM& vm)
 {
     ConcurrentJSLocker locker(m_lock);
-    auto keepMarkedStructuresFilter = [] (Structure* structure) -> bool { return Heap::isMarked(structure); };
+    auto keepMarkedStructuresFilter = [&] (Structure* structure) -> bool {
+        return vm.heap.isMarked(structure);
+    };
     m_structureSet.genericFilter(keepMarkedStructuresFilter);
 }
 

Modified: trunk/Source/_javascript_Core/runtime/TypeSet.h (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/TypeSet.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/TypeSet.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -86,7 +86,7 @@
     static Ref<TypeSet> create() { return adoptRef(*new TypeSet); }
     TypeSet();
     void addTypeInformation(RuntimeType, RefPtr<StructureShape>&&, Structure*, bool sawPolyProtoStructure);
-    void invalidateCache();
+    void invalidateCache(VM&);
     String dumpTypes() const;
     String displayName() const;
     Ref<JSON::ArrayOf<Inspector::Protocol::Runtime::StructureDescription>> allStructureRepresentations() const;

Modified: trunk/Source/_javascript_Core/runtime/WeakMapImpl.cpp (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/WeakMapImpl.cpp	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/WeakMapImpl.cpp	2019-03-25 22:40:58 UTC (rev 243467)
@@ -64,6 +64,7 @@
 template <>
 void WeakMapImpl<WeakMapBucket<WeakMapBucketDataKeyValue>>::visitOutputConstraints(JSCell* cell, SlotVisitor& visitor)
 {
+    VM& vm = visitor.vm();
     auto* thisObject = jsCast<WeakMapImpl*>(cell);
     auto locker = holdLock(thisObject->cellLock());
     auto* buffer = thisObject->buffer();
@@ -71,7 +72,7 @@
         auto* bucket = buffer + index;
         if (bucket->isEmpty() || bucket->isDeleted())
             continue;
-        if (!Heap::isMarked(bucket->key()))
+        if (!vm.heap.isMarked(bucket->key()))
             continue;
         bucket->visitAggregate(visitor);
     }

Modified: trunk/Source/_javascript_Core/runtime/WeakMapImplInlines.h (243466 => 243467)


--- trunk/Source/_javascript_Core/runtime/WeakMapImplInlines.h	2019-03-25 22:15:41 UTC (rev 243466)
+++ trunk/Source/_javascript_Core/runtime/WeakMapImplInlines.h	2019-03-25 22:40:58 UTC (rev 243467)
@@ -31,7 +31,7 @@
 
 // Note that this function can be executed in parallel as long as the mutator stops.
 template<typename WeakMapBucket>
-void WeakMapImpl<WeakMapBucket>::finalizeUnconditionally(VM&)
+void WeakMapImpl<WeakMapBucket>::finalizeUnconditionally(VM& vm)
 {
     auto* buffer = this->buffer();
     for (uint32_t index = 0; index < m_capacity; ++index) {
@@ -39,7 +39,7 @@
         if (bucket->isEmpty() || bucket->isDeleted())
             continue;
 
-        if (Heap::isMarked(bucket->key()))
+        if (vm.heap.isMarked(bucket->key()))
             continue;
 
         bucket->makeDeleted();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to