Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1d86f8086971d835b9b42331532d647839b2b17a
https://github.com/WebKit/WebKit/commit/1d86f8086971d835b9b42331532d647839b2b17a
Author: Dan Hecht <[email protected]>
Date: 2026-10-14 (Wed, 14 Oct 2026)
Changed paths:
M Source/JavaScriptCore/heap/AbstractSlotVisitor.h
M Source/JavaScriptCore/heap/Collector.cpp
M Source/JavaScriptCore/heap/SlotVisitor.cpp
M Source/JavaScriptCore/heap/SlotVisitor.h
M Source/JavaScriptCore/heap/VerifierSlotVisitor.cpp
M Source/JavaScriptCore/heap/VerifierSlotVisitor.h
M Source/JavaScriptCore/runtime/JSObject.cpp
M Source/JavaScriptCore/runtime/OptionsList.h
Log Message:
-----------
[JSC] Remove optimizeParallelSlotVisitorsForStoppedMutator and its protocol
https://bugs.webkit.org/show_bug.cgi?id=327462
rdar://189959191
Reviewed by Yusuke Suzuki.
When the mutators are stopped, visiting a JSObject can read its structure and
butterfly directly. Otherwise it has to use a slower protocol, since a mutator
may be reallocating the butterfly at the same time. A SlotVisitor reports which
case applies through mutatorIsStopped().
Only the Collector's own visitor ever reports that the mutators are stopped.
The option optimizeParallelSlotVisitorsForStoppedMutator lets the parallel
visitors do so too, but it has been off since it was added in 2016.
Supporting the parallel visitors needs extra work at every stop and resume,
because they keep marking through both, and that work has a race. Removing the
option fixes the race and simplifies the code that stops and resumes the
mutators, which will need to change for global collections.
The race, with the option on:
Collector thread Parallel visitor thread
----------------------------------------------
----------------------------------------------------
Stop:
heap.m_worldIsStopped = true
visitor.m_mutatorIsStopped = true,
without taking visitor.m_rightToRun
Starts a pass, holding
visitor.m_rightToRun:
reads stale
heap.m_worldIsStopped == false
visitor.m_mutatorIsStopped =
false
Stays in that pass through the
stop.
Resume:
heap.m_worldIsStopped = false
sees visitor.m_mutatorIsStopped == false
restarts the mutators without taking
visitor.m_rightToRun
Starts its next pass:
reads stale
heap.m_worldIsStopped == true
visitor.m_mutatorIsStopped =
true
visits objects with the
direct reads
while the mutators run
The Collector's own visitor needs none of this. Only the thread conducting the
collection uses it, and that thread also runs the stop and the resume, so its
state never changes while it is marking. So the Collector now sets it directly
at the stop and the resume, and the setter asserts the visitor is not
draining. The visitors' rightToRun lock, their check at every pass, and the
resume's wait for them are gone. Since a collection may cover several heaps,
mutatorIsStopped() is now mutatorsAreStopped().
No behavior change with the default options.
* Source/JavaScriptCore/heap/AbstractSlotVisitor.h:
* Source/JavaScriptCore/heap/Collector.cpp:
(JSC::Collector::Collector):
(JSC::Collector::stopThePeriphery):
(JSC::Collector::resumeThePeriphery):
* Source/JavaScriptCore/heap/SlotVisitor.cpp:
(JSC::SlotVisitor::drain):
(JSC::SlotVisitor::performIncrementOfDraining):
(JSC::SlotVisitor::updateMutatorIsStopped): Deleted.
(JSC::SlotVisitor::hasAcknowledgedThatTheMutatorIsResumed const): Deleted.
(JSC::SlotVisitor::mutatorIsStoppedIsUpToDate const): Deleted.
(JSC::SlotVisitor::optimizeForStoppedMutator): Deleted.
* Source/JavaScriptCore/heap/SlotVisitor.h:
* Source/JavaScriptCore/heap/VerifierSlotVisitor.cpp:
(JSC::VerifierSlotVisitor::mutatorsAreStopped const):
(JSC::VerifierSlotVisitor::mutatorIsStopped const): Deleted.
* Source/JavaScriptCore/heap/VerifierSlotVisitor.h:
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObjectWithButterfly::visitButterflyImpl):
* Source/JavaScriptCore/runtime/OptionsList.h:
Canonical link: https://commits.webkit.org/323742@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
