Title: [172976] trunk/Source/_javascript_Core
- Revision
- 172976
- Author
- commit-qu...@webkit.org
- Date
- 2014-08-26 14:24:40 -0700 (Tue, 26 Aug 2014)
Log Message
TypeSet caches structureIDs even after the corresponding Structure could be GCed
https://bugs.webkit.org/show_bug.cgi?id=136178
Patch by Saam Barati <sbar...@apple.com> on 2014-08-26
Reviewed by Geoffrey Garen.
Currently, TypeSet will never remove StructureIDs from its cache,
even after the corresponding Structures could be garbage collected.
Now, when the Garbage Collector collects, and type profiling is
enabled, the Garbage Collector will invalidate all TypeSet caches.
* heap/Heap.cpp:
(JSC::Heap::collect):
* runtime/TypeSet.cpp:
(JSC::TypeSet::addTypeInformation):
(JSC::TypeSet::invalidateCache):
* runtime/TypeSet.h:
* runtime/VM.cpp:
(JSC::VM::invalidateTypeSetCache):
* runtime/VM.h:
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (172975 => 172976)
--- trunk/Source/_javascript_Core/ChangeLog 2014-08-26 21:06:07 UTC (rev 172975)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-08-26 21:24:40 UTC (rev 172976)
@@ -1,3 +1,25 @@
+2014-08-26 Saam Barati <sbar...@apple.com>
+
+ TypeSet caches structureIDs even after the corresponding Structure could be GCed
+ https://bugs.webkit.org/show_bug.cgi?id=136178
+
+ Reviewed by Geoffrey Garen.
+
+ Currently, TypeSet will never remove StructureIDs from its cache,
+ even after the corresponding Structures could be garbage collected.
+ Now, when the Garbage Collector collects, and type profiling is
+ enabled, the Garbage Collector will invalidate all TypeSet caches.
+
+ * heap/Heap.cpp:
+ (JSC::Heap::collect):
+ * runtime/TypeSet.cpp:
+ (JSC::TypeSet::addTypeInformation):
+ (JSC::TypeSet::invalidateCache):
+ * runtime/TypeSet.h:
+ * runtime/VM.cpp:
+ (JSC::VM::invalidateTypeSetCache):
+ * runtime/VM.h:
+
2014-08-26 Michael Saboff <msab...@apple.com>
REGRESSION(r172794) + 32Bit build: for-in-base-reassigned-later-and-change-structure.js fail with NaN result
Modified: trunk/Source/_javascript_Core/heap/Heap.cpp (172975 => 172976)
--- trunk/Source/_javascript_Core/heap/Heap.cpp 2014-08-26 21:06:07 UTC (rev 172975)
+++ trunk/Source/_javascript_Core/heap/Heap.cpp 2014-08-26 21:24:40 UTC (rev 172976)
@@ -982,6 +982,7 @@
if (vm()->typeProfiler()) {
DeferGCForAWhile awhile(*this);
vm()->typeProfilerLog()->processLogEntries(ASCIILiteral("GC"));
+ vm()->invalidateTypeSetCache();
}
RELEASE_ASSERT(!m_deferralDepth);
Modified: trunk/Source/_javascript_Core/runtime/TypeSet.cpp (172975 => 172976)
--- trunk/Source/_javascript_Core/runtime/TypeSet.cpp 2014-08-26 21:06:07 UTC (rev 172975)
+++ trunk/Source/_javascript_Core/runtime/TypeSet.cpp 2014-08-26 21:24:40 UTC (rev 172976)
@@ -71,10 +71,9 @@
m_seenTypes = m_seenTypes | type;
if (id && shape && type != TypeString) {
- ASSERT(m_structureIDHistory.isValidKey(id));
- auto iter = m_structureIDHistory.find(id);
- if (iter == m_structureIDHistory.end()) {
- m_structureIDHistory.set(id, 1);
+ ASSERT(m_structureIDCache.isValidValue(id));
+ auto addResult = m_structureIDCache.add(id);
+ if (addResult.isNewEntry) {
// Make one more pass making sure that we don't have the same shape. (Same shapes may have different StructureIDs).
bool found = false;
String hash = shape->propertyHash();
@@ -92,6 +91,11 @@
}
}
+void TypeSet::invalidateCache()
+{
+ m_structureIDCache.clear();
+}
+
String TypeSet::seenTypes() const
{
if (m_seenTypes == TypeNothing)
Modified: trunk/Source/_javascript_Core/runtime/TypeSet.h (172975 => 172976)
--- trunk/Source/_javascript_Core/runtime/TypeSet.h 2014-08-26 21:06:07 UTC (rev 172975)
+++ trunk/Source/_javascript_Core/runtime/TypeSet.h 2014-08-26 21:24:40 UTC (rev 172976)
@@ -27,7 +27,7 @@
#define TypeSet_h
#include "StructureIDTable.h"
-#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
#include <wtf/RefCounted.h>
#include <wtf/text/WTFString.h>
#include <wtf/Vector.h>
@@ -92,6 +92,7 @@
TypeSet();
void addTypeInformation(RuntimeType, PassRefPtr<StructureShape>, StructureID);
static RuntimeType getRuntimeTypeForValue(JSValue);
+ void invalidateCache();
JS_EXPORT_PRIVATE String seenTypes() const;
String displayName() const;
PassRefPtr<Inspector::Protocol::Array<String>> allPrimitiveTypeNames() const;
@@ -104,7 +105,7 @@
uint32_t m_seenTypes;
Vector<RefPtr<StructureShape>> m_structureHistory;
- HashMap<StructureID, uint8_t> m_structureIDHistory;
+ HashSet<StructureID> m_structureIDCache;
};
} //namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/VM.cpp (172975 => 172976)
--- trunk/Source/_javascript_Core/runtime/VM.cpp 2014-08-26 21:06:07 UTC (rev 172975)
+++ trunk/Source/_javascript_Core/runtime/VM.cpp 2014-08-26 21:24:40 UTC (rev 172976)
@@ -942,6 +942,18 @@
}
}
+void VM::invalidateTypeSetCache()
+{
+ RELEASE_ASSERT(typeProfiler());
+
+ for (Bag<TypeLocation>::iterator iter = m_typeLocationInfo->begin(); !!iter; ++iter) {
+ TypeLocation* location = *iter;
+ location->m_instructionTypeSet->invalidateCache();
+ if (location->m_globalTypeSet)
+ location->m_globalTypeSet->invalidateCache();
+ }
+}
+
void sanitizeStackForVM(VM* vm)
{
logSanitizeStack(vm);
Modified: trunk/Source/_javascript_Core/runtime/VM.h (172975 => 172976)
--- trunk/Source/_javascript_Core/runtime/VM.h 2014-08-26 21:06:07 UTC (rev 172975)
+++ trunk/Source/_javascript_Core/runtime/VM.h 2014-08-26 21:24:40 UTC (rev 172976)
@@ -514,6 +514,7 @@
TypeProfiler* typeProfiler() { return m_typeProfiler.get(); }
TypeLocation* nextTypeLocation();
JS_EXPORT_PRIVATE void dumpTypeProfilerData();
+ void invalidateTypeSetCache();
GlobalVariableID getNextUniqueVariableID() { return m_nextUniqueVariableID++; }
private:
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
