Title: [188978] trunk/Source/_javascript_Core
- Revision
- 188978
- Author
- akl...@apple.com
- Date
- 2015-08-26 12:21:19 -0700 (Wed, 26 Aug 2015)
Log Message
[JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls.
<https://webkit.org/b/148478>
Reviewed by Geoffrey Garen.
Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers
when it's using the single-transition optimization and the Structure it transitioned
to has been GC'd.
This prevents Structures from keeping WeakBlocks alive longer than necessary when
they've been transitioned away from but are still in use themselves.
* runtime/Structure.cpp:
(JSC::singleSlotTransitionWeakOwner):
(JSC::StructureTransitionTable::singleTransition):
(JSC::StructureTransitionTable::setSingleTransition):
(JSC::StructureTransitionTable::add):
* runtime/StructureTransitionTable.h:
(JSC::StructureTransitionTable::singleTransition): Deleted.
(JSC::StructureTransitionTable::setSingleTransition): Deleted.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (188977 => 188978)
--- trunk/Source/_javascript_Core/ChangeLog 2015-08-26 19:01:44 UTC (rev 188977)
+++ trunk/Source/_javascript_Core/ChangeLog 2015-08-26 19:21:19 UTC (rev 188978)
@@ -1,3 +1,26 @@
+2015-08-26 Andreas Kling <akl...@apple.com>
+
+ [JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls.
+ <https://webkit.org/b/148478>
+
+ Reviewed by Geoffrey Garen.
+
+ Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers
+ when it's using the single-transition optimization and the Structure it transitioned
+ to has been GC'd.
+
+ This prevents Structures from keeping WeakBlocks alive longer than necessary when
+ they've been transitioned away from but are still in use themselves.
+
+ * runtime/Structure.cpp:
+ (JSC::singleSlotTransitionWeakOwner):
+ (JSC::StructureTransitionTable::singleTransition):
+ (JSC::StructureTransitionTable::setSingleTransition):
+ (JSC::StructureTransitionTable::add):
+ * runtime/StructureTransitionTable.h:
+ (JSC::StructureTransitionTable::singleTransition): Deleted.
+ (JSC::StructureTransitionTable::setSingleTransition): Deleted.
+
2015-08-26 Brian Burg <bb...@apple.com>
Web Inspector: REGRESSION(r188965): BackendDispatcher loses request ids when called re-entrantly
Modified: trunk/Source/_javascript_Core/runtime/Structure.cpp (188977 => 188978)
--- trunk/Source/_javascript_Core/runtime/Structure.cpp 2015-08-26 19:01:44 UTC (rev 188977)
+++ trunk/Source/_javascript_Core/runtime/Structure.cpp 2015-08-26 19:21:19 UTC (rev 188978)
@@ -38,6 +38,7 @@
#include "StructureRareDataInlines.h"
#include "WeakGCMapInlines.h"
#include <wtf/CommaPrinter.h>
+#include <wtf/NeverDestroyed.h>
#include <wtf/ProcessID.h>
#include <wtf/RefCountedLeakCounter.h>
#include <wtf/RefPtr.h>
@@ -60,6 +61,41 @@
static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
#endif
+class SingleSlotTransitionWeakOwner final : public WeakHandleOwner {
+ void finalize(Handle<Unknown>, void* context) override
+ {
+ StructureTransitionTable* table = reinterpret_cast<StructureTransitionTable*>(context);
+ ASSERT(table->isUsingSingleSlot());
+ WeakSet::deallocate(table->weakImpl());
+ table->m_data = StructureTransitionTable::UsingSingleSlotFlag;
+ }
+};
+
+static SingleSlotTransitionWeakOwner& singleSlotTransitionWeakOwner()
+{
+ static NeverDestroyed<SingleSlotTransitionWeakOwner> owner;
+ return owner;
+}
+
+inline Structure* StructureTransitionTable::singleTransition() const
+{
+ ASSERT(isUsingSingleSlot());
+ if (WeakImpl* impl = this->weakImpl()) {
+ if (impl->state() == WeakImpl::Live)
+ return jsCast<Structure*>(impl->jsValue().asCell());
+ }
+ return nullptr;
+}
+
+inline void StructureTransitionTable::setSingleTransition(Structure* structure)
+{
+ ASSERT(isUsingSingleSlot());
+ if (WeakImpl* impl = this->weakImpl())
+ WeakSet::deallocate(impl);
+ WeakImpl* impl = WeakSet::allocate(structure, &singleSlotTransitionWeakOwner(), this);
+ m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
+}
+
bool StructureTransitionTable::contains(UniquedStringImpl* rep, unsigned attributes) const
{
if (isUsingSingleSlot()) {
@@ -85,7 +121,7 @@
// This handles the first transition being added.
if (!existingTransition) {
- setSingleTransition(vm, structure);
+ setSingleTransition(structure);
return;
}
Modified: trunk/Source/_javascript_Core/runtime/StructureTransitionTable.h (188977 => 188978)
--- trunk/Source/_javascript_Core/runtime/StructureTransitionTable.h 2015-08-26 19:01:44 UTC (rev 188977)
+++ trunk/Source/_javascript_Core/runtime/StructureTransitionTable.h 2015-08-26 19:21:19 UTC (rev 188978)
@@ -134,6 +134,8 @@
Structure* get(UniquedStringImpl*, unsigned attributes) const;
private:
+ friend class SingleSlotTransitionWeakOwner;
+
bool isUsingSingleSlot() const
{
return m_data & UsingSingleSlotFlag;
@@ -164,24 +166,8 @@
ASSERT(!isUsingSingleSlot());
}
- Structure* singleTransition() const
- {
- ASSERT(isUsingSingleSlot());
- if (WeakImpl* impl = this->weakImpl()) {
- if (impl->state() == WeakImpl::Live)
- return reinterpret_cast<Structure*>(impl->jsValue().asCell());
- }
- return 0;
- }
-
- void setSingleTransition(VM&, Structure* structure)
- {
- ASSERT(isUsingSingleSlot());
- if (WeakImpl* impl = this->weakImpl())
- WeakSet::deallocate(impl);
- WeakImpl* impl = WeakSet::allocate(reinterpret_cast<JSCell*>(structure));
- m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
- }
+ Structure* singleTransition() const;
+ void setSingleTransition(Structure*);
intptr_t m_data;
};
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
