Ignore:
Timestamp:
Apr 3, 2012, 10:28:13 PM (13 years ago)
Author:
[email protected]
Message:

First step toward incremental Weak<T> finalization
​https://bugs.webkit.org/show_bug.cgi?id=82670

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch implements a Weak<T> heap that is compatible with incremental
finalization, while making as few behavior changes as possible. The behavior
changes it makes are:

(*) Weak<T>'s raw JSValue no longer reverts to JSValue() automatically --
instead, a separate flag indicates that the JSValue is no longer valid.
(This is required so that the JSValue can be preserved for later finalization.)
Objects dealing with WeakImpls directly must change to check the flag.

(*) Weak<T> is no longer a subclass of Handle<T>.

(*) DOM GC performance is different -- 9% faster in the geometric mean,
but 15% slower in one specific case:

gc-dom1.html: 6% faster
gc-dom2.html: 23% faster
gc-dom3.html: 17% faster
gc-dom4.html: 15% *slower*

The key features of this new heap are:

(*) Each block knows its own state, independent of any other blocks.

(*) Each block caches its own sweep result.

(*) The heap visits dead Weak<T>s at the end of GC. (It doesn't
mark them yet, since that would be a behavior change.)

  • API/JSCallbackObject.cpp:

(JSC::JSCallbackObjectData::finalize):

  • API/JSCallbackObjectFunctions.h:

(JSC::::init): Updated to use the new WeakHeap API.

  • CMakeLists.txt:
  • GNUmakefile.list.am:
  • JavaScriptCore.gypi:
  • JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Target.pri: Paid the build system tax since I added some new files.
  • heap/Handle.h: Made WeakBlock a friend and exposed slot() as public,

so we can keep passing a Handle<T> to finalizers, to avoid more surface
area change in this patch. A follow-up patch should change the type we
pass to finalizers.

  • heap/HandleHeap.cpp:

(JSC):
(JSC::HandleHeap::writeBarrier):
(JSC::HandleHeap::isLiveNode):

  • heap/HandleHeap.h:

(JSC):
(HandleHeap):
(Node):
(JSC::HandleHeap::Node::Node): Removed all code related to Weak<T>, since
we have a separate WeakHeap now.

  • heap/Heap.cpp:

(JSC::Heap::Heap): Removed m_extraCost because extra cost is accounted
for through our watermark now. Removed m_waterMark because it was unused.

(JSC::Heap::destroy): Updated for addition of WeakHeap.

(JSC::Heap::reportExtraMemoryCostSlowCase): Changed from using its own
variable to participating in the watermark strategy. I wanted to standardize
WeakHeap and all other Heap clients on this strategy, to make sure it's
accurate.

(JSC::Heap::markRoots): Updated for addition of WeakHeap. Added WeakHeap
dead visit pass, as explained above.

(JSC::Heap::collect):
(JSC::Heap::resetAllocators): Updated for addition of WeakHeap.

(JSC::Heap::addFinalizer):
(JSC::Heap::FinalizerOwner::finalize): Updated for new Weak<T> API.

  • heap/Heap.h:

(JSC::Heap::weakHeap):
(Heap):
(JSC::Heap::addToWaterMark): Added a way to participate in the watermarking
strategy, since this is the best way for WeakHeap to report its memory
cost. (I plan to update this in a follow-up patch to make it more accurate,
but for now it is not less accurate than it used to be.)

  • heap/MarkedSpace.cpp:

(JSC::MarkedSpace::MarkedSpace):
(JSC::MarkedSpace::resetAllocators):

  • heap/MarkedSpace.h:

(MarkedSpace):
(JSC::MarkedSpace::addToWaterMark):
(JSC::MarkedSpace::didConsumeFreeList): Removed m_nurseryWaterMark because
it was unused, and I didn't want to update WeakHeap to keep an usused
variable working. Added API for above.

  • heap/PassWeak.h:

(JSC):
(WeakImplAccessor):
(PassWeak):
(JSC::::operator):
(JSC::::get):
(JSC::::was):
(JSC::::PassWeak):
(JSC::::~PassWeak):
(JSC::UnspecifiedBoolType):
(JSC::::leakImpl):
(JSC::adoptWeak):

  • heap/Strong.h:

(JSC::Strong::operator!):
(Strong):
(JSC::Strong::operator UnspecifiedBoolType*):
(JSC::Strong::get):

  • heap/Weak.h:

(Weak):
(JSC::::Weak):
(JSC):
(JSC::::isHashTableDeletedValue):
(JSC::::~Weak):
(JSC::::swap):
(JSC::=):
(JSC::::operator):
(JSC::UnspecifiedBoolType):
(JSC::::release):
(JSC::::clear):
(JSC::::hashTableDeletedValue): Lots of code changes here, but they boil
down to two things:

(*) Allocate WeakImpls from the WeakHeap instead of Handles from the HandleHeap.

(*) Explicitly check WeakImpl::state() for non-liveness before returning
a value (explained above).

These files implement the new Weak<T> heap behavior described above:

  • heap/WeakBlock.cpp: Added.
  • heap/WeakBlock.h: Added.
  • heap/WeakHandleOwner.cpp: Added.
  • heap/WeakHandleOwner.h: Added.
  • heap/WeakHeap.cpp: Added.
  • heap/WeakHeap.h: Added.
  • heap/WeakImpl.h: Added.

One interesting difference from the old heap is that we don't allow
clients to overwrite a WeakImpl after allocating it, and we don't recycle
WeakImpls prior to garbage collection. This is required for lazy finalization,
but it will also help us esablish a useful invariant in the future: allocating
a WeakImpl will be a binding contract to run a finalizer at some point in the
future, even if the WeakImpl is later deallocated.

  • jit/JITStubs.cpp:

(JSC::JITThunks::hostFunctionStub): Check the Weak<T> for ! instead of
its JSValue, since that's our API contract now, and the JSValue might
be stale.

  • runtime/JSCell.h:

(JSC::jsCast): Allow casting NULL pointers because it's useful and harmless.

  • runtime/Structure.cpp:

(JSC::StructureTransitionTable::add): I can't remember why I did this.

  • runtime/StructureTransitionTable.h:
  • runtime/WeakGCMap.h: I had to update these classes because they allocate

and deallocate weak pointers manually. They should probably stop doing that.

Source/WebCore:

Updated WebCore for Weak<T> API changes.

  • bindings/js/DOMWrapperWorld.cpp:

(WebCore::JSStringOwner::finalize): We're not allowed to get() a dead Weak<T>
anymore, so use the debug-only was() helper function instead.

  • bindings/js/JSDOMBinding.h:

(WebCore::uncacheWrapper): Ditto.

  • bindings/js/JSNodeCustom.h:

(WebCore::setInlineCachedWrapper):
(WebCore::clearInlineCachedWrapper): We're not allowed to get() a dead
Weak<T>, so I had to push down these ASSERTs into ScriptWrappable.

  • bindings/js/JSNodeFilterCondition.cpp:

(WebCore::JSNodeFilterCondition::acceptNode): Updated for non-Handle-ness
of Weak<T>.

  • bindings/js/ScriptWrappable.h:

(WebCore::ScriptWrappable::setWrapper):
(WebCore::ScriptWrappable::clearWrapper): Use was(), as above.

Source/WebKit2:

Updated for API change.

  • WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:

(WebKit::NPRuntimeObjectMap::finalize):

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/heap/HandleHeap.h

    r110033 r113141  
    4141class SlotVisitor;
    4242
    43 class JS_EXPORT_PRIVATE WeakHandleOwner {
    44 public:
    45     virtual ~WeakHandleOwner();
    46     virtual bool isReachableFromOpaqueRoots(Handle<Unknown>, void* context, SlotVisitor&);
    47     virtual void finalize(Handle<Unknown>, void* context);
    48 };
    49 
    5043class HandleHeap {
    5144public:
    … …  
    5952    void deallocate(HandleSlot);
    6053
    61     void makeWeak(HandleSlot, WeakHandleOwner* = 0, void* context = 0);
    62     HandleSlot copyWeak(HandleSlot);
    63 
    6454    void visitStrongHandles(HeapRootVisitor&);
    65     void visitWeakHandles(HeapRootVisitor&);
    66     void finalizeWeakHandles();
    6755
    6856    JS_EXPORT_PRIVATE void writeBarrier(HandleSlot, const JSValue&);
    69 
    70 #if !ASSERT_DISABLED
    71     bool hasWeakOwner(HandleSlot, WeakHandleOwner*);
    72     bool hasFinalizer(HandleSlot);
    73 #endif
    7457
    7558    unsigned protectedGlobalObjectCount();
    … …  
    8669        HandleHeap* handleHeap();
    8770
    88         void makeWeak(WeakHandleOwner*, void* context);
    89         bool isWeak();
    90        
    91         WeakHandleOwner* weakOwner();
    92         void* weakOwnerContext();
    93 
    9471        void setPrev(Node*);
    9572        Node* prev();
    … …  
    9976
    10077    private:
    101         WeakHandleOwner* emptyWeakOwner();
    102 
    10378        JSValue m_value;
    10479        HandleHeap* m_handleHeap;
    105         WeakHandleOwner* m_weakOwner;
    106         void* m_weakOwnerContext;
    10780        Node* m_prev;
    10881        Node* m_next;
    … …  
    11588   
    11689#if ENABLE(GC_VALIDATION) || !ASSERT_DISABLED
    117     bool isValidWeakNode(Node*);
    11890    bool isLiveNode(Node*);
    11991#endif
    … …  
    12395
    12496    SentinelLinkedList<Node> m_strongList;
    125     SentinelLinkedList<Node> m_weakList;
    12697    SentinelLinkedList<Node> m_immediateList;
    12798    SinglyLinkedList<Node> m_freeList;
    … …  
    176147}
    177148
    178 inline HandleSlot HandleHeap::copyWeak(HandleSlot other)
    179 {
    180     Node* node = toNode(allocate());
    181     node->makeWeak(toNode(other)->weakOwner(), toNode(other)->weakOwnerContext());
    182     writeBarrier(node->slot(), *other);
    183     *node->slot() = *other;
    184     return toHandle(node);
    185 }
    186 
    187 inline void HandleHeap::makeWeak(HandleSlot handle, WeakHandleOwner* weakOwner, void* context)
    188 {
    189     // Forbid assignment to handles during the finalization phase, since it would violate many GC invariants.
    190     // File a bug with stack trace if you hit this.
    191     if (m_nextToFinalize)
    192         CRASH();
    193     Node* node = toNode(handle);
    194     node->makeWeak(weakOwner, context);
    195 
    196     SentinelLinkedList<Node>::remove(node);
    197     if (!*handle || !handle->isCell()) {
    198         m_immediateList.push(node);
    199         return;
    200     }
    201 
    202     m_weakList.push(node);
    203 }
    204 
    205 #if !ASSERT_DISABLED
    206 inline bool HandleHeap::hasWeakOwner(HandleSlot handle, WeakHandleOwner* weakOwner)
    207 {
    208     return toNode(handle)->weakOwner() == weakOwner;
    209 }
    210 
    211 inline bool HandleHeap::hasFinalizer(HandleSlot handle)
    212 {
    213     return toNode(handle)->weakOwner();
    214 }
    215 #endif
    216 
    217149inline HandleHeap::Node::Node(HandleHeap* handleHeap)
    218150    : m_handleHeap(handleHeap)
    219     , m_weakOwner(0)
    220     , m_weakOwnerContext(0)
    221151    , m_prev(0)
    222152    , m_next(0)
    … …  
    226156inline HandleHeap::Node::Node(WTF::SentinelTag)
    227157    : m_handleHeap(0)
    228     , m_weakOwner(0)
    229     , m_weakOwnerContext(0)
    230158    , m_prev(0)
    231159    , m_next(0)
    … …  
    243171}
    244172
    245 inline void HandleHeap::Node::makeWeak(WeakHandleOwner* weakOwner, void* context)
    246 {
    247     m_weakOwner = weakOwner ? weakOwner : emptyWeakOwner();
    248     m_weakOwnerContext = context;
    249 }
    250 
    251 inline bool HandleHeap::Node::isWeak()
    252 {
    253     return m_weakOwner; // True for emptyWeakOwner().
    254 }
    255 
    256 inline WeakHandleOwner* HandleHeap::Node::weakOwner()
    257 {
    258     return m_weakOwner == emptyWeakOwner() ? 0 : m_weakOwner; // 0 for emptyWeakOwner().
    259 }
    260 
    261 inline void* HandleHeap::Node::weakOwnerContext()
    262 {
    263     ASSERT(weakOwner());
    264     return m_weakOwnerContext;
    265 }
    266 
    267173inline void HandleHeap::Node::setPrev(Node* prev)
    268174{
    … …  
    283189{
    284190    return m_next;
    285 }
    286 
    287 // Sentinel to indicate that a node is weak, but its owner has no meaningful
    288 // callbacks. This allows us to optimize by skipping such nodes.
    289 inline WeakHandleOwner* HandleHeap::Node::emptyWeakOwner()
    290 {
    291     return reinterpret_cast<WeakHandleOwner*>(-1);
    292191}
    293192
Note: See TracChangeset for help on using the changeset viewer.