Changeset 172976 in webkit for trunk/Source/JavaScriptCore/heap/Heap.cpp

Timestamp:

Aug 26, 2014, 2:24:40 PM (11 years ago)

Author:

[email protected]

Message:

TypeSet caches structureIDs even after the corresponding Structure could be GCed
​https://bugs.webkit.org/show_bug.cgi?id=136178

Patch by Saam Barati <​[email protected]> on 2014-08-26
Reviewed by Geoffrey Garen.

Currently, TypeSet will never remove StructureIDs from its cache,
even after the corresponding Structures could be garbage collected.
Now, when the Garbage Collector collects, and type profiling is
enabled, the Garbage Collector will invalidate all TypeSet caches.

• heap/Heap.cpp:

(JSC::Heap::collect):

• runtime/TypeSet.cpp:

(JSC::TypeSet::addTypeInformation):
(JSC::TypeSet::invalidateCache):

• runtime/TypeSet.h:
• runtime/VM.cpp:

(JSC::VM::invalidateTypeSetCache):

• runtime/VM.h:

File:

• trunk/Source/JavaScriptCore/heap/Heap.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -983 +983 @@
         DeferGCForAWhile awhile(*this);
         vm()->typeProfilerLog()->processLogEntries(ASCIILiteral("GC"));
+        vm()->invalidateTypeSetCache();
     }