Changeset 182747 in webkit for trunk/Source/JavaScriptCore/jsc.cpp

Timestamp:

Apr 13, 2015, 12:12:48 PM (10 years ago)

Author:

[email protected]

Message:

Don't segregate heap objects based on Structure immortality.
<​https://webkit.org/b/143638>

Reviewed by Darin Adler.

Source/JavaScriptCore:

Put all objects that need a destructor call into the same MarkedBlock.
This reduces memory consumption in many situations, while improving locality,
since much more of the MarkedBlock space can be shared.

Instead of branching on the MarkedBlock type, we now check a bit in the
JSCell's inline type flags (StructureIsImmortal) to see whether it's safe
to access the cell's Structure during destruction or not.

Performance benchmarks look mostly neutral. Maybe a small regression on
SunSpider's date objects.

On the amazon.com landing page, this saves us 50 MarkedBlocks (3200kB) along
with a bunch of WeakBlocks that were hanging off of them. That's on the higher
end of savings we can get from this, but still a very real improvement.

Most of this patch is removing the "hasImmortalStructure" constant from JSCell
derived classes and passing that responsibility to the StructureIsImmortal flag.
StructureFlags is made public so that it's accessible from non-member functions.
I made sure to declare it everywhere and make classes final to try to make it
explicit what each class is doing to its inherited flags.

• API/JSCallbackConstructor.h:
• API/JSCallbackObject.h:
• bytecode/UnlinkedCodeBlock.h:
• debugger/DebuggerScope.h:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileMakeRope):

• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::compileMakeRope):

• heap/Heap.h:

(JSC::Heap::subspaceForObjectDestructor):
(JSC::Heap::allocatorForObjectWithDestructor):
(JSC::Heap::subspaceForObjectNormalDestructor): Deleted.
(JSC::Heap::subspaceForObjectsWithImmortalStructure): Deleted.
(JSC::Heap::allocatorForObjectWithNormalDestructor): Deleted.
(JSC::Heap::allocatorForObjectWithImmortalStructureDestructor): Deleted.

• heap/HeapInlines.h:

(JSC::Heap::allocateWithDestructor):
(JSC::Heap::allocateObjectOfType):
(JSC::Heap::subspaceForObjectOfType):
(JSC::Heap::allocatorForObjectOfType):
(JSC::Heap::allocateWithNormalDestructor): Deleted.
(JSC::Heap::allocateWithImmortalStructureDestructor): Deleted.

• heap/MarkedAllocator.cpp:

(JSC::MarkedAllocator::allocateBlock):

• heap/MarkedAllocator.h:

(JSC::MarkedAllocator::needsDestruction):
(JSC::MarkedAllocator::MarkedAllocator):
(JSC::MarkedAllocator::init):
(JSC::MarkedAllocator::destructorType): Deleted.

• heap/MarkedBlock.cpp:

(JSC::MarkedBlock::create):
(JSC::MarkedBlock::MarkedBlock):
(JSC::MarkedBlock::callDestructor):
(JSC::MarkedBlock::specializedSweep):
(JSC::MarkedBlock::sweep):
(JSC::MarkedBlock::sweepHelper):

• heap/MarkedBlock.h:

(JSC::MarkedBlock::needsDestruction):
(JSC::MarkedBlock::destructorType): Deleted.

• heap/MarkedSpace.cpp:

(JSC::MarkedSpace::MarkedSpace):
(JSC::MarkedSpace::resetAllocators):
(JSC::MarkedSpace::forEachAllocator):
(JSC::MarkedSpace::isPagedOut):
(JSC::MarkedSpace::clearNewlyAllocated):

• heap/MarkedSpace.h:

(JSC::MarkedSpace::subspaceForObjectsWithDestructor):
(JSC::MarkedSpace::destructorAllocatorFor):
(JSC::MarkedSpace::allocateWithDestructor):
(JSC::MarkedSpace::forEachBlock):
(JSC::MarkedSpace::subspaceForObjectsWithNormalDestructor): Deleted.
(JSC::MarkedSpace::subspaceForObjectsWithImmortalStructure): Deleted.
(JSC::MarkedSpace::immortalStructureDestructorAllocatorFor): Deleted.
(JSC::MarkedSpace::normalDestructorAllocatorFor): Deleted.
(JSC::MarkedSpace::allocateWithImmortalStructureDestructor): Deleted.
(JSC::MarkedSpace::allocateWithNormalDestructor): Deleted.

• inspector/JSInjectedScriptHost.h:
• inspector/JSInjectedScriptHostPrototype.h:
• inspector/JSJavaScriptCallFrame.h:
• inspector/JSJavaScriptCallFramePrototype.h:
• jsc.cpp:
• runtime/ArrayBufferNeuteringWatchpoint.h:
• runtime/ArrayConstructor.h:
• runtime/ArrayIteratorPrototype.h:
• runtime/BooleanPrototype.h:
• runtime/ClonedArguments.h:
• runtime/CustomGetterSetter.h:
• runtime/DateConstructor.h:
• runtime/DatePrototype.h:
• runtime/ErrorPrototype.h:
• runtime/ExceptionHelpers.h:
• runtime/Executable.h:
• runtime/GenericArguments.h:
• runtime/GetterSetter.h:
• runtime/InternalFunction.h:
• runtime/JSAPIValueWrapper.h:
• runtime/JSArgumentsIterator.h:
• runtime/JSArray.h:
• runtime/JSArrayBuffer.h:
• runtime/JSArrayBufferView.h:
• runtime/JSBoundFunction.h:
• runtime/JSCallee.h:
• runtime/JSCell.h:
• runtime/JSCellInlines.h:

(JSC::JSCell::classInfo):

• runtime/JSDataViewPrototype.h:
• runtime/JSEnvironmentRecord.h:
• runtime/JSFunction.h:
• runtime/JSGenericTypedArrayView.h:
• runtime/JSGlobalObject.h:
• runtime/JSLexicalEnvironment.h:
• runtime/JSNameScope.h:
• runtime/JSNotAnObject.h:
• runtime/JSONObject.h:
• runtime/JSObject.h:

(JSC::JSFinalObject::JSFinalObject):

• runtime/JSPromiseConstructor.h:
• runtime/JSPromiseDeferred.h:
• runtime/JSPromisePrototype.h:
• runtime/JSPromiseReaction.h:
• runtime/JSPropertyNameEnumerator.h:
• runtime/JSProxy.h:
• runtime/JSScope.h:
• runtime/JSString.h:
• runtime/JSSymbolTableObject.h:
• runtime/JSTypeInfo.h:

(JSC::TypeInfo::structureIsImmortal):

• runtime/MathObject.h:
• runtime/NumberConstructor.h:
• runtime/NumberPrototype.h:
• runtime/ObjectConstructor.h:
• runtime/PropertyMapHashTable.h:
• runtime/RegExp.h:
• runtime/RegExpConstructor.h:
• runtime/RegExpObject.h:
• runtime/RegExpPrototype.h:
• runtime/ScopedArgumentsTable.h:
• runtime/SparseArrayValueMap.h:
• runtime/StrictEvalActivation.h:
• runtime/StringConstructor.h:
• runtime/StringIteratorPrototype.h:
• runtime/StringObject.h:
• runtime/StringPrototype.h:
• runtime/Structure.cpp:

(JSC::Structure::Structure):

• runtime/Structure.h:
• runtime/StructureChain.h:
• runtime/StructureRareData.h:
• runtime/Symbol.h:
• runtime/SymbolPrototype.h:
• runtime/SymbolTable.h:
• runtime/WeakMapData.h:

Source/WebCore:

• bindings/js/JSDOMBinding.h:
• bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GeneratePrototypeDeclaration):

• bridge/objc/objc_runtime.h:
• bridge/runtime_array.h:
• bridge/runtime_method.h:
• bridge/runtime_object.h:

Source/WebKit2:

• WebProcess/Plugins/Netscape/JSNPObject.h:

File:

• trunk/Source/JavaScriptCore/jsc.cpp (modified) (6 diffs)

trunk/Source/JavaScriptCore/jsc.cpp

@@ -182 +182 @@
 
     typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | JSC::MasqueradesAsUndefined;
 
     static Masquerader* create(VM& vm, JSGlobalObject* globalObject)
@@ -198 +199 @@
 
     DECLARE_INFO;
-
-protected:
-    static const unsigned StructureFlags = JSC::MasqueradesAsUndefined | Base::StructureFlags;
 };
 
@@ -258 +256 @@
     DECLARE_INFO;
     typedef JSNonFinalObject Base;
+    static const unsigned StructureFlags = Base::StructureFlags | JSC::HasImpureGetOwnPropertySlot | JSC::OverridesGetOwnPropertySlot;
 
     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
@@ -277 +276 @@
             m_delegate.set(vm, this, delegate);
     }
-
-    static const unsigned StructureFlags = JSC::HasImpureGetOwnPropertySlot | JSC::OverridesGetOwnPropertySlot | Base::StructureFlags;
 
     static bool getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName name, PropertySlot& slot)
@@ -309 +306 @@
 public:
     typedef JSArray Base;
+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
 
     static RuntimeArray* create(ExecState* exec)
@@ -391 +389 @@
             m_vector.append(exec->argument(i).toInt32(exec));
     }
-
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames | JSArray::StructureFlags;
 
 private: