Changeset 190694 in webkit for trunk/Source/JavaScriptCore/dfg/DFGPlan.h

Timestamp:

Oct 7, 2015, 4:10:20 PM (10 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling back in r190450
​https://bugs.webkit.org/show_bug.cgi?id=149727

This time for sure?

The cause of the leak was an invalidated compilation.

There was vestigial manual memory management code that eagerly removed
a CodeBlock from the set of CodeBlocks if compilation was invalidated.
That's not cool since we rely on the set of CodeBlocks when we run
destructors.

The fix is to remove the vestigial code.

I ran the leaks, correctness, and performance tests locally and did not
see any problems.

Restored changesets:

"CodeBlock should be a GC object"
​https://bugs.webkit.org/show_bug.cgi?id=149727
​http://trac.webkit.org/changeset/190450

File:

• trunk/Source/JavaScriptCore/dfg/DFGPlan.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/dfg/DFGPlan.h

@@ -56 +56 @@
 struct Plan : public ThreadSafeRefCounted<Plan> {
     Plan(
-        PassRefPtr<CodeBlock> codeBlockToCompile, CodeBlock* profiledDFGCodeBlock,
+        CodeBlock* codeBlockToCompile, CodeBlock* profiledDFGCodeBlock,
         CompilationMode, unsigned osrEntryBytecodeIndex,
         const Operands<JSValue>& mustHandleValues);
@@ -72 +72 @@
     CompilationKey key();
     
-    void clearCodeBlockMarks();
+    void rememberCodeBlocks();
     void checkLivenessAndVisitChildren(SlotVisitor&);
     bool isKnownToBeLiveDuringGC();
@@ -78 +78 @@
     
     VM& vm;
-    RefPtr<CodeBlock> codeBlock;
-    RefPtr<CodeBlock> profiledDFGCodeBlock;
+
+    // These can be raw pointers because we visit them during every GC in checkLivenessAndVisitChildren.
+    CodeBlock* codeBlock;
+    CodeBlock* profiledDFGCodeBlock;
+
     CompilationMode mode;
     const unsigned osrEntryBytecodeIndex;