Ignore:
Timestamp:
Aug 7, 2017, 2:31:49 PM (8 years ago)
Author:
[email protected]
Message:

Primitive auxiliaries and JSValue auxiliaries should have separate gigacages
​https://bugs.webkit.org/show_bug.cgi?id=174919

Reviewed by Keith Miller.
Source/bmalloc:


This introduces two kinds of Gigacage, Primitive and JSValue. This translates to two kinds of
HeapKind, PrimitiveGigacage and JSValueGigacage.

The new support functionality required turning Inline.h into BInline.h, and INLINE into BINLINE, and
NO_INLINE into BNO_INLINE.

  • bmalloc.xcodeproj/project.pbxproj:
  • bmalloc/Allocator.cpp:

(bmalloc::Allocator::refillAllocatorSlowCase):
(bmalloc::Allocator::refillAllocator):
(bmalloc::Allocator::allocateLarge):
(bmalloc::Allocator::allocateLogSizeClass):

  • bmalloc/AsyncTask.h:
  • bmalloc/BInline.h: Copied from Source/bmalloc/bmalloc/Inline.h.
  • bmalloc/Cache.cpp:

(bmalloc::Cache::tryAllocateSlowCaseNullCache):
(bmalloc::Cache::allocateSlowCaseNullCache):
(bmalloc::Cache::deallocateSlowCaseNullCache):
(bmalloc::Cache::reallocateSlowCaseNullCache):

  • bmalloc/Deallocator.cpp:
  • bmalloc/Gigacage.cpp:

(Gigacage::PrimitiveDisableCallbacks::PrimitiveDisableCallbacks):
(Gigacage::ensureGigacage):
(Gigacage::disablePrimitiveGigacage):
(Gigacage::addPrimitiveDisableCallback):
(Gigacage::removePrimitiveDisableCallback):
(Gigacage::Callbacks::Callbacks): Deleted.
(Gigacage::disableGigacage): Deleted.
(Gigacage::addDisableCallback): Deleted.
(Gigacage::removeDisableCallback): Deleted.

  • bmalloc/Gigacage.h:

(Gigacage::name):
(Gigacage::basePtr):
(Gigacage::forEachKind):
(Gigacage::caged):
(Gigacage::isCaged):

  • bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):
(bmalloc::Heap::usingGigacage):
(bmalloc::Heap::gigacageBasePtr):

  • bmalloc/Heap.h:
  • bmalloc/HeapKind.h:

(bmalloc::isGigacage):
(bmalloc::gigacageKind):
(bmalloc::heapKind):

  • bmalloc/Inline.h: Removed.
  • bmalloc/Map.h:
  • bmalloc/PerProcess.h:

(bmalloc::PerProcess<T>::getFastCase):
(bmalloc::PerProcess<T>::get):
(bmalloc::PerProcess<T>::getSlowCase):

  • bmalloc/PerThread.h:

(bmalloc::PerThread<T>::getFastCase):

  • bmalloc/Vector.h:

(bmalloc::Vector<T>::push):
(bmalloc::Vector<T>::shrinkCapacity):
(bmalloc::Vector<T>::growCapacity):

Source/JavaScriptCore:


This adapts JSC to there being two gigacages.

To make matters simpler, this turns AlignedMemoryAllocators into per-VM instances rather than
singletons. I don't think we were gaining anything by making them be singletons.

This makes it easy to teach GigacageAlignedMemoryAllocator that there are multiple kinds of
gigacages. We'll have one of those allocators per cage.

From there, this change teaches everyone who previously knew about cages that there are two cages.
This means having to specify either Gigacage::Primitive or Gigacage::JSValue. In most places, this is
easy: typed arrays are Primitive and butterflies are JSValue. But there are a few places where it's
not so obvious, so this change introduces some helpers to make it easy to define what cage you want
to use in one place and refer to it abstractly. We do this in DirectArguments and GenericArguments.h

A lot of the magic of this change is due to CagedBarrierPtr, which combines AuxiliaryBarrier and
CagedPtr. This removes one layer of "get()" calls from a bunch of places.

(JSC::AccessCase::generateImpl):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
(JSC::DFG::SpeculativeJIT::emitAllocateButterfly):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly):
(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
(JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
(JSC::FTL::DFG::LowerDFGToB3::caged):

  • heap/FastMallocAlignedMemoryAllocator.cpp:

(JSC::FastMallocAlignedMemoryAllocator::instance): Deleted.

  • heap/FastMallocAlignedMemoryAllocator.h:
  • heap/GigacageAlignedMemoryAllocator.cpp:

(JSC::GigacageAlignedMemoryAllocator::GigacageAlignedMemoryAllocator):
(JSC::GigacageAlignedMemoryAllocator::tryAllocateAlignedMemory):
(JSC::GigacageAlignedMemoryAllocator::freeAlignedMemory):
(JSC::GigacageAlignedMemoryAllocator::dump const):
(JSC::GigacageAlignedMemoryAllocator::instance): Deleted.

  • heap/GigacageAlignedMemoryAllocator.h:
  • jsc.cpp:

(primitiveGigacageDisabled):
(jscmain):
(gigacageDisabled): Deleted.

  • llint/LowLevelInterpreter64.asm:
  • runtime/ArrayBuffer.cpp:

(JSC::ArrayBufferContents::tryAllocate):
(JSC::ArrayBuffer::createAdopted):
(JSC::ArrayBuffer::createFromBytes):

  • runtime/AuxiliaryBarrier.h:
  • runtime/ButterflyInlines.h:

(JSC::Butterfly::createUninitialized):
(JSC::Butterfly::tryCreate):
(JSC::Butterfly::growArrayRight):

  • runtime/CagedBarrierPtr.h: Added.

(JSC::CagedBarrierPtr::CagedBarrierPtr):
(JSC::CagedBarrierPtr::clear):
(JSC::CagedBarrierPtr::set):
(JSC::CagedBarrierPtr::get const):
(JSC::CagedBarrierPtr::getMayBeNull const):
(JSC::CagedBarrierPtr::operator== const):
(JSC::CagedBarrierPtr::operator!= const):
(JSC::CagedBarrierPtr::operator bool const):
(JSC::CagedBarrierPtr::setWithoutBarrier):
(JSC::CagedBarrierPtr::operator* const):
(JSC::CagedBarrierPtr::operator-> const):
(JSC::CagedBarrierPtr::operator[] const):

  • runtime/DirectArguments.cpp:

(JSC::DirectArguments::overrideThings):
(JSC::DirectArguments::unmapArgument):

  • runtime/DirectArguments.h:

(JSC::DirectArguments::isMappedArgument const):

  • runtime/GenericArguments.h:
  • runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
(JSC::GenericArguments<Type>::setModifiedArgumentDescriptor):
(JSC::GenericArguments<Type>::isModifiedArgumentDescriptor):

  • runtime/HashMapImpl.cpp:

(JSC::HashMapImpl<HashMapBucket>::visitChildren):

  • runtime/HashMapImpl.h:

(JSC::HashMapBuffer::create):
(JSC::HashMapImpl::buffer const):
(JSC::HashMapImpl::rehash):

  • runtime/JSArray.cpp:

(JSC::JSArray::tryCreateUninitializedRestricted):
(JSC::JSArray::unshiftCountSlowCase):
(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::fastSlice):
(JSC::JSArray::shiftCountWithArrayStorage):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):

  • runtime/JSArray.h:

(JSC::JSArray::tryCreate):

  • runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
(JSC::JSArrayBufferView::finalize):

  • runtime/JSLock.cpp:

(JSC::JSLock::didAcquireLock):

  • runtime/JSObject.cpp:

(JSC::JSObject::heapSnapshot):
(JSC::JSObject::getOwnPropertySlotByIndex):
(JSC::JSObject::putByIndex):
(JSC::JSObject::enterDictionaryIndexingMode):
(JSC::JSObject::createInitialIndexedStorage):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
(JSC::JSObject::convertUndecidedToArrayStorage):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToContiguous):
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::setIndexQuicklyToUndecided):
(JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::putIndexedDescriptor):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
(JSC::JSObject::getNewVectorLength):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::reallocateAndShrinkButterfly):
(JSC::JSObject::allocateMoreOutOfLineStorage):
(JSC::JSObject::getEnumerableLength):

  • runtime/JSObject.h:

(JSC::JSObject::getArrayLength const):
(JSC::JSObject::getVectorLength):
(JSC::JSObject::putDirectIndex):
(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::tryGetIndexQuickly const):
(JSC::JSObject::canSetIndexQuickly):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::initializeIndexWithoutBarrier):
(JSC::JSObject::hasSparseMap):
(JSC::JSObject::inSparseIndexingMode):
(JSC::JSObject::butterfly const):
(JSC::JSObject::butterfly):
(JSC::JSObject::outOfLineStorage const):
(JSC::JSObject::outOfLineStorage):
(JSC::JSObject::ensureInt32):
(JSC::JSObject::ensureDouble):
(JSC::JSObject::ensureContiguous):
(JSC::JSObject::ensureArrayStorage):
(JSC::JSObject::arrayStorage):
(JSC::JSObject::arrayStorageOrNull):
(JSC::JSObject::ensureLength):

  • runtime/RegExpMatchesArray.h:

(JSC::tryCreateUninitializedRegExpMatchesArray):

  • runtime/VM.cpp:

(JSC::VM::VM):
(JSC::VM::~VM):
(JSC::VM::primitiveGigacageDisabledCallback):
(JSC::VM::primitiveGigacageDisabled):
(JSC::VM::gigacageDisabledCallback): Deleted.
(JSC::VM::gigacageDisabled): Deleted.

  • runtime/VM.h:

(JSC::VM::gigacageAuxiliarySpace):
(JSC::VM::firePrimitiveGigacageEnabledIfNecessary):
(JSC::VM::primitiveGigacageEnabled):
(JSC::VM::fireGigacageEnabledIfNecessary): Deleted.
(JSC::VM::gigacageEnabled): Deleted.

  • wasm/WasmMemory.cpp:

(JSC::Wasm::Memory::create):
(JSC::Wasm::Memory::~Memory):
(JSC::Wasm::Memory::grow):

Source/WebCore:

No new tests because no change in behavior.

Adapting to API changes - we now specify the AlignedMemoryAllocator differently and we need to be
specific about which Gigacage we're using.

  • bindings/js/WebCoreJSClientData.cpp:

(WebCore::JSVMClientData::JSVMClientData):

  • platform/graphics/cocoa/GPUBufferMetal.mm:

(WebCore::GPUBuffer::GPUBuffer):

Source/WebKit:


The disable callback is all about the primitive gigacage.

  • WebProcess/WebProcess.cpp:

(WebKit::primitiveGigacageDisabled):
(WebKit::m_webSQLiteDatabaseTracker):
(WebKit::gigacageDisabled): Deleted.

Source/WTF:


This mirrors the changes from bmalloc/Gigacage.h.

Also it teaches CagedPtr how to reason about multiple gigacages.

  • wtf/CagedPtr.h:

(WTF::CagedPtr::get const):
(WTF::CagedPtr::operator[] const):

  • wtf/Gigacage.cpp:

(Gigacage::tryMalloc):
(Gigacage::tryAllocateVirtualPages):
(Gigacage::freeVirtualPages):
(Gigacage::tryAlignedMalloc):
(Gigacage::alignedFree):
(Gigacage::free):

  • wtf/Gigacage.h:

(Gigacage::disablePrimitiveGigacage):
(Gigacage::addPrimitiveDisableCallback):
(Gigacage::removePrimitiveDisableCallback):
(Gigacage::name):
(Gigacage::basePtr):
(Gigacage::caged):
(Gigacage::isCaged):
(Gigacage::tryAlignedMalloc):
(Gigacage::alignedFree):
(Gigacage::free):
(Gigacage::disableGigacage): Deleted.
(Gigacage::addDisableCallback): Deleted.
(Gigacage::removeDisableCallback): Deleted.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r220346 r220352  
     12017-08-06  Filip Pizlo  <[email protected]>
     2
     3        Primitive auxiliaries and JSValue auxiliaries should have separate gigacages
     4        https://bugs.webkit.org/show_bug.cgi?id=174919
     5
     6        Reviewed by Keith Miller.
     7       
     8        This adapts JSC to there being two gigacages.
     9       
     10        To make matters simpler, this turns AlignedMemoryAllocators into per-VM instances rather than
     11        singletons. I don't think we were gaining anything by making them be singletons.
     12       
     13        This makes it easy to teach GigacageAlignedMemoryAllocator that there are multiple kinds of
     14        gigacages. We'll have one of those allocators per cage.
     15       
     16        From there, this change teaches everyone who previously knew about cages that there are two cages.
     17        This means having to specify either Gigacage::Primitive or Gigacage::JSValue. In most places, this is
     18        easy: typed arrays are Primitive and butterflies are JSValue. But there are a few places where it's
     19        not so obvious, so this change introduces some helpers to make it easy to define what cage you want
     20        to use in one place and refer to it abstractly. We do this in DirectArguments and GenericArguments.h
     21       
     22        A lot of the magic of this change is due to CagedBarrierPtr, which combines AuxiliaryBarrier and
     23        CagedPtr. This removes one layer of "get()" calls from a bunch of places.
     24
     25        * JavaScriptCore.xcodeproj/project.pbxproj:
     26        * bytecode/AccessCase.cpp:
     27        (JSC::AccessCase::generateImpl):
     28        * dfg/DFGSpeculativeJIT.cpp:
     29        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
     30        (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
     31        (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
     32        (JSC::DFG::SpeculativeJIT::compileNewTypedArray):
     33        (JSC::DFG::SpeculativeJIT::emitAllocateButterfly):
     34        * ftl/FTLLowerDFGToB3.cpp:
     35        (JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly):
     36        (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
     37        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
     38        (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
     39        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
     40        (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
     41        (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
     42        (JSC::FTL::DFG::LowerDFGToB3::caged):
     43        * heap/FastMallocAlignedMemoryAllocator.cpp:
     44        (JSC::FastMallocAlignedMemoryAllocator::instance): Deleted.
     45        * heap/FastMallocAlignedMemoryAllocator.h:
     46        * heap/GigacageAlignedMemoryAllocator.cpp:
     47        (JSC::GigacageAlignedMemoryAllocator::GigacageAlignedMemoryAllocator):
     48        (JSC::GigacageAlignedMemoryAllocator::tryAllocateAlignedMemory):
     49        (JSC::GigacageAlignedMemoryAllocator::freeAlignedMemory):
     50        (JSC::GigacageAlignedMemoryAllocator::dump const):
     51        (JSC::GigacageAlignedMemoryAllocator::instance): Deleted.
     52        * heap/GigacageAlignedMemoryAllocator.h:
     53        * jsc.cpp:
     54        (primitiveGigacageDisabled):
     55        (jscmain):
     56        (gigacageDisabled): Deleted.
     57        * llint/LowLevelInterpreter64.asm:
     58        * runtime/ArrayBuffer.cpp:
     59        (JSC::ArrayBufferContents::tryAllocate):
     60        (JSC::ArrayBuffer::createAdopted):
     61        (JSC::ArrayBuffer::createFromBytes):
     62        * runtime/AuxiliaryBarrier.h:
     63        * runtime/ButterflyInlines.h:
     64        (JSC::Butterfly::createUninitialized):
     65        (JSC::Butterfly::tryCreate):
     66        (JSC::Butterfly::growArrayRight):
     67        * runtime/CagedBarrierPtr.h: Added.
     68        (JSC::CagedBarrierPtr::CagedBarrierPtr):
     69        (JSC::CagedBarrierPtr::clear):
     70        (JSC::CagedBarrierPtr::set):
     71        (JSC::CagedBarrierPtr::get const):
     72        (JSC::CagedBarrierPtr::getMayBeNull const):
     73        (JSC::CagedBarrierPtr::operator== const):
     74        (JSC::CagedBarrierPtr::operator!= const):
     75        (JSC::CagedBarrierPtr::operator bool const):
     76        (JSC::CagedBarrierPtr::setWithoutBarrier):
     77        (JSC::CagedBarrierPtr::operator* const):
     78        (JSC::CagedBarrierPtr::operator-> const):
     79        (JSC::CagedBarrierPtr::operator[] const):
     80        * runtime/DirectArguments.cpp:
     81        (JSC::DirectArguments::overrideThings):
     82        (JSC::DirectArguments::unmapArgument):
     83        * runtime/DirectArguments.h:
     84        (JSC::DirectArguments::isMappedArgument const):
     85        * runtime/GenericArguments.h:
     86        * runtime/GenericArgumentsInlines.h:
     87        (JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
     88        (JSC::GenericArguments<Type>::setModifiedArgumentDescriptor):
     89        (JSC::GenericArguments<Type>::isModifiedArgumentDescriptor):
     90        * runtime/HashMapImpl.cpp:
     91        (JSC::HashMapImpl<HashMapBucket>::visitChildren):
     92        * runtime/HashMapImpl.h:
     93        (JSC::HashMapBuffer::create):
     94        (JSC::HashMapImpl::buffer const):
     95        (JSC::HashMapImpl::rehash):
     96        * runtime/JSArray.cpp:
     97        (JSC::JSArray::tryCreateUninitializedRestricted):
     98        (JSC::JSArray::unshiftCountSlowCase):
     99        (JSC::JSArray::setLength):
     100        (JSC::JSArray::pop):
     101        (JSC::JSArray::push):
     102        (JSC::JSArray::fastSlice):
     103        (JSC::JSArray::shiftCountWithArrayStorage):
     104        (JSC::JSArray::shiftCountWithAnyIndexingType):
     105        (JSC::JSArray::unshiftCountWithAnyIndexingType):
     106        (JSC::JSArray::fillArgList):
     107        (JSC::JSArray::copyToArguments):
     108        * runtime/JSArray.h:
     109        (JSC::JSArray::tryCreate):
     110        * runtime/JSArrayBufferView.cpp:
     111        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
     112        (JSC::JSArrayBufferView::finalize):
     113        * runtime/JSLock.cpp:
     114        (JSC::JSLock::didAcquireLock):
     115        * runtime/JSObject.cpp:
     116        (JSC::JSObject::heapSnapshot):
     117        (JSC::JSObject::getOwnPropertySlotByIndex):
     118        (JSC::JSObject::putByIndex):
     119        (JSC::JSObject::enterDictionaryIndexingMode):
     120        (JSC::JSObject::createInitialIndexedStorage):
     121        (JSC::JSObject::createArrayStorage):
     122        (JSC::JSObject::convertUndecidedToInt32):
     123        (JSC::JSObject::convertUndecidedToDouble):
     124        (JSC::JSObject::convertUndecidedToContiguous):
     125        (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
     126        (JSC::JSObject::convertUndecidedToArrayStorage):
     127        (JSC::JSObject::convertInt32ToDouble):
     128        (JSC::JSObject::convertInt32ToContiguous):
     129        (JSC::JSObject::convertInt32ToArrayStorage):
     130        (JSC::JSObject::convertDoubleToContiguous):
     131        (JSC::JSObject::convertDoubleToArrayStorage):
     132        (JSC::JSObject::convertContiguousToArrayStorage):
     133        (JSC::JSObject::setIndexQuicklyToUndecided):
     134        (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
     135        (JSC::JSObject::deletePropertyByIndex):
     136        (JSC::JSObject::getOwnPropertyNames):
     137        (JSC::JSObject::putIndexedDescriptor):
     138        (JSC::JSObject::defineOwnIndexedProperty):
     139        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
     140        (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
     141        (JSC::JSObject::getNewVectorLength):
     142        (JSC::JSObject::ensureLengthSlow):
     143        (JSC::JSObject::reallocateAndShrinkButterfly):
     144        (JSC::JSObject::allocateMoreOutOfLineStorage):
     145        (JSC::JSObject::getEnumerableLength):
     146        * runtime/JSObject.h:
     147        (JSC::JSObject::getArrayLength const):
     148        (JSC::JSObject::getVectorLength):
     149        (JSC::JSObject::putDirectIndex):
     150        (JSC::JSObject::canGetIndexQuickly):
     151        (JSC::JSObject::getIndexQuickly):
     152        (JSC::JSObject::tryGetIndexQuickly const):
     153        (JSC::JSObject::canSetIndexQuickly):
     154        (JSC::JSObject::setIndexQuickly):
     155        (JSC::JSObject::initializeIndex):
     156        (JSC::JSObject::initializeIndexWithoutBarrier):
     157        (JSC::JSObject::hasSparseMap):
     158        (JSC::JSObject::inSparseIndexingMode):
     159        (JSC::JSObject::butterfly const):
     160        (JSC::JSObject::butterfly):
     161        (JSC::JSObject::outOfLineStorage const):
     162        (JSC::JSObject::outOfLineStorage):
     163        (JSC::JSObject::ensureInt32):
     164        (JSC::JSObject::ensureDouble):
     165        (JSC::JSObject::ensureContiguous):
     166        (JSC::JSObject::ensureArrayStorage):
     167        (JSC::JSObject::arrayStorage):
     168        (JSC::JSObject::arrayStorageOrNull):
     169        (JSC::JSObject::ensureLength):
     170        * runtime/RegExpMatchesArray.h:
     171        (JSC::tryCreateUninitializedRegExpMatchesArray):
     172        * runtime/VM.cpp:
     173        (JSC::VM::VM):
     174        (JSC::VM::~VM):
     175        (JSC::VM::primitiveGigacageDisabledCallback):
     176        (JSC::VM::primitiveGigacageDisabled):
     177        (JSC::VM::gigacageDisabledCallback): Deleted.
     178        (JSC::VM::gigacageDisabled): Deleted.
     179        * runtime/VM.h:
     180        (JSC::VM::gigacageAuxiliarySpace):
     181        (JSC::VM::firePrimitiveGigacageEnabledIfNecessary):
     182        (JSC::VM::primitiveGigacageEnabled):
     183        (JSC::VM::fireGigacageEnabledIfNecessary): Deleted.
     184        (JSC::VM::gigacageEnabled): Deleted.
     185        * wasm/WasmMemory.cpp:
     186        (JSC::Wasm::Memory::create):
     187        (JSC::Wasm::Memory::~Memory):
     188        (JSC::Wasm::Memory::grow):
     189
    11902017-08-07  Commit Queue  <[email protected]>
    2191
Note: See TracChangeset for help on using the changeset viewer.