Changeset 220777 in webkit for trunk/Source/JavaScriptCore/runtime/VM.cpp

Timestamp:

Aug 15, 2017, 5:03:45 PM (8 years ago)

Author:

[email protected]

Message:

Make VM::scratchBufferForSize thread safe
​https://bugs.webkit.org/show_bug.cgi?id=175604

Reviewed by Geoffrey Garen and Mark Lam.

I want to use the VM::scratchBufferForSize in another patch I'm writing.
The use case for my other patch is to call it from the compiler thread.
When reading the code, I saw that this API was not thread safe. This patch
makes it thread safe. It actually turns out we were calling this API from
the compiler thread already when we created FTL::State for an FTL OSR entry
compilation, and from FTLLowerDFGToB3. That code was racy and wrong, but
is now correct with this patch.

• runtime/VM.cpp:

(JSC::VM::VM):
(JSC::VM::~VM):
(JSC::VM::gatherConservativeRoots):
(JSC::VM::scratchBufferForSize):

• runtime/VM.h:

(JSC::VM::scratchBufferForSize): Deleted.

File:

• trunk/Source/JavaScriptCore/runtime/VM.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/runtime/VM.cpp

@@ -195 +195 @@
     , prototypeMap(*this)
     , interpreter(0)
-    , sizeOfLastScratchBuffer(0)
     , entryScope(0)
     , m_regExpCache(new RegExpCache(this))
@@ -424 +423 @@
 
 #if ENABLE(DFG_JIT)
-    for (unsigned i = 0; i < scratchBuffers.size(); ++i)
-        fastFree(scratchBuffers[i]);
+    for (unsigned i = 0; i < m_scratchBuffers.size(); ++i)
+        fastFree(m_scratchBuffers[i]);
 #endif
 }
@@ -747 +746 @@
 void VM::gatherConservativeRoots(ConservativeRoots& conservativeRoots)
 {
-    for (auto* scratchBuffer : scratchBuffers) {
+    auto lock = holdLock(m_scratchBufferLock);
+    for (auto* scratchBuffer : m_scratchBuffers) {
         if (scratchBuffer->activeLength()) {
             void* bufferStart = scratchBuffer->dataBuffer();
@@ -1009 +1009 @@
 #endif // USE(CF)
 
+ScratchBuffer* VM::scratchBufferForSize(size_t size)
+{
+    if (!size)
+        return nullptr;
+
+    auto locker = holdLock(m_scratchBufferLock);
+
+    if (size > m_sizeOfLastScratchBuffer) {
+        // Protect against a N^2 memory usage pathology by ensuring
+        // that at worst, we get a geometric series, meaning that the
+        // total memory usage is somewhere around
+        // max(scratch buffer size) * 4.
+        m_sizeOfLastScratchBuffer = size * 2;
+
+        ScratchBuffer* newBuffer = ScratchBuffer::create(m_sizeOfLastScratchBuffer);
+        RELEASE_ASSERT(newBuffer);
+        m_scratchBuffers.append(newBuffer);
+    }
+
+    ScratchBuffer* result = m_scratchBuffers.last();
+    return result;
+}
+
 } // namespace JSC