Changeset 259645 in webkit for trunk/Source/JavaScriptCore/runtime/JSWrapperObject.cpp

Timestamp:

Apr 7, 2020, 10:39:24 AM (5 years ago)

Author:

[email protected]

Message:

[JSC] JSWrapperObject should use JSInternalFieldObjectImpl
​https://bugs.webkit.org/show_bug.cgi?id=210019

Reviewed by Mark Lam.

JSWrapperObject's mechanism can be basically implemented by using JSInternalFieldObjectImpl.
We should leverage JSInternalFieldObjectImpl to implement JSWrapperObject since it can pave
the way to implementing Object-Allocation-Sinking and faster access to value etc. in DFG without
duplicating code.

We also noticed that we are storing classInfo to JSWrapperObject when allocating StringObject in
DFG and FTL while JSWrapperObject is no longer inheriting JSDestructibleObject! But it turned out
that this is safe since the subsequent JSWrapperObject::internalValue setting can overwrite it.
We remove this wrong store.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewStringObject):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::emitAllocateDestructibleObject): Deleted.

• ftl/FTLAbstractHeapRepository.cpp:

(JSC::FTL::AbstractHeapRepository::AbstractHeapRepository):

• ftl/FTLAbstractHeapRepository.h:
• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitAllocateDestructibleObject): Deleted.

• runtime/BigIntObject.h:
• runtime/BooleanObject.h:
• runtime/JSDestructibleObject.h:

(JSC::JSDestructibleObject::classInfo const):
(JSC::JSDestructibleObject::classInfoOffset): Deleted.

• runtime/JSWrapperObject.cpp:

(JSC::JSWrapperObject::visitChildren):

• runtime/JSWrapperObject.h:

(JSC::JSWrapperObject::internalValueOffset):
(JSC::JSWrapperObject::internalValue const):
(JSC::JSWrapperObject::setInternalValue):
(JSC::JSWrapperObject::createStructure): Deleted.

• runtime/NumberObject.h:
• runtime/StringObject.h:
• runtime/SymbolObject.h:

File:

• trunk/Source/JavaScriptCore/runtime/JSWrapperObject.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/runtime/JSWrapperObject.cpp

@@ -24 +24 @@
 
 #include "JSCInlines.h"
+#include "JSInternalFieldObjectImplInlines.h"
 
 namespace JSC {
@@ -31 +32 @@
 void JSWrapperObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
 {
-    JSWrapperObject* thisObject = jsCast<JSWrapperObject*>(cell);
+    auto* thisObject = jsCast<JSWrapperObject*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
-    JSObject::visitChildren(thisObject, visitor);
-    visitor.append(thisObject->m_internalValue);
+    Base::visitChildren(thisObject, visitor);
 }