Changeset 266250 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Aug 27, 2020, 1:01:04 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] Use auxiliary memory for JSBigInt storage
​https://bugs.webkit.org/show_bug.cgi?id=215876

Reviewed by Mark Lam.

This makes JSBigInt non-destructible cell. And it makes allocating JSBigInt from JIT easy.

• runtime/JSBigInt.cpp:

(JSC::JSBigInt::JSBigInt):
(JSC::JSBigInt::visitChildren):
(JSC::JSBigInt::createWithLength):
(JSC::JSBigInt::destroy): Deleted.

• runtime/JSBigInt.h:
• runtime/VM.cpp:

(JSC::VM::VM):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSBigInt.cpp (modified) (2 diffs)
• runtime/JSBigInt.h (modified) (2 diffs)
• runtime/VM.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-08-27  Yusuke Suzuki  <[email protected]>
+
+        [JSC] Use auxiliary memory for JSBigInt storage
+        https://bugs.webkit.org/show_bug.cgi?id=215876
+
+        Reviewed by Mark Lam.
+
+        This makes JSBigInt non-destructible cell. And it makes allocating JSBigInt from JIT easy.
+
+        * runtime/JSBigInt.cpp:
+        (JSC::JSBigInt::JSBigInt):
+        (JSC::JSBigInt::visitChildren):
+        (JSC::JSBigInt::createWithLength):
+        (JSC::JSBigInt::destroy): Deleted.
+        * runtime/JSBigInt.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+
 2020-08-27  Keith Miller  <[email protected]>
 

trunk/Source/JavaScriptCore/runtime/JSBigInt.cpp

@@ -64 +64 @@
     : Base(vm, structure)
     , m_length(length)
-    , m_data(data, length)
+    , m_data(vm, this, data, length)
 { }
 
-void JSBigInt::destroy(JSCell* thisCell)
-{
-    static_cast<JSBigInt*>(thisCell)->~JSBigInt();
+void JSBigInt::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    auto* thisObject = jsCast<JSBigInt*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+    if (auto* data = thisObject->m_data.getUnsafe())
+        visitor.markAuxiliary(data);
 }
 
@@ -109 +113 @@
 
     ASSERT(length <= maxLength);
-    void* data = Gigacage::tryMalloc(Gigacage::Primitive, length * sizeof(Digit));
+    void* data = vm.primitiveGigacageAuxiliarySpace.allocateNonVirtual(vm, length * sizeof(Digit), nullptr, AllocationFailureMode::ReturnNull);
     if (UNLIKELY(!data)) {
         if (nullOrGlobalObjectForOOM) {

trunk/Source/JavaScriptCore/runtime/JSBigInt.h

@@ -51 +51 @@
     friend class CachedBigInt;
 
-    static constexpr bool needsDestruction = true;
-    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
 
     template<typename CellType, SubspaceAccess>
@@ -577 +576 @@
     const unsigned m_length;
     bool m_sign { false };
-    CagedUniquePtr<Gigacage::Primitive, Digit> m_data;
+    CagedBarrierPtr<Gigacage::Primitive, Digit> m_data;
 };
 

trunk/Source/JavaScriptCore/runtime/VM.cpp

@@ -338 +338 @@
     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x4f5ed7a9
     , arraySpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSArray)
-    , bigIntSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), JSBigInt)
+    , bigIntSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSBigInt)
     , calleeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSCallee)
     , clonedArgumentsSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ClonedArguments)