Changeset 188978 in webkit

Timestamp:

Aug 26, 2015 12:21:19 PM (9 years ago)

Author:

akling@apple.com

Message:

[JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls.
<​https://webkit.org/b/148478>

Reviewed by Geoffrey Garen.

Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers
when it's using the single-transition optimization and the Structure it transitioned
to has been GC'd.

This prevents Structures from keeping WeakBlocks alive longer than necessary when
they've been transitioned away from but are still in use themselves.

• runtime/Structure.cpp:

(JSC::singleSlotTransitionWeakOwner):
(JSC::StructureTransitionTable::singleTransition):
(JSC::StructureTransitionTable::setSingleTransition):
(JSC::StructureTransitionTable::add):

• runtime/StructureTransitionTable.h:

(JSC::StructureTransitionTable::singleTransition): Deleted.
(JSC::StructureTransitionTable::setSingleTransition): Deleted.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/Structure.cpp (modified) (3 diffs)
• runtime/StructureTransitionTable.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-08-26  Andreas Kling  <akling@apple.com>
+
+        [JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls.
+        <https://webkit.org/b/148478>
+
+        Reviewed by Geoffrey Garen.
+
+        Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers
+        when it's using the single-transition optimization and the Structure it transitioned
+        to has been GC'd.
+
+        This prevents Structures from keeping WeakBlocks alive longer than necessary when
+        they've been transitioned away from but are still in use themselves.
+
+        * runtime/Structure.cpp:
+        (JSC::singleSlotTransitionWeakOwner):
+        (JSC::StructureTransitionTable::singleTransition):
+        (JSC::StructureTransitionTable::setSingleTransition):
+        (JSC::StructureTransitionTable::add):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTable::singleTransition): Deleted.
+        (JSC::StructureTransitionTable::setSingleTransition): Deleted.
+
 2015-08-26  Brian Burg  <bburg@apple.com>
 

trunk/Source/JavaScriptCore/runtime/Structure.cpp

@@ -39 +39 @@
 #include "WeakGCMapInlines.h"
 #include <wtf/CommaPrinter.h>
+#include <wtf/NeverDestroyed.h>
 #include <wtf/ProcessID.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -61 +62 @@
 #endif
 
+class SingleSlotTransitionWeakOwner final : public WeakHandleOwner {
+    void finalize(Handle<Unknown>, void* context) override
+    {
+        StructureTransitionTable* table = reinterpret_cast<StructureTransitionTable*>(context);
+        ASSERT(table->isUsingSingleSlot());
+        WeakSet::deallocate(table->weakImpl());
+        table->m_data = StructureTransitionTable::UsingSingleSlotFlag;
+    }
+};
+
+static SingleSlotTransitionWeakOwner& singleSlotTransitionWeakOwner()
+{
+    static NeverDestroyed<SingleSlotTransitionWeakOwner> owner;
+    return owner;
+}
+
+inline Structure* StructureTransitionTable::singleTransition() const
+{
+    ASSERT(isUsingSingleSlot());
+    if (WeakImpl* impl = this->weakImpl()) {
+        if (impl->state() == WeakImpl::Live)
+            return jsCast<Structure*>(impl->jsValue().asCell());
+    }
+    return nullptr;
+}
+
+inline void StructureTransitionTable::setSingleTransition(Structure* structure)
+{
+    ASSERT(isUsingSingleSlot());
+    if (WeakImpl* impl = this->weakImpl())
+        WeakSet::deallocate(impl);
+    WeakImpl* impl = WeakSet::allocate(structure, &singleSlotTransitionWeakOwner(), this);
+    m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
+}
+
 bool StructureTransitionTable::contains(UniquedStringImpl* rep, unsigned attributes) const
 {
@@ -86 +122 @@
         // This handles the first transition being added.
         if (!existingTransition) {
-            setSingleTransition(vm, structure);
+            setSingleTransition(structure);
             return;
         }

trunk/Source/JavaScriptCore/runtime/StructureTransitionTable.h

@@ -135 +135 @@
 
 private:
+    friend class SingleSlotTransitionWeakOwner;
+
     bool isUsingSingleSlot() const
     {
@@ -165 +167 @@
     }
 
-    Structure* singleTransition() const
-    {
-        ASSERT(isUsingSingleSlot());
-        if (WeakImpl* impl = this->weakImpl()) {
-            if (impl->state() == WeakImpl::Live)
-                return reinterpret_cast<Structure*>(impl->jsValue().asCell());
-        }
-        return 0;
-    }
-    
-    void setSingleTransition(VM&, Structure* structure)
-    {
-        ASSERT(isUsingSingleSlot());
-        if (WeakImpl* impl = this->weakImpl())
-            WeakSet::deallocate(impl);
-        WeakImpl* impl = WeakSet::allocate(reinterpret_cast<JSCell*>(structure));
-        m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag;
-    }
+    Structure* singleTransition() const;
+    void setSingleTransition(Structure*);
 
     intptr_t m_data;