Changeset 188978 in webkit
- Timestamp:
- Aug 26, 2015 12:21:19 PM (9 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r188976 r188978 1 2015-08-26 Andreas Kling <akling@apple.com> 2 3 [JSC] StructureTransitionTable should eagerly deallocate single-transition WeakImpls. 4 <https://webkit.org/b/148478> 5 6 Reviewed by Geoffrey Garen. 7 8 Use a WeakHandleOwner to eagerly deallocate StructureTransitionTable's Weak pointers 9 when it's using the single-transition optimization and the Structure it transitioned 10 to has been GC'd. 11 12 This prevents Structures from keeping WeakBlocks alive longer than necessary when 13 they've been transitioned away from but are still in use themselves. 14 15 * runtime/Structure.cpp: 16 (JSC::singleSlotTransitionWeakOwner): 17 (JSC::StructureTransitionTable::singleTransition): 18 (JSC::StructureTransitionTable::setSingleTransition): 19 (JSC::StructureTransitionTable::add): 20 * runtime/StructureTransitionTable.h: 21 (JSC::StructureTransitionTable::singleTransition): Deleted. 22 (JSC::StructureTransitionTable::setSingleTransition): Deleted. 23 1 24 2015-08-26 Brian Burg <bburg@apple.com> 2 25 -
trunk/Source/JavaScriptCore/runtime/Structure.cpp
r187780 r188978 39 39 #include "WeakGCMapInlines.h" 40 40 #include <wtf/CommaPrinter.h> 41 #include <wtf/NeverDestroyed.h> 41 42 #include <wtf/ProcessID.h> 42 43 #include <wtf/RefCountedLeakCounter.h> … … 61 62 #endif 62 63 64 class SingleSlotTransitionWeakOwner final : public WeakHandleOwner { 65 void finalize(Handle<Unknown>, void* context) override 66 { 67 StructureTransitionTable* table = reinterpret_cast<StructureTransitionTable*>(context); 68 ASSERT(table->isUsingSingleSlot()); 69 WeakSet::deallocate(table->weakImpl()); 70 table->m_data = StructureTransitionTable::UsingSingleSlotFlag; 71 } 72 }; 73 74 static SingleSlotTransitionWeakOwner& singleSlotTransitionWeakOwner() 75 { 76 static NeverDestroyed<SingleSlotTransitionWeakOwner> owner; 77 return owner; 78 } 79 80 inline Structure* StructureTransitionTable::singleTransition() const 81 { 82 ASSERT(isUsingSingleSlot()); 83 if (WeakImpl* impl = this->weakImpl()) { 84 if (impl->state() == WeakImpl::Live) 85 return jsCast<Structure*>(impl->jsValue().asCell()); 86 } 87 return nullptr; 88 } 89 90 inline void StructureTransitionTable::setSingleTransition(Structure* structure) 91 { 92 ASSERT(isUsingSingleSlot()); 93 if (WeakImpl* impl = this->weakImpl()) 94 WeakSet::deallocate(impl); 95 WeakImpl* impl = WeakSet::allocate(structure, &singleSlotTransitionWeakOwner(), this); 96 m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag; 97 } 98 63 99 bool StructureTransitionTable::contains(UniquedStringImpl* rep, unsigned attributes) const 64 100 { … … 86 122 // This handles the first transition being added. 87 123 if (!existingTransition) { 88 setSingleTransition( vm,structure);124 setSingleTransition(structure); 89 125 return; 90 126 } -
trunk/Source/JavaScriptCore/runtime/StructureTransitionTable.h
r184828 r188978 135 135 136 136 private: 137 friend class SingleSlotTransitionWeakOwner; 138 137 139 bool isUsingSingleSlot() const 138 140 { … … 165 167 } 166 168 167 Structure* singleTransition() const 168 { 169 ASSERT(isUsingSingleSlot()); 170 if (WeakImpl* impl = this->weakImpl()) { 171 if (impl->state() == WeakImpl::Live) 172 return reinterpret_cast<Structure*>(impl->jsValue().asCell()); 173 } 174 return 0; 175 } 176 177 void setSingleTransition(VM&, Structure* structure) 178 { 179 ASSERT(isUsingSingleSlot()); 180 if (WeakImpl* impl = this->weakImpl()) 181 WeakSet::deallocate(impl); 182 WeakImpl* impl = WeakSet::allocate(reinterpret_cast<JSCell*>(structure)); 183 m_data = reinterpret_cast<intptr_t>(impl) | UsingSingleSlotFlag; 184 } 169 Structure* singleTransition() const; 170 void setSingleTransition(Structure*); 185 171 186 172 intptr_t m_data;
Note: See TracChangeset
for help on using the changeset viewer.