Changeset 232798 in webkit

Timestamp:

Jun 13, 2018 11:32:56 AM (6 years ago)

Author:

Yusuke Suzuki

Message:

[JSC] Always use Nuke & Set procedure for x86
​https://bugs.webkit.org/show_bug.cgi?id=186592

Reviewed by Keith Miller.

We always use nukeStructureAndStoreButterfly for Contiguous -> ArrayStorage conversion if the architecture is x86.
By doing so, we can concurrently load structure and butterfly at least in x86 environment even in non-collector
threads.

• runtime/JSObject.cpp:

(JSC::JSObject::convertContiguousToArrayStorage):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSObject.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
+
+        [JSC] Always use Nuke & Set procedure for x86
+        https://bugs.webkit.org/show_bug.cgi?id=186592
+
+        Reviewed by Keith Miller.
+
+        We always use nukeStructureAndStoreButterfly for Contiguous -> ArrayStorage conversion if the architecture is x86.
+        By doing so, we can concurrently load structure and butterfly at least in x86 environment even in non-collector
+        threads.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::convertContiguousToArrayStorage):
+
 2018-06-12  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -1345 +1345 @@
     }
     
-    Structure* newStructure = Structure::nonPropertyTransition(vm, structure(vm), transition);
+    StructureID oldStructureID = this->structureID();
+    Structure* oldStructure = vm.getStructure(oldStructureID);
+    Structure* newStructure = Structure::nonPropertyTransition(vm, oldStructure, transition);
 
     // This has a crazy race with the garbage collector. When changing the butterfly and structure,
@@ -1358 +1360 @@
     //
     // Fortunately, we have the JSCell lock for this purpose!
-    
-    if (vm.heap.mutatorShouldBeFenced()) {
-        auto locker = holdLock(cellLock());
-        setStructureIDDirectly(nuke(structureID()));
-        WTF::storeStoreFence();
-        m_butterfly.set(vm, this, newStorage->butterfly());
-        WTF::storeStoreFence();
-        setStructure(vm, newStructure);
-    } else {
-        m_butterfly.set(vm, this, newStorage->butterfly());
-        setStructure(vm, newStructure);
-    }
+
+    Locker<JSCellLock> locker(NoLockingNecessary);
+    if (vm.heap.mutatorShouldBeFenced())
+        locker = holdLock(cellLock());
+    nukeStructureAndSetButterfly(vm, oldStructureID, newStorage->butterfly());
+    setStructure(vm, newStructure);
     
     return newStorage;