⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 243279 in webkit


Ignore:
Timestamp:
Mar 21, 2019, 12:00:24 AM (7 years ago)
Author:
ysuzuki@apple.com
Message:

[JSC] Use finalizer in JSGlobalLexicalEnvironment and JSGlobalObject
​https://bugs.webkit.org/show_bug.cgi?id=195992

Reviewed by Keith Miller and Mark Lam.

Source/JavaScriptCore:

JSGlobalLexicalEnvironment and JSGlobalObject have their own CompleteSubspace to call destructors while they are not inheriting JSDestructibleObject.
But it is too costly since (1) it requires CompleteSubspace in VM, (2) both objects allocate MarkedBlocks while # of them are really small.

Instead of using CompleteSubspace, we just set finalizers for them. Since these objects are rarely allocated, setting finalizers does not show
memory / performance problems (actually, previously we used finalizer for ArrayPrototype due to the same reason, and it does not show any problems).

And we also add following two changes to JSSegmentedVariableObject.

  1. Remove one boolean used for debugging in Release build. It enlarges sizeof(JSSegmentedVariableObject) and allocates one more MarkedBlock.
  2. Use cellLock() instead.
  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • runtime/JSSegmentedVariableObject.cpp:

(JSC::JSSegmentedVariableObject::findVariableIndex):
(JSC::JSSegmentedVariableObject::addVariables):
(JSC::JSSegmentedVariableObject::visitChildren):
(JSC::JSSegmentedVariableObject::~JSSegmentedVariableObject):
(JSC::JSSegmentedVariableObject::finishCreation):

  • runtime/JSSegmentedVariableObject.h:

(JSC::JSSegmentedVariableObject::subspaceFor): Deleted.

  • runtime/JSSegmentedVariableObjectHeapCellType.cpp: Removed.
  • runtime/JSSegmentedVariableObjectHeapCellType.h: Removed.
  • runtime/StringIteratorPrototype.cpp:
  • runtime/VM.cpp:

(JSC::VM::VM):

  • runtime/VM.h:

Source/WebCore:

Use cellHeapCellType since JSSegmentedVariableObject already set finalizer.

  • bindings/js/WebCoreJSClientData.cpp:

(WebCore::JSVMClientData::JSVMClientData):

Location:
trunk/Source
Files:
2 deleted
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r243011 r243279  
    872872    runtime/JSScriptFetcher.h
    873873    runtime/JSSegmentedVariableObject.h
    874     runtime/JSSegmentedVariableObjectHeapCellType.h
    875874    runtime/JSSet.h
    876875    runtime/JSSetIterator.h

  • trunk/Source/JavaScriptCore/ChangeLog

    r243278 r243279  
     12019-03-20  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Use finalizer in JSGlobalLexicalEnvironment and JSGlobalObject
     4        https://bugs.webkit.org/show_bug.cgi?id=195992
     5
     6        Reviewed by Keith Miller and Mark Lam.
     7
     8        JSGlobalLexicalEnvironment and JSGlobalObject have their own CompleteSubspace to call destructors while they are not inheriting JSDestructibleObject.
     9        But it is too costly since (1) it requires CompleteSubspace in VM, (2) both objects allocate MarkedBlocks while # of them are really small.
     10
     11        Instead of using CompleteSubspace, we just set finalizers for them. Since these objects are rarely allocated, setting finalizers does not show
     12        memory / performance problems (actually, previously we used finalizer for ArrayPrototype due to the same reason, and it does not show any problems).
     13
     14        And we also add following two changes to JSSegmentedVariableObject.
     15
     16        1. Remove one boolean used for debugging in Release build. It enlarges sizeof(JSSegmentedVariableObject) and allocates one more MarkedBlock.
     17        2. Use cellLock() instead.
     18
     19        * CMakeLists.txt:
     20        * JavaScriptCore.xcodeproj/project.pbxproj:
     21        * Sources.txt:
     22        * runtime/JSSegmentedVariableObject.cpp:
     23        (JSC::JSSegmentedVariableObject::findVariableIndex):
     24        (JSC::JSSegmentedVariableObject::addVariables):
     25        (JSC::JSSegmentedVariableObject::visitChildren):
     26        (JSC::JSSegmentedVariableObject::~JSSegmentedVariableObject):
     27        (JSC::JSSegmentedVariableObject::finishCreation):
     28        * runtime/JSSegmentedVariableObject.h:
     29        (JSC::JSSegmentedVariableObject::subspaceFor): Deleted.
     30        * runtime/JSSegmentedVariableObjectHeapCellType.cpp: Removed.
     31        * runtime/JSSegmentedVariableObjectHeapCellType.h: Removed.
     32        * runtime/StringIteratorPrototype.cpp:
     33        * runtime/VM.cpp:
     34        (JSC::VM::VM):
     35        * runtime/VM.h:
     36
    1372019-03-20  Saam Barati  <sbarati@apple.com>
    238

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r243278 r243279  
    350350                0F4F11EB209D426600709654 /* DFGAbstractValueClobberEpoch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */; };
    351351                0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; };
    352                 0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; };
    353352                0F4F828C1E31B9760075184C /* StochasticSpaceTimeMutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */; };
    354353                0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */; };
    … …  
    24422441                0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = "<group>"; };
    24432442                0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = "<group>"; };
    2444                 0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSegmentedVariableObjectHeapCellType.cpp; sourceTree = "<group>"; };
    2445                 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSegmentedVariableObjectHeapCellType.h; sourceTree = "<group>"; };
    24462443                0F4F82891E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StochasticSpaceTimeMutatorScheduler.cpp; sourceTree = "<group>"; };
    24472444                0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StochasticSpaceTimeMutatorScheduler.h; sourceTree = "<group>"; };
    … …  
    69976994                                0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */,
    69986995                                0F919D0F157F3327004A4E7D /* JSSegmentedVariableObject.h */,
    6999                                 0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.cpp */,
    7000                                 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */,
    70016996                                A7299D9B17D12837005F5FF9 /* JSSet.cpp */,
    70026997                                A7299D9C17D12837005F5FF9 /* JSSet.h */,
    … …  
    85068501                                0F6B1CB91861244C00845D97 /* ArityCheckMode.h in Headers */,
    85078502                                A1A009C11831A26E00CF8711 /* ARM64Assembler.h in Headers */,
     8503                                FE1E2C402240DD6200F6B729 /* ARM64EAssembler.h in Headers */,
    85088504                                86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
    85098505                                0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */,
    … …  
    85478543                                0FEC85011BDACDAC0080FF74 /* B3BasicBlock.h in Headers */,
    85488544                                0FEC85021BDACDAC0080FF74 /* B3BasicBlockInlines.h in Headers */,
    8549                                 FE1E2C3F2240DD5800F6B729 /* MacroAssemblerARM64E.h in Headers */,
    85508545                                0FEC85031BDACDAC0080FF74 /* B3BasicBlockUtils.h in Headers */,
    85518546                                0F338E1C1BF286EA0013C88F /* B3BlockInsertionSet.h in Headers */,
    … …  
    86278622                                0F4570411BE584CA0062A629 /* B3TimingScope.h in Headers */,
    86288623                                0FEC853C1BDACDAC0080FF74 /* B3Type.h in Headers */,
    8629                                 FE1E2C402240DD6200F6B729 /* ARM64EAssembler.h in Headers */,
    86308624                                DCFDFBDA1D1F5D9E00FE3D72 /* B3TypeMap.h in Headers */,
    86318625                                0FEC853E1BDACDAC0080FF74 /* B3UpsilonValue.h in Headers */,
    … …  
    94059399                                14D01A7721FB351F00BC54E9 /* JSScriptSourceProvider.h in Headers */,
    94069400                                0F919D11157F332C004A4E7D /* JSSegmentedVariableObject.h in Headers */,
    9407                                 0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectHeapCellType.h in Headers */,
    94089401                                A7299D9E17D12837005F5FF9 /* JSSet.h in Headers */,
    94099402                                A790DD70182F499700588807 /* JSSetIterator.h in Headers */,
    … …  
    94969489                                86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */,
    94979490                                A1A009C01831A22D00CF8711 /* MacroAssemblerARM64.h in Headers */,
     9491                                FE1E2C3F2240DD5800F6B729 /* MacroAssemblerARM64E.h in Headers */,
    94989492                                86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */,
    94999493                                863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */,

  • trunk/Source/JavaScriptCore/Sources.txt

    r243254 r243279  
    847847runtime/JSScriptFetchParameters.cpp
    848848runtime/JSSegmentedVariableObject.cpp
    849 runtime/JSSegmentedVariableObjectHeapCellType.cpp
    850849runtime/JSSet.cpp
    851850runtime/JSSetIterator.cpp

  • trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp

    r229362 r243279  
    3939ScopeOffset JSSegmentedVariableObject::findVariableIndex(void* variableAddress)
    4040{
    41     ConcurrentJSLocker locker(m_lock);
     41    auto locker = holdLock(cellLock());
    4242   
    4343    for (unsigned i = m_variables.size(); i--;) {
    … …  
    5252ScopeOffset JSSegmentedVariableObject::addVariables(unsigned numberOfVariablesToAdd, JSValue initialValue)
    5353{
    54     ConcurrentJSLocker locker(m_lock);
     54    auto locker = holdLock(cellLock());
    5555   
    5656    size_t oldSize = m_variables.size();
    … …  
    7171    // FIXME: We could avoid locking here if SegmentedVector was lock-free. It could be made lock-free
    7272    // relatively easily.
    73     auto locker = holdLock(thisObject->m_lock);
     73    auto locker = holdLock(thisObject->cellLock());
    7474    for (unsigned i = thisObject->m_variables.size(); i--;)
    7575        slotVisitor.appendHidden(thisObject->m_variables[i]);
    … …  
    109109JSSegmentedVariableObject::~JSSegmentedVariableObject()
    110110{
    111     RELEASE_ASSERT(!m_alreadyDestroyed);
     111#ifndef NDEBUG
     112    ASSERT(!m_alreadyDestroyed);
    112113    m_alreadyDestroyed = true;
     114#endif
    113115}
    114116
    … …  
    117119    Base::finishCreation(vm);
    118120    setSymbolTable(vm, SymbolTable::create(vm));
     121    vm.heap.addFinalizer(this, [] (JSCell* cell) {
     122        static_cast<JSSegmentedVariableObject*>(cell)->classInfo()->methodTable.destroy(cell);
     123    });
    119124}
    120125

  • trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h

    r242100 r243279  
    4848// exact dimensions of the variables array at all times.
    4949
    50 // Except for JSGlobalObject, subclasses of this don't call the destructor and leak memory.
    51 
    5250class JSSegmentedVariableObject : public JSSymbolTableObject {
    5351    friend class JIT;
    … …  
    5856
    5957    DECLARE_INFO;
     58
     59    static const bool needsDestruction = true;
     60
     61    template<typename CellType, SubspaceAccess>
     62    static CompleteSubspace* subspaceFor(VM& vm)
     63    {
     64        return &vm.cellSpace;
     65    }
    6066
    6167    bool isValidScopeOffset(ScopeOffset offset)
    … …  
    9197    static void destroy(JSCell*);
    9298   
    93     template<typename, SubspaceAccess>
    94     static CompleteSubspace* subspaceFor(VM& vm)
    95     {
    96         return &vm.segmentedVariableObjectSpace;
    97     }
    98    
    9999    const ClassInfo* classInfo() const { return m_classInfo; }
    100100   
    … …  
    109109    SegmentedVector<WriteBarrier<Unknown>, 16> m_variables;
    110110    const ClassInfo* m_classInfo;
    111     ConcurrentJSLock m_lock;
     111#ifndef NDEBUG
    112112    bool m_alreadyDestroyed { false }; // We use these assertions to check that we aren't doing ancient hacks that result in this being destroyed more than once.
     113#endif
    113114};
    114115

  • trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp

    r242742 r243279  
    2828#include "StringIteratorPrototype.h"
    2929
     30#include "JSCBuiltins.h"
    3031#include "JSCInlines.h"
    3132#include "JSGlobalObject.h"

  • trunk/Source/JavaScriptCore/runtime/VM.cpp

    r242742 r243279  
    9292#include "JSPromiseDeferred.h"
    9393#include "JSPropertyNameEnumerator.h"
    94 #include "JSSegmentedVariableObjectHeapCellType.h"
    9594#include "JSScriptFetchParameters.h"
    9695#include "JSScriptFetcher.h"
    … …  
    275274    , stringHeapCellType(std::make_unique<JSStringHeapCellType>())
    276275    , destructibleObjectHeapCellType(std::make_unique<JSDestructibleObjectHeapCellType>())
    277     , segmentedVariableObjectHeapCellType(std::make_unique<JSSegmentedVariableObjectHeapCellType>())
    278276#if ENABLE(WEBASSEMBLY)
    279277    , webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
    … …  
    288286    , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
    289287    , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
    290     , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap, segmentedVariableObjectHeapCellType.get(), fastMallocAllocator.get())
    291288    , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge)
    292289    , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction)

  • trunk/Source/JavaScriptCore/runtime/VM.h

    r242742 r243279  
    124124class JSObject;
    125125class JSRunLoopTimer;
    126 class JSSegmentedVariableObjectHeapCellType;
    127126class JSStringHeapCellType;
    128127class JSWebAssemblyCodeBlockHeapCellType;
    … …  
    330329    std::unique_ptr<JSStringHeapCellType> stringHeapCellType;
    331330    std::unique_ptr<JSDestructibleObjectHeapCellType> destructibleObjectHeapCellType;
    332     std::unique_ptr<JSSegmentedVariableObjectHeapCellType> segmentedVariableObjectHeapCellType;
    333331#if ENABLE(WEBASSEMBLY)
    334332    std::unique_ptr<JSWebAssemblyCodeBlockHeapCellType> webAssemblyCodeBlockHeapCellType;
    … …  
    366364    CompleteSubspace destructibleObjectSpace;
    367365    CompleteSubspace eagerlySweptDestructibleObjectSpace;
    368     CompleteSubspace segmentedVariableObjectSpace;
    369366   
    370367    IsoSubspace executableToCodeBlockEdgeSpace;

  • trunk/Source/WebCore/ChangeLog

    r243276 r243279  
     12019-03-20  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Use finalizer in JSGlobalLexicalEnvironment and JSGlobalObject
     4        https://bugs.webkit.org/show_bug.cgi?id=195992
     5
     6        Reviewed by Keith Miller and Mark Lam.
     7
     8        Use cellHeapCellType since JSSegmentedVariableObject already set finalizer.
     9
     10        * bindings/js/WebCoreJSClientData.cpp:
     11        (WebCore::JSVMClientData::JSVMClientData):
     12
    1132019-03-20  Youenn Fablet  <youenn@apple.com>
    214

  • trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp

    r230813 r243279  
    3232#include <JavaScriptCore/HeapInlines.h>
    3333#include <JavaScriptCore/JSDestructibleObjectHeapCellType.h>
    34 #include <JavaScriptCore/JSSegmentedVariableObjectHeapCellType.h>
    3534#include <JavaScriptCore/MarkingConstraint.h>
    3635#include <JavaScriptCore/SubspaceInlines.h>
    … …  
    4746    , m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType.get(), RuntimeMethod)
    4847    , m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap, vm.destructibleObjectHeapCellType.get(), vm.fastMallocAllocator.get())
    49     , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.segmentedVariableObjectHeapCellType.get(), vm.fastMallocAllocator.get())
     48    , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.cellHeapCellType.get(), vm.fastMallocAllocator.get())
    5049{
    5150}
Note: See TracChangeset for help on using the changeset viewer.