Changeset 249484 in webkit


Ignore:
Timestamp:
Sep 4, 2019 11:01:37 AM (5 years ago)
Author:
mark.lam@apple.com
Message:

Source/JavaScriptCore:
Cherry-pick 248143, 248162. rdar://problem/55000992

Also deleted an unused function. This is needed to resolve a merge conflict for
this patch.

  • heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::zap): Deleted.

  • heap/MarkedBlock.h:

(JSC::MarkedBlock::Handle::zap): Deleted.

2019-08-02 Mark Lam <​mark.lam@apple.com>

Gardening: build fix.
​https://bugs.webkit.org/show_bug.cgi?id=200149
<rdar://problem/53570112>

Not reviewed.

  • assembler/CPU.cpp: (JSC::hwPhysicalCPUMax):

2019-08-01 Mark Lam <​mark.lam@apple.com>

Add crash diagnostics for debugging unexpected zapped cells.
​https://bugs.webkit.org/show_bug.cgi?id=200149
<rdar://problem/53570112>

Reviewed by Yusuke Suzuki.

Add a check for zapped cells in SlotVisitor::appendToMarkStack() and
SlotVisitor::visitChildren(). If a zapped cell is detected, we will crash with
some diagnostic info.

To facilitate this, we've made the following changes:

  1. Changed FreeCell to preserve the 1st 8 bytes. This is fine to do because all cells are at least 16 bytes long.
  2. Changed HeapCell::zap() to only zap the structureID. Leave the rest of the cell header info intact (including the cell JSType).
  3. Changed HeapCell::zap() to record the reason for zapping the cell. We stash the reason immediately after the first 8 bytes. This is the same location as FreeCell::scrambledNext. However, since a cell is not expected to be zapped and on the free list at the same time, it is also fine to do this.
  4. Added a few utility functions to MarkedBlock for checking if a cell points into the block.
  5. Added VMInspector and JSDollarVM utilities to dump in-use subspace hashes.
  6. Added some comments to document the hashes of known subspaces.
  7. Added Options::dumpZappedCellCrashData() to make this check conditional. We use this option to disable this check for slower machines so that their PLT5 performance is not impacted.
  • assembler/CPU.cpp: (JSC::hwL3CacheSize): (JSC::hwPhysicalCPUMax):
  • assembler/CPU.h: (JSC::hwL3CacheSize): (JSC::hwPhysicalCPUMax):
  • heap/FreeList.h: (JSC::FreeCell::offsetOfScrambledNext):
  • heap/HeapCell.h: (JSC::HeapCell::zap): (JSC::HeapCell::isZapped const):
  • heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::stopAllocating):
  • heap/MarkedBlock.h: (JSC::MarkedBlock::Handle::start const): (JSC::MarkedBlock::Handle::end const): (JSC::MarkedBlock::Handle::contains const):
  • heap/MarkedBlockInlines.h: (JSC::MarkedBlock::Handle::specializedSweep):
  • heap/MarkedSpace.h: (JSC::MarkedSpace::forEachSubspace):
  • heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendToMarkStack): (JSC::SlotVisitor::visitChildren): (JSC::SlotVisitor::reportZappedCellAndCrash):
  • heap/SlotVisitor.h:
  • jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
  • runtime/Options.cpp: (JSC::Options::initialize):
  • runtime/Options.h:
  • runtime/VM.cpp: (JSC::VM::VM):
  • tools/JSDollarVM.cpp: (JSC::functionDumpSubspaceHashes): (JSC::JSDollarVM::finishCreation):
  • tools/VMInspector.cpp: (JSC::VMInspector::dumpSubspaceHashes):
  • tools/VMInspector.h:

Source/WebCore:
Cherry-pick 248143. rdar://problem/55000992

2019-08-01 Mark Lam <​mark.lam@apple.com>

Add crash diagnostics for debugging unexpected zapped cells.
​https://bugs.webkit.org/show_bug.cgi?id=200149
<rdar://problem/53570112>

Reviewed by Yusuke Suzuki.

No new tests because this is a feature for debugging crashes. It has been tested
manually by modifying the code to force a crash at the point of interest.

Added some comments to document the hashes of known subspaces.

  • bindings/js/WebCoreJSClientData.cpp: (WebCore::JSVMClientData::JSVMClientData):
Location:
branches/safari-608-branch
Files:
22 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-608-branch

  • branches/safari-608-branch/Source/JavaScriptCore/ChangeLog

    r249466 r249484  
     12019-09-04  Mark Lam  <mark.lam@apple.com>
     2
     3        Cherry-pick 248143, 248162. rdar://problem/55000992
     4
     5        Also deleted an unused function.  This is needed to resolve a merge conflict for
     6        this patch.
     7
     8        * heap/MarkedBlock.cpp:
     9        (JSC::MarkedBlock::Handle::zap): Deleted.
     10        * heap/MarkedBlock.h:
     11        (JSC::MarkedBlock::Handle::zap): Deleted.
     12
     13    2019-08-02  Mark Lam  <mark.lam@apple.com>
     14
     15            Gardening: build fix.
     16            https://bugs.webkit.org/show_bug.cgi?id=200149
     17            <rdar://problem/53570112>
     18
     19            Not reviewed.
     20
     21            * assembler/CPU.cpp:
     22            (JSC::hwPhysicalCPUMax):
     23
     24    2019-08-01  Mark Lam  <mark.lam@apple.com>
     25
     26            Add crash diagnostics for debugging unexpected zapped cells.
     27            https://bugs.webkit.org/show_bug.cgi?id=200149
     28            <rdar://problem/53570112>
     29
     30            Reviewed by Yusuke Suzuki.
     31
     32            Add a check for zapped cells in SlotVisitor::appendToMarkStack() and
     33            SlotVisitor::visitChildren().  If a zapped cell is detected, we will crash with
     34            some diagnostic info.
     35
     36            To facilitate this, we've made the following changes:
     37            1. Changed FreeCell to preserve the 1st 8 bytes.  This is fine to do because all
     38               cells are at least 16 bytes long.
     39            2. Changed HeapCell::zap() to only zap the structureID.  Leave the rest of the
     40               cell header info intact (including the cell JSType).
     41            3. Changed HeapCell::zap() to record the reason for zapping the cell.  We stash
     42               the reason immediately after the first 8 bytes.  This is the same location as
     43               FreeCell::scrambledNext.  However, since a cell is not expected to be zapped
     44               and on the free list at the same time, it is also fine to do this.
     45            4. Added a few utility functions to MarkedBlock for checking if a cell points
     46               into the block.
     47            5. Added VMInspector and JSDollarVM utilities to dump in-use subspace hashes.
     48            6. Added some comments to document the hashes of known subspaces.
     49            7. Added Options::dumpZappedCellCrashData() to make this check conditional.
     50               We use this option to disable this check for slower machines so that their
     51               PLT5 performance is not impacted.
     52
     53            * assembler/CPU.cpp:
     54            (JSC::hwL3CacheSize):
     55            (JSC::hwPhysicalCPUMax):
     56            * assembler/CPU.h:
     57            (JSC::hwL3CacheSize):
     58            (JSC::hwPhysicalCPUMax):
     59            * heap/FreeList.h:
     60            (JSC::FreeCell::offsetOfScrambledNext):
     61            * heap/HeapCell.h:
     62            (JSC::HeapCell::zap):
     63            (JSC::HeapCell::isZapped const):
     64            * heap/MarkedBlock.cpp:
     65            (JSC::MarkedBlock::Handle::stopAllocating):
     66            * heap/MarkedBlock.h:
     67            (JSC::MarkedBlock::Handle::start const):
     68            (JSC::MarkedBlock::Handle::end const):
     69            (JSC::MarkedBlock::Handle::contains const):
     70            * heap/MarkedBlockInlines.h:
     71            (JSC::MarkedBlock::Handle::specializedSweep):
     72            * heap/MarkedSpace.h:
     73            (JSC::MarkedSpace::forEachSubspace):
     74            * heap/SlotVisitor.cpp:
     75            (JSC::SlotVisitor::appendToMarkStack):
     76            (JSC::SlotVisitor::visitChildren):
     77            (JSC::SlotVisitor::reportZappedCellAndCrash):
     78            * heap/SlotVisitor.h:
     79            * jit/AssemblyHelpers.cpp:
     80            (JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):
     81            * runtime/Options.cpp:
     82            (JSC::Options::initialize):
     83            * runtime/Options.h:
     84            * runtime/VM.cpp:
     85            (JSC::VM::VM):
     86            * tools/JSDollarVM.cpp:
     87            (JSC::functionDumpSubspaceHashes):
     88            (JSC::JSDollarVM::finishCreation):
     89            * tools/VMInspector.cpp:
     90            (JSC::VMInspector::dumpSubspaceHashes):
     91            * tools/VMInspector.h:
     92
    1932019-09-03  Kocsen Chung  <kocsen_chung@apple.com>
    294

  • branches/safari-608-branch/Source/JavaScriptCore/assembler/CPU.cpp

    r244237 r249484  
    6767    return result;
    6868}
     69
     70int64_t hwL3CacheSize()
     71{
     72    int64_t val = 0;
     73    size_t valSize = sizeof(val);
     74    int rc = sysctlbyname("hw.l3cachesize", &val, &valSize, nullptr, 0);
     75    if (rc < 0)
     76        return 0;
     77    return val;
     78}
     79
     80int32_t hwPhysicalCPUMax()
     81{
     82    int32_t val = 0;
     83    size_t valSize = sizeof(val);
     84    int rc = sysctlbyname("hw.physicalcpu_max", &val, &valSize, nullptr, 0);
     85    if (rc < 0)
     86        return 0;
     87    return val;
     88}
     89
    6990#endif // #if (CPU(X86) || CPU(X86_64)) && OS(DARWIN)
    7091

  • branches/safari-608-branch/Source/JavaScriptCore/assembler/CPU.h

    r246368 r249484  
    11/*
    2  * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    146146bool enableKernTCSM();
    147147int kernTCSMAwareNumberOfProcessorCores();
     148int64_t hwL3CacheSize();
     149int32_t hwPhysicalCPUMax();
    148150#else
    149151ALWAYS_INLINE bool isKernTCSMAvailable() { return false; }
    150152ALWAYS_INLINE bool enableKernTCSM() { return false; }
    151153ALWAYS_INLINE int kernTCSMAwareNumberOfProcessorCores() { return WTF::numberOfProcessorCores(); }
     154ALWAYS_INLINE int64_t hwL3CacheSize() { return 0; }
     155ALWAYS_INLINE int32_t hwPhysicalCPUMax() { return kernTCSMAwareNumberOfProcessorCores(); }
    152156#endif
    153157

  • branches/safari-608-branch/Source/JavaScriptCore/heap/FreeList.h

    r240216 r249484  
    11/*
    2  * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5454    }
    5555   
     56    static ptrdiff_t offsetOfScrambledNext() { return OBJECT_OFFSETOF(FreeCell, scrambledNext); }
     57
     58    uint64_t preservedBitsForCrashAnalysis;
    5659    uintptr_t scrambledNext;
    5760};

  • branches/safari-608-branch/Source/JavaScriptCore/heap/HeapCell.h

    r243667 r249484  
    11/*
    2  * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4848    HeapCell() { }
    4949   
    50     void zap() { *reinterpret_cast_ptr<uintptr_t**>(this) = 0; }
    51     bool isZapped() const { return !*reinterpret_cast_ptr<uintptr_t* const*>(this); }
     50    // We're intentionally only zapping the bits for the structureID and leaving
     51    // the rest of the cell header bits intact for crash analysis uses.
     52    enum ZapReason : int8_t { Unspecified, Destruction, StopAllocating };
     53    void zap(ZapReason reason)
     54    {
     55        uint32_t* cellWords = bitwise_cast<uint32_t*>(this);
     56        cellWords[0] = 0;
     57        // Leaving cellWords[1] alone for crash analysis if needed.
     58        cellWords[2] = reason;
     59    }
     60    bool isZapped() const { return !*bitwise_cast<const uint32_t*>(this); }
    5261
    5362    bool isLive();

  • branches/safari-608-branch/Source/JavaScriptCore/heap/MarkedBlock.cpp

    r244939 r249484  
    162162                dataLog("Free cell: ", RawPointer(cell), "\n");
    163163            if (m_attributes.destruction == NeedsDestruction)
    164                 cell->zap();
     164                cell->zap(HeapCell::StopAllocating);
    165165            block().clearNewlyAllocated(cell);
    166166        });
    … …  
    204204    // freelist, in which case the block will still be Marked!
    205205    sweep(&freeList);
    206 }
    207 
    208 void MarkedBlock::Handle::zap(const FreeList& freeList)
    209 {
    210     freeList.forEach(
    211         [&] (HeapCell* cell) {
    212             if (m_attributes.destruction == NeedsDestruction)
    213                 cell->zap();
    214         });
    215206}
    216207

  • branches/safari-608-branch/Source/JavaScriptCore/heap/MarkedBlock.h

    r244506 r249484  
    147147        void unsweepWithNoNewlyAllocated();
    148148       
    149         void zap(const FreeList&);
    150        
    151149        void shrink();
    152150           
    … …  
    201199        void didRemoveFromDirectory();
    202200       
     201        void* start() const { return &m_block->atoms()[0]; }
     202        void* end() const { return &m_block->atoms()[m_endAtom]; }
     203        bool contains(void* p) const { return start() <= p && p < end(); }
     204
    203205        void dumpState(PrintStream&);
    204206       

  • branches/safari-608-branch/Source/JavaScriptCore/heap/MarkedBlockInlines.h

    r233346 r249484  
    11/*
    2  * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    259259        if (!jsCell->isZapped()) {
    260260            destroyFunc(vm, jsCell);
    261             jsCell->zap();
     261            jsCell->zap(HeapCell::Destruction);
    262262        }
    263263    };

  • branches/safari-608-branch/Source/JavaScriptCore/heap/MarkedSpace.h

    r240216 r249484  
    125125    template<typename Functor> void forEachDeadCell(HeapIterationScope&, const Functor&);
    126126    template<typename Functor> void forEachBlock(const Functor&);
     127    template<typename Functor> void forEachSubspace(const Functor&);
    127128
    128129    void shrink();
    … …  
    241242}
    242243
     244template<typename Functor>
     245void MarkedSpace::forEachSubspace(const Functor& functor)
     246{
     247    for (auto subspace : m_subspaces) {
     248        if (functor(*subspace) == IterationStatus::Done)
     249            return;
     250    }
     251}
     252
     253
    243254ALWAYS_INLINE size_t MarkedSpace::optimalSizeFor(size_t bytes)
    244255{

  • branches/safari-608-branch/Source/JavaScriptCore/heap/SlotVisitor.cpp

    r243467 r249484  
    287287{
    288288    ASSERT(m_heap.isMarked(cell));
     289#if CPU(X86_64)
     290    if (Options::dumpZappedCellCrashData()) {
     291        if (UNLIKELY(cell->isZapped()))
     292            reportZappedCellAndCrash(cell);
     293    }
     294#endif
    289295    ASSERT(!cell->isZapped());
    290    
     296
    291297    container.noteMarked();
    292298   
    … …  
    391397        // FIXME: This could be so much better.
    392398        // https://bugs.webkit.org/show_bug.cgi?id=162462
     399#if CPU(X86_64)
     400        if (Options::dumpZappedCellCrashData()) {
     401            Structure* structure = cell->structure(vm());
     402            if (LIKELY(structure)) {
     403                const MethodTable* methodTable = &structure->classInfo()->methodTable;
     404                methodTable->visitChildren(const_cast<JSCell*>(cell), *this);
     405                break;
     406            }
     407            reportZappedCellAndCrash(const_cast<JSCell*>(cell));
     408        }
     409#endif
    393410        cell->methodTable(vm())->visitChildren(const_cast<JSCell*>(cell), *this);
    394411        break;
    … …  
    810827}
    811828
     829#if CPU(X86_64)
     830NEVER_INLINE NO_RETURN_DUE_TO_CRASH NOT_TAIL_CALLED void SlotVisitor::reportZappedCellAndCrash(JSCell* cell)
     831{
     832    MarkedBlock::Handle* foundBlock = nullptr;
     833    uint32_t* cellWords = reinterpret_cast_ptr<uint32_t*>(this);
     834
     835    uintptr_t cellAddress = bitwise_cast<uintptr_t>(cell);
     836    uintptr_t headerWord = cellWords[1];
     837    uintptr_t zapReason = cellWords[2];
     838    unsigned subspaceHash = 0;
     839    size_t cellSize = 0;
     840
     841    m_heap.objectSpace().forEachBlock([&] (MarkedBlock::Handle* block) {
     842        if (block->contains(cell)) {
     843            foundBlock = block;
     844            return IterationStatus::Done;
     845        }
     846        return IterationStatus::Continue;
     847    });
     848
     849    if (foundBlock) {
     850        subspaceHash = StringHasher::computeHash(foundBlock->subspace()->name());
     851        cellSize = foundBlock->cellSize();
     852    }
     853
     854    CRASH_WITH_INFO(cellAddress, headerWord, zapReason, subspaceHash, cellSize);
     855}
     856#endif // PLATFORM(MAC)
     857
    812858} // namespace JSC

  • branches/safari-608-branch/Source/JavaScriptCore/heap/SlotVisitor.h

    r245808 r249484  
    228228    bool didReachTermination(const AbstractLocker&);
    229229
     230#if CPU(X86_64)
     231    NEVER_INLINE NO_RETURN_DUE_TO_CRASH NOT_TAIL_CALLED void reportZappedCellAndCrash(JSCell*);
     232#endif
     233
    230234    template<typename Func>
    231235    IterationStatus forEachMarkStack(const Func&);

  • branches/safari-608-branch/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

    r243232 r249484  
    547547    // The object is half-allocated: we have what we know is a fresh object, but
    548548    // it's still on the GC's free list.
    549     loadPtr(Address(resultGPR), scratchGPR);
     549    loadPtr(Address(resultGPR, FreeCell::offsetOfScrambledNext()), scratchGPR);
    550550    storePtr(scratchGPR, Address(allocatorGPR, LocalAllocator::offsetOfFreeList() + FreeList::offsetOfScrambledHead()));
    551551       

  • branches/safari-608-branch/Source/JavaScriptCore/runtime/Options.cpp

    r244505 r249484  
    601601                }
    602602            }
     603#endif
     604
     605#if CPU(X86_64) && OS(DARWIN)
     606            Options::dumpZappedCellCrashData() =
     607                (hwPhysicalCPUMax() >= 4) && (hwL3CacheSize() >= static_cast<int64_t>(6 * MB));
    603608#endif
    604609        });

  • branches/safari-608-branch/Source/JavaScriptCore/runtime/Options.h

    r249466 r249484  
    241241    v(bool, stealEmptyBlocksFromOtherAllocators, true, Normal, nullptr) \
    242242    v(bool, eagerlyUpdateTopCallFrame, false, Normal, nullptr) \
     243    v(bool, dumpZappedCellCrashData, false, Normal, nullptr) \
    243244    \
    244245    v(bool, useOSREntryToDFG, true, Normal, nullptr) \

  • branches/safari-608-branch/Source/JavaScriptCore/runtime/VM.cpp

    r246565 r249484  
    266266    , webAssemblyFunctionHeapCellType(std::make_unique<WebAssemblyFunctionHeapCellType>())
    267267#endif
    268     , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get())
    269     , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get())
    270     , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get())
    271     , cellSpace("JSCell", heap, cellHeapCellType.get(), fastMallocAllocator.get())
    272     , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellHeapCellType.get(), jsValueGigacageAllocator.get())
    273     , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get())
    274     , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
    275     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
    276     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
    277     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge)
    278     , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction)
    279     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
    280     , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
    281     , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
    282     , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData)
    283     , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure)
    284     , symbolTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), SymbolTable)
     268    , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get()) // Hash:0x3e7cd762
     269    , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get()) // Hash:0x241e946
     270    , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get()) // Hash:0x7a945300
     271    , cellSpace("JSCell", heap, cellHeapCellType.get(), fastMallocAllocator.get()) // Hash:0xadfb5a79
     272    , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellHeapCellType.get(), jsValueGigacageAllocator.get()) // Hash:0x2f5b102b
     273    , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get()) // Hash:0xbfff3d73
     274    , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x90cf758f
     275    , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x4f5ed7a9
     276    , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x6ebf28e2
     277    , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge) // Hash:0x7b730b20
     278    , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction) // Hash:0x800fca72
     279    , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction) // Hash:0xf845c464
     280    , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable) // Hash:0x67567f95
     281    , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable) // Hash:0xc6bc9f12
     282    , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData) // Hash:0xaca4e62d
     283    , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure) // Hash:0x1f1bcdca
     284    , symbolTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), SymbolTable) // Hash:0xc5215afd
    285285    , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
    286286    , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
    287     , codeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), CodeBlock)
    288     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
    289     , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
    290     , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable)
     287    , codeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), CodeBlock) // Hash:0x77e66ec9
     288    , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable) // Hash:0x5d158f3
     289    , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable) // Hash:0x527c77e7
     290    , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable) // Hash:0xf6b828d9
    291291    , vmType(vmType)
    292292    , clientData(0)
    … …  
    12441244
    12451245
    1246 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType.get(), JSBoundFunction)
    1247 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, destructibleObjectHeapCellType.get(), JSCallbackFunction)
    1248 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterSetterFunctionSpace, cellHeapCellType.get(), JSCustomGetterSetterFunction)
    1249 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, destructibleObjectHeapCellType.get(), ErrorInstance)
    1250 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType.get(), JSNativeStdFunction)
    1251 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, destructibleObjectHeapCellType.get(), ProxyRevoke)
    1252 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, destructibleObjectHeapCellType.get(), JSWeakMap)
    1253 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, destructibleObjectHeapCellType.get(), JSWeakSet)
    1254 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakObjectRefSpace, cellHeapCellType.get(), JSWeakObjectRef)
     1246DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType.get(), JSBoundFunction) // Hash:0xd7916d41
     1247DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, destructibleObjectHeapCellType.get(), JSCallbackFunction) // Hash:0xe7648ebc
     1248DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterSetterFunctionSpace, cellHeapCellType.get(), JSCustomGetterSetterFunction) // Hash:0x18091000
     1249DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, destructibleObjectHeapCellType.get(), ErrorInstance) // Hash:0x3f40d4a
     1250DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType.get(), JSNativeStdFunction) // Hash:0x70ed61e4
     1251DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, destructibleObjectHeapCellType.get(), ProxyRevoke) // Hash:0xb506a939
     1252DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, destructibleObjectHeapCellType.get(), JSWeakMap) // Hash:0x662b12a3
     1253DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, destructibleObjectHeapCellType.get(), JSWeakSet) // Hash:0x4c781b30
     1254DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakObjectRefSpace, cellHeapCellType.get(), JSWeakObjectRef) // Hash:0x8ec68f1f
    12551255#if JSC_OBJC_API_ENABLED
    1256 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
     1256DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, destructibleObjectHeapCellType.get(), ObjCCallbackFunction) // Hash:0x10f610b8
    12571257#endif
    12581258#if ENABLE(WEBASSEMBLY)
    1259 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock)
    1260 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, webAssemblyFunctionHeapCellType.get(), WebAssemblyFunction)
    1261 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, cellHeapCellType.get(), WebAssemblyWrapperFunction)
     1259DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock) // Hash:0x9ad995cd
     1260DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, webAssemblyFunctionHeapCellType.get(), WebAssemblyFunction) // Hash:0x8b7c32db
     1261DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, cellHeapCellType.get(), WebAssemblyWrapperFunction) // Hash:0xd4a5ff01
    12621262#endif
    12631263
    … …  
    12741274    }
    12751275
    1276 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, destructibleCellHeapCellType.get(), EvalExecutable)
    1277 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
     1276DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, destructibleCellHeapCellType.get(), EvalExecutable) // Hash:0x958e3e9d
     1277DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, destructibleCellHeapCellType.get(), ModuleProgramExecutable) // Hash:0x6506fa3c
    12781278
    12791279#undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW

  • branches/safari-608-branch/Source/JavaScriptCore/tools/JSDollarVM.cpp

    r245040 r249484  
    13921392}
    13931393
     1394// Dumps the hashes of all subspaces currently registered with the VM.
     1395// Usage: $vm.dumpSubspaceHashes()
     1396static EncodedJSValue JSC_HOST_CALL functionDumpSubspaceHashes(ExecState* exec)
     1397{
     1398    VM& vm = exec->vm();
     1399    VMInspector::dumpSubspaceHashes(&vm);
     1400    return JSValue::encode(jsUndefined());
     1401}
     1402
    13941403// Gets a JSDollarVMCallFrame for a specified frame index.
    13951404// Usage: var callFrame = $vm.callFrame(0) // frame 0 is the top frame.
    … …  
    22182227    addFunction(vm, "gc", functionGC, 0);
    22192228    addFunction(vm, "edenGC", functionEdenGC, 0);
     2229    addFunction(vm, "dumpSubspaceHashes", functionDumpSubspaceHashes, 0);
    22202230
    22212231    addFunction(vm, "callFrame", functionCallFrame, 1);

  • branches/safari-608-branch/Source/JavaScriptCore/tools/VMInspector.cpp

    r235450 r249484  
    11/*
    2  * Copyright (C) 2017-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2017-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    627627}
    628628
     629void VMInspector::dumpSubspaceHashes(VM* vm)
     630{
     631    unsigned count = 0;
     632    vm->heap.objectSpace().forEachSubspace([&] (const Subspace& subspace) -> IterationStatus {
     633        const char* name = subspace.name();
     634        unsigned hash = StringHasher::computeHash(name);
     635        void* hashAsPtr = reinterpret_cast<void*>(static_cast<uintptr_t>(hash));
     636        dataLogLn("    [", count++, "] ", name, " Hash:", RawPointer(hashAsPtr));
     637        return IterationStatus::Continue;
     638    });
     639    dataLogLn();
     640}
     641
    629642} // namespace JSC

  • branches/safari-608-branch/Source/JavaScriptCore/tools/VMInspector.h

    r241923 r249484  
    11/*
    2  * Copyright (C) 2017-2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2017-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    7979    JS_EXPORT_PRIVATE static void dumpCellMemory(JSCell*);
    8080    JS_EXPORT_PRIVATE static void dumpCellMemoryToStream(JSCell*, PrintStream&);
     81    JS_EXPORT_PRIVATE static void dumpSubspaceHashes(VM*);
    8182
    8283private:

  • branches/safari-608-branch/Source/WebCore

  • branches/safari-608-branch/Source/WebCore/ChangeLog

    r249473 r249484  
     12019-09-04  Mark Lam  <mark.lam@apple.com>
     2
     3        Cherry-pick 248143. rdar://problem/55000992
     4
     5    2019-08-01  Mark Lam  <mark.lam@apple.com>
     6
     7            Add crash diagnostics for debugging unexpected zapped cells.
     8            https://bugs.webkit.org/show_bug.cgi?id=200149
     9            <rdar://problem/53570112>
     10
     11            Reviewed by Yusuke Suzuki.
     12
     13            No new tests because this is a feature for debugging crashes.  It has been tested
     14            manually by modifying the code to force a crash at the point of interest.
     15
     16            Added some comments to document the hashes of known subspaces.
     17
     18            * bindings/js/WebCoreJSClientData.cpp:
     19            (WebCore::JSVMClientData::JSVMClientData):
     20
    1212019-09-04  Kocsen Chung  <kocsen_chung@apple.com>
    222

  • branches/safari-608-branch/Source/WebCore/bindings/js/WebCoreJSClientData.cpp

    r243279 r249484  
    4444    : m_builtinFunctions(vm)
    4545    , m_builtinNames(&vm)
    46     , m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType.get(), RuntimeMethod)
    47     , m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap, vm.destructibleObjectHeapCellType.get(), vm.fastMallocAllocator.get())
    48     , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.cellHeapCellType.get(), vm.fastMallocAllocator.get())
     46    , m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType.get(), RuntimeMethod) // Hash:0xf70c4a85
     47    , m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap, vm.destructibleObjectHeapCellType.get(), vm.fastMallocAllocator.get()) // Hash:0x7724c2e4
     48    , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.cellHeapCellType.get(), vm.fastMallocAllocator.get()) // Hash:0x522d6ec9
    4949{
    5050}
Note: See TracChangeset for help on using the changeset viewer.