⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 255542 in webkit


Ignore:
Timestamp:
Jan 31, 2020, 10:18:18 PM (7 years ago)
Author:
ysuzuki@apple.com
Message:

[JSC] Hold StructureID instead of Structure* in PolyProtoAccessChain and DFG::CommonData
​https://bugs.webkit.org/show_bug.cgi?id=207086

Reviewed by Mark Lam.

PolyProtoAccessChain and DFG::CommonData are kept alive so long as associated AccessCase / DFG/FTL CodeBlock
is alive. They hold Vector<Structure*> / Vector<WriteBarrier<Structure*>>, but access frequency is low. And
We should hold Vector<StructureID> instead to cut 50% of the size.

  • bytecode/AccessCase.cpp:

(JSC::AccessCase::commit):
(JSC::AccessCase::forEachDependentCell const):
(JSC::AccessCase::doesCalls const):
(JSC::AccessCase::visitWeak const):
(JSC::AccessCase::propagateTransitions const):
(JSC::AccessCase::generateWithGuard):

  • bytecode/AccessCase.h:
  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::propagateTransitions):
(JSC::CodeBlock::determineLiveness):
(JSC::CodeBlock::stronglyVisitWeakReferences):

  • bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):

  • bytecode/InByIdStatus.cpp:

(JSC::InByIdStatus::computeFor):
(JSC::InByIdStatus::computeForStubInfo):
(JSC::InByIdStatus::computeForStubInfoWithoutExitSiteFeedback):

  • bytecode/InByIdStatus.h:
  • bytecode/InstanceOfStatus.cpp:

(JSC::InstanceOfStatus::computeFor):
(JSC::InstanceOfStatus::computeForStubInfo):

  • bytecode/InstanceOfStatus.h:
  • bytecode/PolyProtoAccessChain.cpp:

(JSC::PolyProtoAccessChain::create):
(JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const):
(JSC::PolyProtoAccessChain::dump const):

  • bytecode/PolyProtoAccessChain.h:

(JSC::PolyProtoAccessChain::chain const):
(JSC::PolyProtoAccessChain::forEach const):
(JSC::PolyProtoAccessChain::slotBaseStructure const):
(JSC::PolyProtoAccessChain:: const): Deleted.

  • bytecode/PolymorphicAccess.cpp:

(JSC::PolymorphicAccess::regenerate):

  • bytecode/PutByIdStatus.cpp:

(JSC::PutByIdStatus::computeForStubInfo):

  • bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::summary const):
(JSC::StructureStubInfo::summary):

  • bytecode/StructureStubInfo.h:
  • dfg/DFGCommonData.h:
  • dfg/DFGDesiredWeakReferences.cpp:

(JSC::DFG::DesiredWeakReferences::reallyAdd):

  • dfg/DFGPlan.cpp:

(JSC::DFG::Plan::finalizeWithoutNotifyingCallback):

  • jit/Repatch.cpp:

(JSC::tryCacheGetBy):
(JSC::tryCachePutByID):
(JSC::tryCacheInByID):

Location:
trunk/Source/JavaScriptCore
Files:
19 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r255541 r255542  
     12020-01-31  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Hold StructureID instead of Structure* in PolyProtoAccessChain and DFG::CommonData
     4        https://bugs.webkit.org/show_bug.cgi?id=207086
     5
     6        Reviewed by Mark Lam.
     7
     8        PolyProtoAccessChain and DFG::CommonData are kept alive so long as associated AccessCase / DFG/FTL CodeBlock
     9        is alive. They hold Vector<Structure*> / Vector<WriteBarrier<Structure*>>, but access frequency is low. And
     10        We should hold Vector<StructureID> instead to cut 50% of the size.
     11
     12        * bytecode/AccessCase.cpp:
     13        (JSC::AccessCase::commit):
     14        (JSC::AccessCase::forEachDependentCell const):
     15        (JSC::AccessCase::doesCalls const):
     16        (JSC::AccessCase::visitWeak const):
     17        (JSC::AccessCase::propagateTransitions const):
     18        (JSC::AccessCase::generateWithGuard):
     19        * bytecode/AccessCase.h:
     20        * bytecode/CodeBlock.cpp:
     21        (JSC::CodeBlock::propagateTransitions):
     22        (JSC::CodeBlock::determineLiveness):
     23        (JSC::CodeBlock::stronglyVisitWeakReferences):
     24        * bytecode/GetByStatus.cpp:
     25        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
     26        * bytecode/InByIdStatus.cpp:
     27        (JSC::InByIdStatus::computeFor):
     28        (JSC::InByIdStatus::computeForStubInfo):
     29        (JSC::InByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
     30        * bytecode/InByIdStatus.h:
     31        * bytecode/InstanceOfStatus.cpp:
     32        (JSC::InstanceOfStatus::computeFor):
     33        (JSC::InstanceOfStatus::computeForStubInfo):
     34        * bytecode/InstanceOfStatus.h:
     35        * bytecode/PolyProtoAccessChain.cpp:
     36        (JSC::PolyProtoAccessChain::create):
     37        (JSC::PolyProtoAccessChain::needImpurePropertyWatchpoint const):
     38        (JSC::PolyProtoAccessChain::dump const):
     39        * bytecode/PolyProtoAccessChain.h:
     40        (JSC::PolyProtoAccessChain::chain const):
     41        (JSC::PolyProtoAccessChain::forEach const):
     42        (JSC::PolyProtoAccessChain::slotBaseStructure const):
     43        (JSC::PolyProtoAccessChain:: const): Deleted.
     44        * bytecode/PolymorphicAccess.cpp:
     45        (JSC::PolymorphicAccess::regenerate):
     46        * bytecode/PutByIdStatus.cpp:
     47        (JSC::PutByIdStatus::computeForStubInfo):
     48        * bytecode/StructureStubInfo.cpp:
     49        (JSC::StructureStubInfo::summary const):
     50        (JSC::StructureStubInfo::summary):
     51        * bytecode/StructureStubInfo.h:
     52        * dfg/DFGCommonData.h:
     53        * dfg/DFGDesiredWeakReferences.cpp:
     54        (JSC::DFG::DesiredWeakReferences::reallyAdd):
     55        * dfg/DFGPlan.cpp:
     56        (JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
     57        * jit/Repatch.cpp:
     58        (JSC::tryCacheGetBy):
     59        (JSC::tryCachePutByID):
     60        (JSC::tryCacheInByID):
     61
    1622020-01-31  Yusuke Suzuki  <ysuzuki@apple.com>
    263

  • trunk/Source/JavaScriptCore/bytecode/AccessCase.cpp

    r254735 r255542  
    191191        if ((structure && structure->needImpurePropertyWatchpoint())
    192192            || m_conditionSet.needImpurePropertyWatchpoint()
    193             || (m_polyProtoAccessChain && m_polyProtoAccessChain->needImpurePropertyWatchpoint()))
     193            || (m_polyProtoAccessChain && m_polyProtoAccessChain->needImpurePropertyWatchpoint(vm)))
    194194            result.append(vm.ensureWatchpointSetForImpureProperty(m_identifier.uid()));
    195195    }
    … …  
    400400
    401401template<typename Functor>
    402 void AccessCase::forEachDependentCell(const Functor& functor) const
     402void AccessCase::forEachDependentCell(VM& vm, const Functor& functor) const
    403403{
    404404    m_conditionSet.forEachDependentCell(functor);
    … …  
    406406        functor(m_structure.get());
    407407    if (m_polyProtoAccessChain) {
    408         for (Structure* structure : m_polyProtoAccessChain->chain())
    409             functor(structure);
     408        for (StructureID structureID : m_polyProtoAccessChain->chain())
     409            functor(vm.getStructure(structureID));
    410410    }
    411411
    … …  
    478478}
    479479
    480 bool AccessCase::doesCalls(Vector<JSCell*>* cellsToMarkIfDoesCalls) const
     480bool AccessCase::doesCalls(VM& vm, Vector<JSCell*>* cellsToMarkIfDoesCalls) const
    481481{
    482482    bool doesCalls = false;
    … …  
    529529
    530530    if (doesCalls && cellsToMarkIfDoesCalls) {
    531         forEachDependentCell([&](JSCell* cell) {
     531        forEachDependentCell(vm, [&](JSCell* cell) {
    532532            cellsToMarkIfDoesCalls->append(cell);
    533533        });
    … …  
    686686
    687687    bool isValid = true;
    688     forEachDependentCell([&](JSCell* cell) {
     688    forEachDependentCell(vm, [&](JSCell* cell) {
    689689        isValid &= vm.heap.isMarked(cell);
    690690    });
    … …  
    700700
    701701    if (m_polyProtoAccessChain) {
    702         for (Structure* structure : m_polyProtoAccessChain->chain())
    703             result &= structure->markIfCheap(visitor);
     702        for (StructureID structureID : m_polyProtoAccessChain->chain())
     703            result &= visitor.vm().getStructure(structureID)->markIfCheap(visitor);
    704704    }
    705705
    … …  
    756756            GPRReg baseForAccessGPR = state.scratchGPR;
    757757            jit.move(state.baseGPR, baseForAccessGPR);
    758             m_polyProtoAccessChain->forEach(structure(), [&] (Structure* structure, bool atEnd) {
     758            m_polyProtoAccessChain->forEach(vm, structure(), [&] (Structure* structure, bool atEnd) {
    759759                fallThrough.append(
    760760                    jit.branchStructure(

  • trunk/Source/JavaScriptCore/bytecode/AccessCase.h

    r254464 r255542  
    180180    // If you supply the optional vector, this will append the set of cells that this will need to keep alive
    181181    // past the call.
    182     bool doesCalls(Vector<JSCell*>* cellsToMark = nullptr) const;
     182    bool doesCalls(VM&, Vector<JSCell*>* cellsToMark = nullptr) const;
    183183
    184184    bool isCustom() const
    … …  
    269269
    270270    template<typename Functor>
    271     void forEachDependentCell(const Functor&) const;
     271    void forEachDependentCell(VM&, const Functor&) const;
    272272
    273273    void visitAggregate(SlotVisitor&) const;

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r255541 r255542  
    11341134        dfgCommon->recordedStatuses.markIfCheap(visitor);
    11351135       
    1136         for (auto& weakReference : dfgCommon->weakStructureReferences)
    1137             weakReference->markIfCheap(visitor);
     1136        for (StructureID structureID : dfgCommon->weakStructureReferences)
     1137            vm.getStructure(structureID)->markIfCheap(visitor);
    11381138
    11391139        for (auto& transition : dfgCommon->transitions) {
    … …  
    11941194    }
    11951195    if (allAreLiveSoFar) {
    1196         for (unsigned i = 0; i < dfgCommon->weakStructureReferences.size(); ++i) {
    1197             if (!vm.heap.isMarked(dfgCommon->weakStructureReferences[i].get())) {
     1196        for (StructureID structureID : dfgCommon->weakStructureReferences) {
     1197            Structure* structure = vm.getStructure(structureID);
     1198            if (!vm.heap.isMarked(structure)) {
    11981199                allAreLiveSoFar = false;
    11991200                break;
    … …  
    17211722        visitor.append(weakReference);
    17221723
    1723     for (auto& weakStructureReference : dfgCommon->weakStructureReferences)
    1724         visitor.append(weakStructureReference);
     1724    for (StructureID structureID : dfgCommon->weakStructureReferences)
     1725        visitor.appendUnbarriered(visitor.vm().getStructure(structureID));
    17251726
    17261727    dfgCommon->livenessHasBeenProved = true;

  • trunk/Source/JavaScriptCore/bytecode/GetByStatus.cpp

    r254464 r255542  
    169169    const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CallLinkStatus::ExitSiteData callExitSiteData)
    170170{
    171     StubInfoSummary summary = StructureStubInfo::summary(stubInfo);
     171    StubInfoSummary summary = StructureStubInfo::summary(profiledBlock->vm(), stubInfo);
    172172    if (!isInlineable(summary))
    173173        return GetByStatus(summary, *stubInfo);

  • trunk/Source/JavaScriptCore/bytecode/InByIdStatus.cpp

    r252684 r255542  
    5151
    5252#if ENABLE(DFG_JIT)
    53     result = computeForStubInfoWithoutExitSiteFeedback(locker, map.get(CodeOrigin(bytecodeIndex)).stubInfo, uid);
     53    result = computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), map.get(CodeOrigin(bytecodeIndex)).stubInfo, uid);
    5454
    5555    if (!result.takesSlowPath() && didExit)
    … …  
    9797            {
    9898                ConcurrentJSLocker locker(context->optimizedCodeBlock->m_lock);
    99                 result = computeForStubInfoWithoutExitSiteFeedback(locker, status.stubInfo, uid);
     99                result = computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), status.stubInfo, uid);
    100100            }
    101101            if (result.isSet())
    … …  
    115115InByIdStatus InByIdStatus::computeForStubInfo(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CodeOrigin codeOrigin, UniquedStringImpl* uid)
    116116{
    117     InByIdStatus result = InByIdStatus::computeForStubInfoWithoutExitSiteFeedback(locker, stubInfo, uid);
     117    InByIdStatus result = InByIdStatus::computeForStubInfoWithoutExitSiteFeedback(locker, profiledBlock->vm(), stubInfo, uid);
    118118
    119119    if (!result.takesSlowPath() && hasBadCacheExitSite(profiledBlock, codeOrigin.bytecodeIndex()))
    … …  
    122122}
    123123
    124 InByIdStatus InByIdStatus::computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, StructureStubInfo* stubInfo, UniquedStringImpl* uid)
    125 {
    126     StubInfoSummary summary = StructureStubInfo::summary(stubInfo);
     124InByIdStatus InByIdStatus::computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, VM& vm, StructureStubInfo* stubInfo, UniquedStringImpl* uid)
     125{
     126    StubInfoSummary summary = StructureStubInfo::summary(vm, stubInfo);
    127127    if (!isInlineable(summary))
    128128        return InByIdStatus(summary);

  • trunk/Source/JavaScriptCore/bytecode/InByIdStatus.h

    r253969 r255542  
    114114private:
    115115#if ENABLE(DFG_JIT)
    116     static InByIdStatus computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, StructureStubInfo*, UniquedStringImpl* uid);
     116    static InByIdStatus computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker&, VM&, StructureStubInfo*, UniquedStringImpl* uid);
    117117#endif
    118118    bool appendVariant(const InByIdVariant&);

  • trunk/Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp

    r252684 r255542  
    4747    InstanceOfStatus result;
    4848#if ENABLE(DFG_JIT)
    49     result = computeForStubInfo(locker, infoMap.get(CodeOrigin(bytecodeIndex)).stubInfo);
     49    result = computeForStubInfo(locker, codeBlock->vm(), infoMap.get(CodeOrigin(bytecodeIndex)).stubInfo);
    5050
    5151    if (!result.takesSlowPath()) {
    … …  
    6767
    6868#if ENABLE(DFG_JIT)
    69 InstanceOfStatus InstanceOfStatus::computeForStubInfo(const ConcurrentJSLocker&, StructureStubInfo* stubInfo)
     69InstanceOfStatus InstanceOfStatus::computeForStubInfo(const ConcurrentJSLocker&, VM& vm, StructureStubInfo* stubInfo)
    7070{
    7171    // FIXME: We wouldn't have to bail for nonCell if we taught MatchStructure how to handle non
    7272    // cells. If we fixed that then we wouldn't be able to use summary();
    7373    // https://bugs.webkit.org/show_bug.cgi?id=185784
    74     StubInfoSummary summary = StructureStubInfo::summary(stubInfo);
     74    StubInfoSummary summary = StructureStubInfo::summary(vm, stubInfo);
    7575    if (!isInlineable(summary))
    7676        return InstanceOfStatus(summary);

  • trunk/Source/JavaScriptCore/bytecode/InstanceOfStatus.h

    r253969 r255542  
    8383   
    8484#if ENABLE(DFG_JIT)
    85     static InstanceOfStatus computeForStubInfo(const ConcurrentJSLocker&, StructureStubInfo*);
     85    static InstanceOfStatus computeForStubInfo(const ConcurrentJSLocker&, VM&, StructureStubInfo*);
    8686#endif
    8787   

  • trunk/Source/JavaScriptCore/bytecode/PolyProtoAccessChain.cpp

    r255541 r255542  
    6262        // AccessCase provide the base to us as needed.
    6363        if (iterationNumber)
    64             result->m_chain.append(structure);
     64            result->m_chain.append(structure->id());
    6565        else
    6666            RELEASE_ASSERT(current == base);
    … …  
    8484}
    8585
    86 bool PolyProtoAccessChain::needImpurePropertyWatchpoint() const
     86bool PolyProtoAccessChain::needImpurePropertyWatchpoint(VM& vm) const
    8787{
    88     for (Structure* structure : m_chain) {
    89         if (structure->needImpurePropertyWatchpoint())
     88    for (StructureID structureID : m_chain) {
     89        if (vm.getStructure(structureID)->needImpurePropertyWatchpoint())
    9090            return true;
    9191    }
    … …  
    101101{
    102102    out.print("PolyPolyProtoAccessChain: [\n");
    103     forEach(baseStructure, [&] (Structure* structure, bool) {
     103    forEach(baseStructure->vm(), baseStructure, [&] (Structure* structure, bool) {
    104104        out.print("\t");
    105105        structure->dump(out);

  • trunk/Source/JavaScriptCore/bytecode/PolyProtoAccessChain.h

    r251085 r255542  
    5151    }
    5252
    53     const Vector<Structure*>& chain() const { return m_chain; }
     53    const Vector<StructureID>& chain() const { return m_chain; }
    5454
    5555    void dump(Structure* baseStructure, PrintStream& out) const;
    … …  
    6161    }
    6262
    63     bool needImpurePropertyWatchpoint() const;
     63    bool needImpurePropertyWatchpoint(VM&) const;
    6464
    6565    template <typename Func>
    66     void forEach(Structure* baseStructure, const Func& func) const
     66    void forEach(VM& vm, Structure* baseStructure, const Func& func) const
    6767    {
    6868        bool atEnd = !m_chain.size();
    … …  
    7070        for (unsigned i = 0; i < m_chain.size(); ++i) {
    7171            atEnd = i + 1 == m_chain.size();
    72             func(m_chain[i], atEnd);
     72            func(vm.getStructure(m_chain[i]), atEnd);
    7373        }
    7474    }
    7575
    76     Structure* slotBaseStructure(Structure* baseStructure) const
     76    Structure* slotBaseStructure(VM& vm, Structure* baseStructure) const
    7777    {
    7878        if (m_chain.size())
    79             return m_chain.last();
     79            return vm.getStructure(m_chain.last());
    8080        return baseStructure;
    8181    }
    … …  
    8686    // This does not include the base. We rely on AccessCase providing it for us. That said, this data
    8787    // structure is tied to the base that it was created with.
    88     Vector<Structure*> m_chain;
     88    Vector<StructureID> m_chain;
    8989};
    9090

  • trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp

    r255541 r255542  
    726726    Vector<JSCell*> cellsToMark;
    727727    for (auto& entry : cases)
    728         doesCalls |= entry->doesCalls(&cellsToMark);
     728        doesCalls |= entry->doesCalls(vm, &cellsToMark);
    729729   
    730730    m_stubRoutine = createJITStubRoutine(code, vm, codeBlock, doesCalls, cellsToMark, WTFMove(state.m_callLinkInfos), codeBlockThatOwnsExceptionHandlers, callSiteIndexForExceptionHandling);

  • trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp

    r252684 r255542  
    130130    UniquedStringImpl* uid, CallLinkStatus::ExitSiteData callExitSiteData)
    131131{
    132     StubInfoSummary summary = StructureStubInfo::summary(stubInfo);
     132    StubInfoSummary summary = StructureStubInfo::summary(profiledBlock->vm(), stubInfo);
    133133    if (!isInlineable(summary))
    134134        return PutByIdStatus(summary);

  • trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp

    r254464 r255542  
    352352}
    353353
    354 StubInfoSummary StructureStubInfo::summary() const
     354StubInfoSummary StructureStubInfo::summary(VM& vm) const
    355355{
    356356    StubInfoSummary takesSlowPath = StubInfoSummary::TakesSlowPath;
    … …  
    360360        for (unsigned i = 0; i < list->size(); ++i) {
    361361            const AccessCase& access = list->at(i);
    362             if (access.doesCalls()) {
     362            if (access.doesCalls(vm)) {
    363363                takesSlowPath = StubInfoSummary::TakesSlowPathAndMakesCalls;
    364364                simple = StubInfoSummary::MakesCalls;
    … …  
    377377}
    378378
    379 StubInfoSummary StructureStubInfo::summary(const StructureStubInfo* stubInfo)
     379StubInfoSummary StructureStubInfo::summary(VM& vm, const StructureStubInfo* stubInfo)
    380380{
    381381    if (!stubInfo)
    382382        return StubInfoSummary::NoInformation;
    383383   
    384     return stubInfo->summary();
     384    return stubInfo->summary(vm);
    385385}
    386386

  • trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h

    r254464 r255542  
    167167    }
    168168
    169     StubInfoSummary summary() const;
     169    StubInfoSummary summary(VM&) const;
    170170   
    171     static StubInfoSummary summary(const StructureStubInfo*);
     171    static StubInfoSummary summary(VM&, const StructureStubInfo*);
    172172
    173173    bool containsPC(void* pc) const;

  • trunk/Source/JavaScriptCore/dfg/DFGCommonData.h

    r251468 r255542  
    126126    Vector<WeakReferenceTransition> transitions;
    127127    Vector<WriteBarrier<JSCell>> weakReferences;
    128     Vector<WriteBarrier<Structure>> weakStructureReferences;
     128    Vector<StructureID> weakStructureReferences;
    129129    Vector<CatchEntrypointData> catchEntrypoints;
    130130    Bag<CodeBlockJettisoningWatchpoint> watchpoints;

  • trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp

    r251321 r255542  
    6868void DesiredWeakReferences::reallyAdd(VM& vm, CommonData* common)
    6969{
     70    ASSERT(vm.heap.isDeferred());
    7071    for (JSCell* target : m_references) {
    7172        if (Structure* structure = jsDynamicCast<Structure*>(vm, target)) {
    7273            ConcurrentJSLocker locker(m_codeBlock->m_lock);
    73             common->weakStructureReferences.append(
    74                 WriteBarrier<Structure>(vm, m_codeBlock, structure));
     74            // We do not emit WriteBarrier here since (1) GC is deferred and (2) we emit write-barrier on CodeBlock when finishing DFG::Plan::reallyAdd.
     75            common->weakStructureReferences.append(structure->id());
    7576        } else {
    7677            // There are weird relationships in how optimized CodeBlocks

  • trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp

    r255540 r255542  
    625625            for (WriteBarrier<JSCell>& reference : m_codeBlock->jitCode()->dfgCommon()->weakReferences)
    626626                trackedReferences.add(reference.get());
    627             for (WriteBarrier<Structure>& reference : m_codeBlock->jitCode()->dfgCommon()->weakStructureReferences)
    628                 trackedReferences.add(reference.get());
     627            for (StructureID structureID : m_codeBlock->jitCode()->dfgCommon()->weakStructureReferences)
     628                trackedReferences.add(m_vm->getStructure(structureID));
    629629            for (WriteBarrier<Unknown>& constant : m_codeBlock->constants())
    630630                trackedReferences.add(constant.get());

  • trunk/Source/JavaScriptCore/jit/Repatch.cpp

    r255365 r255542  
    321321                        if (!prototypeAccessChain)
    322322                            return GiveUpOnCache;
    323                         RELEASE_ASSERT(slot.isCacheableCustom() || prototypeAccessChain->slotBaseStructure(structure)->get(vm, propertyName.uid()) == offset);
     323                        RELEASE_ASSERT(slot.isCacheableCustom() || prototypeAccessChain->slotBaseStructure(vm, structure)->get(vm, propertyName.uid()) == offset);
    324324                    } else {
    325325                        // We use ObjectPropertyConditionSet instead for faster accesses.
    … …  
    689689                        if (!prototypeAccessChain)
    690690                            return GiveUpOnCache;
    691                         offset = prototypeAccessChain->slotBaseStructure(baseCell->structure(vm))->get(vm, ident.impl());
     691                        offset = prototypeAccessChain->slotBaseStructure(vm, baseCell->structure(vm))->get(vm, ident.impl());
    692692                    } else {
    693693                        prototypeAccessChain = nullptr;
    … …  
    791791                    if (!prototypeAccessChain)
    792792                        return GiveUpOnCache;
    793                     RELEASE_ASSERT(slot.isCacheableCustom() || prototypeAccessChain->slotBaseStructure(structure)->get(vm, ident.impl()) == slot.cachedOffset());
     793                    RELEASE_ASSERT(slot.isCacheableCustom() || prototypeAccessChain->slotBaseStructure(vm, structure)->get(vm, ident.impl()) == slot.cachedOffset());
    794794                } else {
    795795                    prototypeAccessChain = nullptr;
Note: See TracChangeset for help on using the changeset viewer.