⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 286667 in webkit


Ignore:
Timestamp:
Dec 8, 2021, 11:11:40 AM (5 years ago)
Author:
ysuzuki@apple.com
Message:

[JSC] Introduce WriteBarrierStructureID
​https://bugs.webkit.org/show_bug.cgi?id=233918

Reviewed by Mark Lam.

This patch adds WriteBarrierStructureID class, which is similar to WriteBarrier<Structure>, but internally,
it holds StructureID, so sizeof(WriteBarrierStructureID) is 4. This class is useful to use StructureID for
memory saving while keeping WriteBarrier<Structure>'s useful features (automatically inserts write-barrier when
setting etc.). This also paves the way to introducing DOMStructures array with WriteBarrierStructureID instead
of costly HashMap<ClassInfo*, WriteBarrier<Structure>>.

  • bytecode/AccessCase.cpp:

(JSC::AccessCase::AccessCase):
(JSC::AccessCase::forEachDependentCell const):
(JSC::AccessCase::dump const):
(JSC::AccessCase::propagateTransitions const):
(JSC::AccessCase::canBeShared):

  • bytecode/AccessCase.h:

(JSC::AccessCase::structure const):
(JSC::AccessCase::newStructure const):
(JSC::AccessCase::hash const):
(JSC::AccessCase::AccessCase):

  • bytecode/CheckPrivateBrandStatus.cpp:

(JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):

  • bytecode/DeleteByStatus.cpp:

(JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):

  • bytecode/GetByStatus.cpp:

(JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):

  • bytecode/InByStatus.cpp:

(JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):

  • bytecode/InlineAccess.cpp:

(JSC::InlineAccess::rewireStubAsJumpInAccess):
(JSC::InlineAccess::resetStubAsJumpInAccess):

  • bytecode/InstanceOfStatus.cpp:

(JSC::InstanceOfStatus::computeForStubInfo):

  • bytecode/InternalFunctionAllocationProfile.h:

(JSC::InternalFunctionAllocationProfile::offsetOfStructureID):
(JSC::InternalFunctionAllocationProfile::structure):
(JSC::InternalFunctionAllocationProfile::clear):
(JSC::InternalFunctionAllocationProfile::visitAggregate):
(JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
(JSC::InternalFunctionAllocationProfile::offsetOfStructure): Deleted.

  • bytecode/PutByStatus.cpp:

(JSC::PutByStatus::computeForStubInfo):

  • bytecode/SetPrivateBrandStatus.cpp:

(JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):

  • bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::initGetByIdSelf):
(JSC::StructureStubInfo::initPutByIdReplace):
(JSC::StructureStubInfo::initInByIdSelf):
(JSC::StructureStubInfo::deref):
(JSC::StructureStubInfo::aboutToDie):
(JSC::StructureStubInfo::addAccessCase):
(JSC::StructureStubInfo::reset):
(JSC::StructureStubInfo::visitAggregateImpl):
(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::summary const):
(JSC::StructureStubInfo::containsPC const):

  • bytecode/StructureStubInfo.h:

(JSC::StructureStubInfo::inlineAccessBaseStructure):
(JSC::StructureStubInfo::offsetOfByIdSelfOffset):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID):
(JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): Deleted.

  • dfg/DFGSpeculativeJIT.cpp:
  • ftl/FTLAbstractHeapRepository.h:
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

  • heap/AbstractSlotVisitor.h:
  • heap/AbstractSlotVisitorInlines.h:

(JSC::AbstractSlotVisitor::append):
(JSC::AbstractSlotVisitor::appendHidden):

  • heap/SlotVisitor.h:
  • heap/SlotVisitorInlines.h:

(JSC::SlotVisitor::append):
(JSC::SlotVisitor::appendHidden):

  • jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitNonNullDecodeStructureID):
(JSC::AssemblyHelpers::emitLoadStructure):

  • jit/AssemblyHelpers.h:
  • jit/JITInlineCacheGenerator.cpp:

(JSC::generateGetByIdInlineAccess):
(JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
(JSC::JITInByIdGenerator::generateBaselineDataICFastPath):

  • runtime/FunctionExecutable.cpp:

(JSC::FunctionExecutable::visitChildrenImpl):

  • runtime/FunctionExecutable.h:
  • runtime/FunctionRareData.cpp:

(JSC::FunctionRareData::visitChildrenImpl):

  • runtime/FunctionRareData.h:
  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::visitChildrenImpl):

  • runtime/JSGlobalObject.h:
  • runtime/JSPropertyNameEnumerator.cpp:

(JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
(JSC::JSPropertyNameEnumerator::visitChildrenImpl):

  • runtime/JSPropertyNameEnumerator.h:
  • runtime/StructureRareData.cpp:

(JSC::StructureRareData::StructureRareData):

  • runtime/StructureRareData.h:
  • runtime/WriteBarrier.h:

(JSC::WriteBarrierStructureID::WriteBarrierStructureID):
(JSC::WriteBarrierStructureID::get const):
(JSC::WriteBarrierStructureID::operator* const):
(JSC::WriteBarrierStructureID::operator-> const):
(JSC::WriteBarrierStructureID::clear):
(JSC::WriteBarrierStructureID::operator bool const):
(JSC::WriteBarrierStructureID::operator! const):
(JSC::WriteBarrierStructureID::setWithoutWriteBarrier):
(JSC::WriteBarrierStructureID::unvalidatedGet const):
(JSC::WriteBarrierStructureID::value const):

  • runtime/WriteBarrierInlines.h:

(JSC::WriteBarrierStructureID::set):
(JSC::WriteBarrierStructureID::setMayBeNull):
(JSC::WriteBarrierStructureID::setEarlyValue):

  • tools/JSDollarVM.cpp:

(JSC::JSDollarVM::finishCreation):
(JSC::JSDollarVM::visitChildrenImpl):

  • tools/JSDollarVM.h:
Location:
trunk/Source/JavaScriptCore
Files:
38 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r286639 r286667  
     12021-12-08  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] Introduce WriteBarrierStructureID
     4        https://bugs.webkit.org/show_bug.cgi?id=233918
     5
     6        Reviewed by Mark Lam.
     7
     8        This patch adds WriteBarrierStructureID class, which is similar to WriteBarrier<Structure>, but internally,
     9        it holds StructureID, so sizeof(WriteBarrierStructureID) is 4. This class is useful to use StructureID for
     10        memory saving while keeping WriteBarrier<Structure>'s useful features (automatically inserts write-barrier when
     11        setting etc.). This also paves the way to introducing DOMStructures array with WriteBarrierStructureID instead
     12        of costly HashMap<ClassInfo*, WriteBarrier<Structure>>.
     13
     14        * bytecode/AccessCase.cpp:
     15        (JSC::AccessCase::AccessCase):
     16        (JSC::AccessCase::forEachDependentCell const):
     17        (JSC::AccessCase::dump const):
     18        (JSC::AccessCase::propagateTransitions const):
     19        (JSC::AccessCase::canBeShared):
     20        * bytecode/AccessCase.h:
     21        (JSC::AccessCase::structure const):
     22        (JSC::AccessCase::newStructure const):
     23        (JSC::AccessCase::hash const):
     24        (JSC::AccessCase::AccessCase):
     25        * bytecode/CheckPrivateBrandStatus.cpp:
     26        (JSC::CheckPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
     27        * bytecode/DeleteByStatus.cpp:
     28        (JSC::DeleteByStatus::computeForStubInfoWithoutExitSiteFeedback):
     29        * bytecode/GetByStatus.cpp:
     30        (JSC::GetByStatus::computeForStubInfoWithoutExitSiteFeedback):
     31        * bytecode/InByStatus.cpp:
     32        (JSC::InByStatus::computeForStubInfoWithoutExitSiteFeedback):
     33        * bytecode/InlineAccess.cpp:
     34        (JSC::InlineAccess::rewireStubAsJumpInAccess):
     35        (JSC::InlineAccess::resetStubAsJumpInAccess):
     36        * bytecode/InstanceOfStatus.cpp:
     37        (JSC::InstanceOfStatus::computeForStubInfo):
     38        * bytecode/InternalFunctionAllocationProfile.h:
     39        (JSC::InternalFunctionAllocationProfile::offsetOfStructureID):
     40        (JSC::InternalFunctionAllocationProfile::structure):
     41        (JSC::InternalFunctionAllocationProfile::clear):
     42        (JSC::InternalFunctionAllocationProfile::visitAggregate):
     43        (JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):
     44        (JSC::InternalFunctionAllocationProfile::offsetOfStructure): Deleted.
     45        * bytecode/PutByStatus.cpp:
     46        (JSC::PutByStatus::computeForStubInfo):
     47        * bytecode/SetPrivateBrandStatus.cpp:
     48        (JSC::SetPrivateBrandStatus::computeForStubInfoWithoutExitSiteFeedback):
     49        * bytecode/StructureStubInfo.cpp:
     50        (JSC::StructureStubInfo::initGetByIdSelf):
     51        (JSC::StructureStubInfo::initPutByIdReplace):
     52        (JSC::StructureStubInfo::initInByIdSelf):
     53        (JSC::StructureStubInfo::deref):
     54        (JSC::StructureStubInfo::aboutToDie):
     55        (JSC::StructureStubInfo::addAccessCase):
     56        (JSC::StructureStubInfo::reset):
     57        (JSC::StructureStubInfo::visitAggregateImpl):
     58        (JSC::StructureStubInfo::visitWeakReferences):
     59        (JSC::StructureStubInfo::propagateTransitions):
     60        (JSC::StructureStubInfo::summary const):
     61        (JSC::StructureStubInfo::containsPC const):
     62        * bytecode/StructureStubInfo.h:
     63        (JSC::StructureStubInfo::inlineAccessBaseStructure):
     64        (JSC::StructureStubInfo::offsetOfByIdSelfOffset):
     65        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructureID):
     66        (JSC::StructureStubInfo::offsetOfInlineAccessBaseStructure): Deleted.
     67        * dfg/DFGSpeculativeJIT.cpp:
     68        * ftl/FTLAbstractHeapRepository.h:
     69        * ftl/FTLLowerDFGToB3.cpp:
     70        (JSC::FTL::DFG::LowerDFGToB3::compileCreatePromise):
     71        (JSC::FTL::DFG::LowerDFGToB3::compileCreateInternalFieldObject):
     72        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
     73        * heap/AbstractSlotVisitor.h:
     74        * heap/AbstractSlotVisitorInlines.h:
     75        (JSC::AbstractSlotVisitor::append):
     76        (JSC::AbstractSlotVisitor::appendHidden):
     77        * heap/SlotVisitor.h:
     78        * heap/SlotVisitorInlines.h:
     79        (JSC::SlotVisitor::append):
     80        (JSC::SlotVisitor::appendHidden):
     81        * jit/AssemblyHelpers.cpp:
     82        (JSC::AssemblyHelpers::emitNonNullDecodeStructureID):
     83        (JSC::AssemblyHelpers::emitLoadStructure):
     84        * jit/AssemblyHelpers.h:
     85        * jit/JITInlineCacheGenerator.cpp:
     86        (JSC::generateGetByIdInlineAccess):
     87        (JSC::JITPutByIdGenerator::generateBaselineDataICFastPath):
     88        (JSC::JITInByIdGenerator::generateBaselineDataICFastPath):
     89        * runtime/FunctionExecutable.cpp:
     90        (JSC::FunctionExecutable::visitChildrenImpl):
     91        * runtime/FunctionExecutable.h:
     92        * runtime/FunctionRareData.cpp:
     93        (JSC::FunctionRareData::visitChildrenImpl):
     94        * runtime/FunctionRareData.h:
     95        * runtime/JSGlobalObject.cpp:
     96        (JSC::JSGlobalObject::visitChildrenImpl):
     97        * runtime/JSGlobalObject.h:
     98        * runtime/JSPropertyNameEnumerator.cpp:
     99        (JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
     100        (JSC::JSPropertyNameEnumerator::visitChildrenImpl):
     101        * runtime/JSPropertyNameEnumerator.h:
     102        * runtime/StructureRareData.cpp:
     103        (JSC::StructureRareData::StructureRareData):
     104        * runtime/StructureRareData.h:
     105        * runtime/WriteBarrier.h:
     106        (JSC::WriteBarrierStructureID::WriteBarrierStructureID):
     107        (JSC::WriteBarrierStructureID::get const):
     108        (JSC::WriteBarrierStructureID::operator* const):
     109        (JSC::WriteBarrierStructureID::operator-> const):
     110        (JSC::WriteBarrierStructureID::clear):
     111        (JSC::WriteBarrierStructureID::operator bool const):
     112        (JSC::WriteBarrierStructureID::operator! const):
     113        (JSC::WriteBarrierStructureID::setWithoutWriteBarrier):
     114        (JSC::WriteBarrierStructureID::unvalidatedGet const):
     115        (JSC::WriteBarrierStructureID::value const):
     116        * runtime/WriteBarrierInlines.h:
     117        (JSC::WriteBarrierStructureID::set):
     118        (JSC::WriteBarrierStructureID::setMayBeNull):
     119        (JSC::WriteBarrierStructureID::setEarlyValue):
     120        * tools/JSDollarVM.cpp:
     121        (JSC::JSDollarVM::finishCreation):
     122        (JSC::JSDollarVM::visitChildrenImpl):
     123        * tools/JSDollarVM.h:
     124
    11252021-12-07  Saam Barati  <sbarati@apple.com>
    2126

  • trunk/Source/JavaScriptCore/bytecode/AccessCase.cpp

    r286572 r286667  
    6464    , m_identifier(identifier)
    6565{
    66     m_structure.setMayBeNull(vm, owner, structure);
     66    m_structureID.setMayBeNull(vm, owner, structure);
    6767    m_conditionSet = conditionSet;
    6868    RELEASE_ASSERT(m_conditionSet.isValid());
    … …  
    540540{
    541541    m_conditionSet.forEachDependentCell(functor);
    542     if (m_structure)
    543         functor(m_structure.get());
     542    if (m_structureID)
     543        functor(m_structureID.get());
    544544    if (m_polyProtoAccessChain) {
    545545        for (StructureID structureID : m_polyProtoAccessChain->chain())
    … …  
    875875            out.print("\n", indent, "from structure = ", pointerDump(structure()),
    876876                "\n", indent, "to structure = ", pointerDump(newStructure()));
    877         else if (m_structure)
    878             out.print("\n", indent, "structure = ", pointerDump(m_structure.get()));
     877        else if (m_structureID)
     878            out.print("\n", indent, "structure = ", pointerDump(m_structureID.get()));
    879879    }
    880880
    … …  
    905905void AccessCase::propagateTransitions(Visitor& visitor) const
    906906{
    907     if (m_structure)
    908         m_structure->markIfCheap(visitor);
     907    if (m_structureID)
     908        m_structureID->markIfCheap(visitor);
    909909
    910910    if (m_polyProtoAccessChain) {
    … …  
    916916    case Transition:
    917917    case Delete:
    918         if (visitor.isMarked(m_structure->previousID()))
    919             visitor.appendUnbarriered(m_structure.get());
     918        if (visitor.isMarked(m_structureID->previousID()))
     919            visitor.appendUnbarriered(m_structureID.get());
    920920        break;
    921921    default:
    … …  
    26142614    if (lhs.m_viaProxy != rhs.m_viaProxy)
    26152615        return false;
    2616     if (lhs.m_structure.get() != rhs.m_structure.get())
     2616    if (lhs.m_structureID.get() != rhs.m_structureID.get())
    26172617        return false;
    26182618    if (lhs.m_identifier != rhs.m_identifier)

  • trunk/Source/JavaScriptCore/bytecode/AccessCase.h

    r282664 r286667  
    185185    {
    186186        if (m_type == Transition || m_type == Delete || m_type == SetPrivateBrand)
    187             return m_structure->previousID();
    188         return m_structure.get();
     187            return m_structureID->previousID();
     188        return m_structureID.get();
    189189    }
    190190    bool guardedByStructureCheck(const StructureStubInfo&) const;
    … …  
    193193    {
    194194        ASSERT(m_type == Transition || m_type == Delete || m_type == SetPrivateBrand);
    195         return m_structure.get();
     195        return m_structureID.get();
    196196    }
    197197
    … …  
    273273    unsigned hash() const
    274274    {
    275         return computeHash(m_conditionSet.hash(), static_cast<unsigned>(m_type), m_viaProxy, m_structure.unvalidatedGet(), m_offset);
     275        return computeHash(m_conditionSet.hash(), static_cast<unsigned>(m_type), m_viaProxy, m_structureID.unvalidatedGet(), m_offset);
    276276    }
    277277
    … …  
    285285        , m_viaProxy(WTFMove(other.m_viaProxy))
    286286        , m_offset(WTFMove(other.m_offset))
    287         , m_structure(WTFMove(other.m_structure))
     287        , m_structureID(WTFMove(other.m_structureID))
    288288        , m_conditionSet(WTFMove(other.m_conditionSet))
    289289        , m_polyProtoAccessChain(WTFMove(other.m_polyProtoAccessChain))
    … …  
    296296        , m_viaProxy(other.m_viaProxy)
    297297        , m_offset(other.m_offset)
    298         , m_structure(other.m_structure)
     298        , m_structureID(other.m_structureID)
    299299        , m_conditionSet(other.m_conditionSet)
    300300        , m_polyProtoAccessChain(other.m_polyProtoAccessChain)
    … …  
    349349    // structure for a transition and we rely on the fact that it has a strong reference to the old
    350350    // structure. For proxies, this is the structure of the object behind the proxy.
    351     WriteBarrier<Structure> m_structure;
     351    WriteBarrierStructureID m_structureID;
    352352
    353353    ObjectPropertyConditionSet m_conditionSet;

  • trunk/Source/JavaScriptCore/bytecode/CheckPrivateBrandStatus.cpp

    r278445 r286667  
    101101
    102102    case CacheType::Stub: {
    103         PolymorphicAccess* list = stubInfo->u.stub;
     103        PolymorphicAccess* list = stubInfo->m_stub;
    104104
    105105        for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {

  • trunk/Source/JavaScriptCore/bytecode/DeleteByStatus.cpp

    r278696 r286667  
    100100
    101101    case CacheType::Stub: {
    102         PolymorphicAccess* list = stubInfo->u.stub;
     102        PolymorphicAccess* list = stubInfo->m_stub;
    103103
    104104        for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {

  • trunk/Source/JavaScriptCore/bytecode/GetByStatus.cpp

    r286635 r286667  
    237237       
    238238    case CacheType::Stub: {
    239         PolymorphicAccess* list = stubInfo->u.stub;
     239        PolymorphicAccess* list = stubInfo->m_stub;
    240240        if (list->size() == 1) {
    241241            const AccessCase& access = list->at(0);

  • trunk/Source/JavaScriptCore/bytecode/InByStatus.cpp

    r283139 r286667  
    161161
    162162    case CacheType::Stub: {
    163         PolymorphicAccess* list = stubInfo->u.stub;
     163        PolymorphicAccess* list = stubInfo->m_stub;
    164164        for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
    165165            const AccessCase& access = list->at(listIndex);

  • trunk/Source/JavaScriptCore/bytecode/InlineAccess.cpp

    r286345 r286667  
    448448
    449449        stubInfo.m_codePtr = target;
    450         stubInfo.m_inlineAccessBaseStructure = StructureID(); // Clear out the inline access code.
     450        stubInfo.m_inlineAccessBaseStructureID.clear(); // Clear out the inline access code.
    451451        return;
    452452    }
    … …  
    465465    if (codeBlock->useDataIC() && codeBlock->jitType() == JITType::BaselineJIT) {
    466466        stubInfo.m_codePtr = stubInfo.slowPathStartLocation;
    467         stubInfo.m_inlineAccessBaseStructure = StructureID(); // Clear out the inline access code.
     467        stubInfo.m_inlineAccessBaseStructureID.clear(); // Clear out the inline access code.
    468468        return;
    469469    }

  • trunk/Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp

    r275490 r286667  
    8484        return TakesSlowPath; // This is conservative. It could be that we have no information.
    8585   
    86     PolymorphicAccess* list = stubInfo->u.stub;
     86    PolymorphicAccess* list = stubInfo->m_stub;
    8787    InstanceOfStatus result;
    8888    for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {

  • trunk/Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h

    r284852 r286667  
    3434class InternalFunctionAllocationProfile {
    3535public:
    36     static inline ptrdiff_t offsetOfStructure() { return OBJECT_OFFSETOF(InternalFunctionAllocationProfile, m_structure); }
     36    static inline ptrdiff_t offsetOfStructureID() { return OBJECT_OFFSETOF(InternalFunctionAllocationProfile, m_structureID); }
    3737
    38     Structure* structure() { return m_structure.get(); }
     38    Structure* structure() { return m_structureID.get(); }
    3939    Structure* createAllocationStructureFromBase(VM&, JSGlobalObject*, JSCell* owner, JSObject* prototype, Structure* base);
    4040
    41     void clear() { m_structure.clear(); }
    42     template<typename Visitor> void visitAggregate(Visitor& visitor) { visitor.append(m_structure); }
     41    void clear() { m_structureID.clear(); }
     42    template<typename Visitor> void visitAggregate(Visitor& visitor) { visitor.append(m_structureID); }
    4343
    4444private:
    45     WriteBarrier<Structure> m_structure;
     45    WriteBarrierStructureID m_structureID;
    4646};
    4747
    4848inline Structure* InternalFunctionAllocationProfile::createAllocationStructureFromBase(VM& vm, JSGlobalObject* baseGlobalObject, JSCell* owner, JSObject* prototype, Structure* baseStructure)
    4949{
    50     ASSERT(!m_structure || m_structure.get()->classInfo() != baseStructure->classInfo() || m_structure->globalObject() != baseStructure->globalObject());
     50    ASSERT(!m_structureID || m_structureID.get()->classInfo() != baseStructure->classInfo() || m_structureID->globalObject() != baseStructure->globalObject());
    5151    ASSERT(baseStructure->hasMonoProto());
    5252
    … …  
    6262    WTF::storeStoreFence();
    6363
    64     m_structure.set(vm, owner, structure);
    65     return m_structure.get();
     64    m_structureID.set(vm, owner, structure);
     65    return structure;
    6666}
    6767

  • trunk/Source/JavaScriptCore/bytecode/PutByStatus.cpp

    r286345 r286667  
    189189       
    190190    case CacheType::Stub: {
    191         PolymorphicAccess* list = stubInfo->u.stub;
     191        PolymorphicAccess* list = stubInfo->m_stub;
    192192       
    193193        PutByStatus result;

  • trunk/Source/JavaScriptCore/bytecode/SetPrivateBrandStatus.cpp

    r278445 r286667  
    101101
    102102    case CacheType::Stub: {
    103         PolymorphicAccess* list = stubInfo->u.stub;
     103        PolymorphicAccess* list = stubInfo->m_stub;
    104104
    105105        for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {

  • trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp

    r286345 r286667  
    5050    setCacheType(locker, CacheType::GetByIdSelf);
    5151    m_identifier = identifier;
    52     m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
    53     codeBlock->vm().writeBarrier(codeBlock);
     52    m_inlineAccessBaseStructureID.set(codeBlock->vm(), codeBlock, inlineAccessBaseStructure);
    5453    byIdSelfOffset = offset;
    5554}
    … …  
    7271    setCacheType(locker, CacheType::PutByIdReplace);
    7372    m_identifier = identifier;
    74     m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
    75     codeBlock->vm().writeBarrier(codeBlock);
     73    m_inlineAccessBaseStructureID.set(codeBlock->vm(), codeBlock, inlineAccessBaseStructure);
    7674    byIdSelfOffset = offset;
    7775}
    … …  
    8280    setCacheType(locker, CacheType::InByIdSelf);
    8381    m_identifier = identifier;
    84     m_inlineAccessBaseStructure = inlineAccessBaseStructure->id();
    85     codeBlock->vm().writeBarrier(codeBlock);
     82    m_inlineAccessBaseStructureID.set(codeBlock->vm(), codeBlock, inlineAccessBaseStructure);
    8683    byIdSelfOffset = offset;
    8784}
    … …  
    9188    switch (m_cacheType) {
    9289    case CacheType::Stub:
    93         delete u.stub;
     90        delete m_stub;
    9491        return;
    9592    case CacheType::Unset:
    … …  
    109106    switch (m_cacheType) {
    110107    case CacheType::Stub:
    111         u.stub->aboutToDie();
     108        m_stub->aboutToDie();
    112109        return;
    113110    case CacheType::Unset:
    … …  
    140137       
    141138        if (m_cacheType == CacheType::Stub) {
    142             result = u.stub->addCase(locker, vm, codeBlock, *this, accessCase.releaseNonNull());
     139            result = m_stub->addCase(locker, vm, codeBlock, *this, accessCase.releaseNonNull());
    143140           
    144141            if (StructureStubInfoInternal::verbose)
    … …  
    177174           
    178175            setCacheType(locker, CacheType::Stub);
    179             u.stub = access.release();
     176            m_stub = access.release();
    180177        }
    181178       
    … …  
    203200        clearBufferedStructures();
    204201       
    205         result = u.stub->regenerate(locker, vm, globalObject, codeBlock, ecmaMode, *this);
     202        result = m_stub->regenerate(locker, vm, globalObject, codeBlock, ecmaMode, *this);
    206203       
    207204        if (StructureStubInfoInternal::verbose)
    … …  
    217214        // be buffered, and we have not yet generated any code. Once the Stub finally generates
    218215        // code, we're no longer running the inline access code, so we can then clear out
    219         // m_inlineAccessBaseStructure. The reason we don't clear m_inlineAccessBaseStructure while
    220         // we're buffered is because we rely on it to reset during GC if m_inlineAccessBaseStructure
     216        // m_inlineAccessBaseStructureID. The reason we don't clear m_inlineAccessBaseStructureID while
     217        // we're buffered is because we rely on it to reset during GC if m_inlineAccessBaseStructureID
    221218        // is collected.
    222219        m_identifier = nullptr;
    223         m_inlineAccessBaseStructure = StructureID();
     220        m_inlineAccessBaseStructureID.clear();
    224221       
    225222        // If we generated some code then we don't want to attempt to repatch in the future until we
    … …  
    236233    clearBufferedStructures();
    237234    m_identifier = nullptr;
    238     m_inlineAccessBaseStructure = StructureID();
     235    m_inlineAccessBaseStructureID.clear();
    239236
    240237    if (m_cacheType == CacheType::Unset)
    … …  
    324321        return;
    325322    case CacheType::Stub:
    326         u.stub->visitAggregate(visitor);
     323        m_stub->visitAggregate(visitor);
    327324        return;
    328325    }
    … …  
    349346        isValid &= vm.heap.isMarked(structure);
    350347    if (m_cacheType == CacheType::Stub)
    351         isValid &= u.stub->visitWeak(vm);
     348        isValid &= m_stub->visitWeak(vm);
    352349
    353350    if (isValid)
    … …  
    365362
    366363    if (m_cacheType == CacheType::Stub)
    367         u.stub->propagateTransitions(visitor);
     364        m_stub->propagateTransitions(visitor);
    368365}
    369366
    … …  
    376373    StubInfoSummary simple = StubInfoSummary::Simple;
    377374    if (m_cacheType == CacheType::Stub) {
    378         PolymorphicAccess* list = u.stub;
     375        PolymorphicAccess* list = m_stub;
    379376        for (unsigned i = 0; i < list->size(); ++i) {
    380377            const AccessCase& access = list->at(i);
    … …  
    408405    if (m_cacheType != CacheType::Stub)
    409406        return false;
    410     return u.stub->containsPC(pc);
     407    return m_stub->containsPC(pc);
    411408}
    412409

  • trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h

    r286345 r286667  
    211211        return considerCaching(vm, codeBlock, structure, impl);
    212212    }
     213
     214    Structure* inlineAccessBaseStructure(VM&)
     215    {
     216        return m_inlineAccessBaseStructureID.get();
     217    }
     218
     219    static ptrdiff_t offsetOfByIdSelfOffset() { return OBJECT_OFFSETOF(StructureStubInfo, byIdSelfOffset); }
     220    static ptrdiff_t offsetOfInlineAccessBaseStructureID() { return OBJECT_OFFSETOF(StructureStubInfo, m_inlineAccessBaseStructureID); }
    213221
    214222private:
    … …  
    352360public:
    353361    CodeOrigin codeOrigin;
     362    PolymorphicAccess* m_stub { nullptr };
    354363    PropertyOffset byIdSelfOffset;
    355     static ptrdiff_t offsetOfByIdSelfOffset() { return OBJECT_OFFSETOF(StructureStubInfo, byIdSelfOffset); }
    356     static ptrdiff_t offsetOfInlineAccessBaseStructure() { return OBJECT_OFFSETOF(StructureStubInfo, m_inlineAccessBaseStructure); }
    357     union {
    358         PolymorphicAccess* stub;
    359     } u;
    360     Structure* inlineAccessBaseStructure(VM&)
    361     {
    362         if (!m_inlineAccessBaseStructure)
    363             return nullptr;
    364         return m_inlineAccessBaseStructure.decode();
    365     }
    366     StructureID m_inlineAccessBaseStructure;
     364    WriteBarrierStructureID m_inlineAccessBaseStructureID;
     365
    367366private:
    368367    CacheableIdentifier m_identifier;
    … …  
    423422    uint8_t repatchCount { 0 };
    424423    uint8_t numberOfCoolDowns { 0 };
    425 
     424    uint8_t bufferingCountdown;
     425private:
     426    Lock m_bufferedStructuresLock;
     427public:
    426428    CallSiteIndex callSiteIndex;
    427 
    428     uint8_t bufferingCountdown;
    429429    bool resetByGC : 1;
    430430    bool tookSlowPath : 1;
    … …  
    436436    bool propertyIsInt32 : 1;
    437437    bool propertyIsSymbol : 1;
    438 private:
    439     Lock m_bufferedStructuresLock;
    440438};
    441439

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r286572 r286667  
    1482014820    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);
    1482114821    slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));
    14822     m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure() - JSFunction::rareDataTag), structureGPR);
    14823     slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, structureGPR));
     14822    m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID() - JSFunction::rareDataTag), structureGPR);
     14823    slowCases.append(m_jit.branchTest32(CCallHelpers::Zero, structureGPR));
     14824    m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
    1482414825    m_jit.move(TrustedImmPtr(node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info()), scratch1GPR);
    1482514826    slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));
    … …  
    1486814869    m_jit.loadPtr(JITCompiler::Address(calleeGPR, JSFunction::offsetOfExecutableOrRareData()), rareDataGPR);
    1486914870    slowCases.append(m_jit.branchTestPtr(MacroAssembler::Zero, rareDataGPR, CCallHelpers::TrustedImm32(JSFunction::rareDataTag)));
    14870     m_jit.loadPtr(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure() - JSFunction::rareDataTag), structureGPR);
    14871     slowCases.append(m_jit.branchTestPtr(CCallHelpers::Zero, structureGPR));
     14871    m_jit.load32(JITCompiler::Address(rareDataGPR, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID() - JSFunction::rareDataTag), structureGPR);
     14872    slowCases.append(m_jit.branchTest32(CCallHelpers::Zero, structureGPR));
     14873    m_jit.emitNonNullDecodeStructureID(structureGPR, structureGPR);
    1487214874    m_jit.move(TrustedImmPtr(JSClass::info()), scratch1GPR);
    1487314875    slowCases.append(m_jit.branchPtr(CCallHelpers::NotEqual, scratch1GPR, CCallHelpers::Address(structureGPR, Structure::classInfoOffset())));

  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

    r286597 r286667  
    8585    macro(FunctionRareData_allocationProfileWatchpointSet, FunctionRareData::offsetOfAllocationProfileWatchpointSet()) \
    8686    macro(FunctionRareData_executable, FunctionRareData::offsetOfExecutable()) \
    87     macro(FunctionRareData_internalFunctionAllocationProfile_structure, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructure()) \
    88     macro(FunctionRareData_boundFunctionStructure, FunctionRareData::offsetOfBoundFunctionStructure()) \
    89     macro(FunctionRareData_allocationProfileClearingWatchpoint, FunctionRareData::offsetOfAllocationProfileClearingWatchpoint()) \
     87    macro(FunctionRareData_internalFunctionAllocationProfile_structureID, FunctionRareData::offsetOfInternalFunctionAllocationProfile() + InternalFunctionAllocationProfile::offsetOfStructureID()) \
    9088    macro(GetterSetter_getter, GetterSetter::offsetOfGetter()) \
    9189    macro(GetterSetter_setter, GetterSetter::offsetOfSetter()) \

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r286597 r286667  
    78787878        m_out.appendTo(hasRareData, hasStructure);
    78797879        LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));
    7880         LValue structure = m_out.loadPtr(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structure);
    7881         m_out.branch(m_out.isZero64(structure), rarely(slowCase), usually(hasStructure));
     7880        LValue structureID = m_out.load32(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structureID);
     7881        m_out.branch(m_out.isZero32(structureID), rarely(slowCase), usually(hasStructure));
    78827882
    78837883        m_out.appendTo(hasStructure, checkGlobalObjectCase);
     7884        LValue structure = decodeNonNullStructure(structureID);
    78847885        m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(m_node->isInternalPromise() ? JSInternalPromise::info() : JSPromise::info())), usually(checkGlobalObjectCase), rarely(slowCase));
    78857886
    … …  
    79337934        m_out.appendTo(hasRareData, hasStructure);
    79347935        LValue rareData = m_out.sub(rareDataTags, m_out.constIntPtr(JSFunction::rareDataTag));
    7935         LValue structure = m_out.loadPtr(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structure);
    7936         m_out.branch(m_out.isZero64(structure), rarely(slowCase), usually(hasStructure));
     7936        LValue structureID = m_out.load32(rareData, m_heaps.FunctionRareData_internalFunctionAllocationProfile_structureID);
     7937        m_out.branch(m_out.isZero32(structureID), rarely(slowCase), usually(hasStructure));
    79377938
    79387939        m_out.appendTo(hasStructure, checkGlobalObjectCase);
     7940        LValue structure = decodeNonNullStructure(structureID);
    79397941        m_out.branch(m_out.equal(m_out.loadPtr(structure, m_heaps.Structure_classInfo), m_out.constIntPtr(JSClass::info())), usually(checkGlobalObjectCase), rarely(slowCase));
    79407942
    … …  
    2097420976    }
    2097520977
    20976     LValue loadStructure(LValue value)
    20977     {
    20978         LValue structureID = m_out.load32(value, m_heaps.JSCell_structureID);
     20978    LValue decodeNonNullStructure(LValue structureID)
     20979    {
    2097920980        LValue maskedStructureID = m_out.bitAnd(structureID, m_out.constInt32(structureIDMask));
    2098020981        return m_out.add(m_out.constIntPtr(g_jscConfig.startOfStructureHeap), m_out.zeroExtPtr(maskedStructureID));
     20982    }
     20983
     20984    LValue loadStructure(LValue value)
     20985    {
     20986        LValue structureID = m_out.load32(value, m_heaps.JSCell_structureID);
     20987        return decodeNonNullStructure(structureID);
    2098120988    }
    2098220989

  • trunk/Source/JavaScriptCore/heap/AbstractSlotVisitor.h

    r274601 r286667  
    4949template<typename T> class Weak;
    5050template<typename T, typename Traits> class WriteBarrierBase;
     51class WriteBarrierStructureID;
    5152
    5253class AbstractSlotVisitor {
    … …  
    144145    template<typename T, typename Traits> void append(const WriteBarrierBase<T, Traits>&);
    145146    template<typename T, typename Traits> void appendHidden(const WriteBarrierBase<T, Traits>&);
     147    void append(const WriteBarrierStructureID&);
     148    void appendHidden(const WriteBarrierStructureID&);
    146149    template<typename Iterator> void append(Iterator begin , Iterator end);
    147150    ALWAYS_INLINE void appendValues(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);

  • trunk/Source/JavaScriptCore/heap/AbstractSlotVisitorInlines.h

    r277773 r286667  
    159159}
    160160
     161ALWAYS_INLINE void AbstractSlotVisitor::append(const WriteBarrierStructureID& slot)
     162{
     163    appendUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
     164}
     165
     166ALWAYS_INLINE void AbstractSlotVisitor::appendHidden(const WriteBarrierStructureID& slot)
     167{
     168    appendHiddenUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
     169}
     170
    161171ALWAYS_INLINE void AbstractSlotVisitor::appendHiddenUnbarriered(JSValue value)
    162172{

  • trunk/Source/JavaScriptCore/heap/SlotVisitor.h

    r278093 r286667  
    9393    template<typename T, typename Traits> void append(const WriteBarrierBase<T, Traits>&);
    9494    template<typename T, typename Traits> void appendHidden(const WriteBarrierBase<T, Traits>&);
     95    void append(const WriteBarrierStructureID&);
     96    void appendHidden(const WriteBarrierStructureID&);
    9597    template<typename Iterator> void append(Iterator begin , Iterator end);
    9698    ALWAYS_INLINE void appendValues(const WriteBarrierBase<Unknown, RawValueTraits<Unknown>>*, size_t count);

  • trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h

    r273138 r286667  
    117117}
    118118
     119ALWAYS_INLINE void SlotVisitor::append(const WriteBarrierStructureID& slot)
     120{
     121    appendUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
     122}
     123
     124ALWAYS_INLINE void SlotVisitor::appendHidden(const WriteBarrierStructureID& slot)
     125{
     126    appendHiddenUnbarriered(reinterpret_cast<JSCell*>(slot.get()));
     127}
     128
    119129template<typename Iterator>
    120130ALWAYS_INLINE void SlotVisitor::append(Iterator begin, Iterator end)

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp

    r286345 r286667  
    390390}
    391391
    392 void AssemblyHelpers::emitLoadStructure(VM&, RegisterID source, RegisterID dest)
    393 {
    394     load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
     392void AssemblyHelpers::emitNonNullDecodeStructureID(RegisterID source, RegisterID dest)
     393{
     394    move(source, dest);
    395395#if CPU(ADDRESS64)
    396396    // This could use BFI on arm64 but that only helps if the start of structure heap is encodable as a mov and not as an immediate in the add so it's probably not super important.
    … …  
    398398    add64(TrustedImm64(g_jscConfig.startOfStructureHeap), dest);
    399399#endif // not CPU(ADDRESS64)
     400}
     401
     402void AssemblyHelpers::emitLoadStructure(VM&, RegisterID source, RegisterID dest)
     403{
     404    load32(MacroAssembler::Address(source, JSCell::structureIDOffset()), dest);
     405    emitNonNullDecodeStructureID(dest, dest);
    400406}
    401407

  • trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

    r286597 r286667  
    15781578    }
    15791579   
     1580    void emitNonNullDecodeStructureID(RegisterID source, RegisterID dest);
    15801581    void emitLoadStructure(VM&, RegisterID source, RegisterID dest);
    15811582    void emitLoadPrototype(VM&, GPRReg objectGPR, JSValueRegs resultRegs, JumpList& slowPath);

  • trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp

    r286424 r286667  
    137137{
    138138    jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
    139     auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
     139    auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructureID()));
    140140    jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);
    141141    doInlineAccess.link(&jit);
    … …  
    222222
    223223    jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
    224     auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
     224    auto doInlineAccess = jit.branch32(CCallHelpers::Equal, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructureID()));
    225225    jit.farJump(CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfCodePtr()), JITStubRoutinePtrTag);
    226226    doInlineAccess.link(&jit);
    … …  
    413413
    414414    jit.load32(CCallHelpers::Address(baseJSR.payloadGPR(), JSCell::structureIDOffset()), scratchGPR);
    415     auto skipInlineAccess = jit.branch32(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructure()));
     415    auto skipInlineAccess = jit.branch32(CCallHelpers::NotEqual, scratchGPR, CCallHelpers::Address(stubInfoGPR, StructureStubInfo::offsetOfInlineAccessBaseStructureID()));
    416416    jit.boxBoolean(true, resultJSR);
    417417    auto finished = jit.jump();

  • trunk/Source/JavaScriptCore/runtime/FunctionExecutable.cpp

    r278588 r286667  
    7979    visitor.append(thisObject->m_unlinkedExecutable);
    8080    if (RareData* rareData = thisObject->m_rareData.get()) {
    81         visitor.append(rareData->m_cachedPolyProtoStructure);
     81        visitor.append(rareData->m_cachedPolyProtoStructureID);
    8282        visitor.append(rareData->m_asString);
    8383        if (TemplateObjectMap* map = rareData->m_templateObjectMap.get()) {

  • trunk/Source/JavaScriptCore/runtime/FunctionExecutable.h

    r286347 r286667  
    258258    {
    259259        if (UNLIKELY(m_rareData))
    260             return m_rareData->m_cachedPolyProtoStructure.get();
     260            return m_rareData->m_cachedPolyProtoStructureID.get();
    261261        return nullptr;
    262262    }
    263263    void setCachedPolyProtoStructure(VM& vm, Structure* structure)
    264264    {
    265         ensureRareData().m_cachedPolyProtoStructure.set(vm, this, structure);
     265        ensureRareData().m_cachedPolyProtoStructureID.set(vm, this, structure);
    266266    }
    267267
    … …  
    311311        unsigned m_typeProfilingStartOffset { UINT_MAX };
    312312        unsigned m_typeProfilingEndOffset { UINT_MAX };
     313        WriteBarrierStructureID m_cachedPolyProtoStructureID;
    313314        std::unique_ptr<TemplateObjectMap> m_templateObjectMap;
    314         WriteBarrier<Structure> m_cachedPolyProtoStructure;
    315315        WriteBarrier<JSString> m_asString;
    316316    };

  • trunk/Source/JavaScriptCore/runtime/FunctionRareData.cpp

    r285730 r286667  
    6161    rareData->m_objectAllocationProfile.visitAggregate(visitor);
    6262    rareData->m_internalFunctionAllocationProfile.visitAggregate(visitor);
    63     visitor.append(rareData->m_boundFunctionStructure);
     63    visitor.append(rareData->m_boundFunctionStructureID);
    6464    visitor.append(rareData->m_executable);
    6565}

  • trunk/Source/JavaScriptCore/runtime/FunctionRareData.h

    r273138 r286667  
    7373    static inline ptrdiff_t offsetOfAllocationProfileWatchpointSet() { return OBJECT_OFFSETOF(FunctionRareData, m_allocationProfileWatchpointSet); }
    7474    static inline ptrdiff_t offsetOfInternalFunctionAllocationProfile() { return OBJECT_OFFSETOF(FunctionRareData, m_internalFunctionAllocationProfile); }
    75     static inline ptrdiff_t offsetOfBoundFunctionStructure() { return OBJECT_OFFSETOF(FunctionRareData, m_boundFunctionStructure); }
    7675    static inline ptrdiff_t offsetOfExecutable() { return OBJECT_OFFSETOF(FunctionRareData, m_executable); }
    77     static inline ptrdiff_t offsetOfAllocationProfileClearingWatchpoint() { return OBJECT_OFFSETOF(FunctionRareData, m_allocationProfileClearingWatchpoint); }
    7876
    7977    ObjectAllocationProfileWithPrototype* objectAllocationProfile()
    … …  
    114112    }
    115113
    116     Structure* getBoundFunctionStructure() { return m_boundFunctionStructure.get(); }
    117     void setBoundFunctionStructure(VM& vm, Structure* structure) { m_boundFunctionStructure.set(vm, this, structure); }
     114    Structure* getBoundFunctionStructure() { return m_boundFunctionStructureID.get(); }
     115    void setBoundFunctionStructure(VM& vm, Structure* structure) { m_boundFunctionStructureID.set(vm, this, structure); }
    118116
    119117    ExecutableBase* executable() const { return m_executable.get(); }
    … …  
    161159    InlineWatchpointSet m_allocationProfileWatchpointSet;
    162160    InternalFunctionAllocationProfile m_internalFunctionAllocationProfile;
    163     WriteBarrier<Structure> m_boundFunctionStructure;
     161    WriteBarrierStructureID m_boundFunctionStructureID;
    164162    WriteBarrier<ExecutableBase> m_executable;
    165163    std::unique_ptr<AllocationProfileClearingWatchpoint> m_allocationProfileClearingWatchpoint;

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r286313 r286667  
    22822282        property.visit(visitor);
    22832283
    2284 #define VISIT_SIMPLE_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) { \
     2284#define VISIT_SIMPLE_TYPE_PROTOTYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) \
    22852285        visitor.append(thisObject->m_ ## lowerName ## Prototype); \
     2286
     2287#define VISIT_SIMPLE_TYPE_STRUCTURE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) \
    22862288        visitor.append(thisObject->m_ ## properName ## Structure); \
    2287     }
    2288 
    2289     FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE)
    2290     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE)
     2289
     2290    FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE_STRUCTURE)
     2291    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE_STRUCTURE)
     2292    FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE_PROTOTYPE)
     2293    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE_PROTOTYPE)
    22912294
    22922295#define VISIT_LAZY_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) if (featureFlag) \

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

    r286313 r286667  
    377377    LazyProperty<JSGlobalObject, Structure> m_withScopeStructure;
    378378    LazyProperty<JSGlobalObject, Structure> m_strictEvalActivationStructure;
    379     WriteBarrier<Structure> m_lexicalEnvironmentStructure;
    380379    LazyProperty<JSGlobalObject, Structure> m_moduleEnvironmentStructure;
    381     WriteBarrier<Structure> m_directArgumentsStructure;
    382     WriteBarrier<Structure> m_scopedArgumentsStructure;
    383     WriteBarrier<Structure> m_clonedArgumentsStructure;
    384 
    385     WriteBarrier<Structure> m_objectStructureForObjectConstructor;
    386        
    387     // Lists the actual structures used for having these particular indexing shapes.
    388     WriteBarrier<Structure> m_originalArrayStructureForIndexingShape[NumberOfArrayIndexingModes];
    389     // Lists the structures we should use during allocation for these particular indexing shapes.
    390     // These structures will differ from the originals list above when we are having a bad time.
    391     WriteBarrier<Structure> m_arrayStructureForIndexingShapeDuringAllocation[NumberOfArrayIndexingModes];
    392 
    393380    LazyProperty<JSGlobalObject, Structure> m_callbackConstructorStructure;
    394381    LazyProperty<JSGlobalObject, Structure> m_callbackFunctionStructure;
    … …  
    402389    LazyProperty<JSGlobalObject, Structure> m_glibWrapperObjectStructure;
    403390#endif
    404     WriteBarrier<Structure> m_nullPrototypeObjectStructure;
    405     WriteBarrier<Structure> m_calleeStructure;
    406 
    407     WriteBarrier<Structure> m_hostFunctionStructure;
     391
     392    WriteBarrierStructureID m_lexicalEnvironmentStructure;
     393    WriteBarrierStructureID m_directArgumentsStructure;
     394    WriteBarrierStructureID m_scopedArgumentsStructure;
     395    WriteBarrierStructureID m_clonedArgumentsStructure;
     396
     397    WriteBarrierStructureID m_objectStructureForObjectConstructor;
     398
     399    // Lists the actual structures used for having these particular indexing shapes.
     400    WriteBarrierStructureID m_originalArrayStructureForIndexingShape[NumberOfArrayIndexingModes];
     401    // Lists the structures we should use during allocation for these particular indexing shapes.
     402    // These structures will differ from the originals list above when we are having a bad time.
     403    WriteBarrierStructureID m_arrayStructureForIndexingShapeDuringAllocation[NumberOfArrayIndexingModes];
     404
     405    WriteBarrierStructureID m_nullPrototypeObjectStructure;
     406    WriteBarrierStructureID m_calleeStructure;
     407
     408    WriteBarrierStructureID m_hostFunctionStructure;
    408409
    409410    struct FunctionStructures {
    410         WriteBarrier<Structure> arrowFunctionStructure;
    411         WriteBarrier<Structure> sloppyFunctionStructure;
    412         WriteBarrier<Structure> strictFunctionStructure;
     411        WriteBarrierStructureID arrowFunctionStructure;
     412        WriteBarrierStructureID sloppyFunctionStructure;
     413        WriteBarrierStructureID strictFunctionStructure;
    413414    };
    414415    FunctionStructures m_builtinFunctions;
    415416    FunctionStructures m_ordinaryFunctions;
     417
     418    PropertyOffset m_functionNameOffset;
     419    WriteBarrierStructureID m_shadowRealmObjectStructure;
     420    WriteBarrierStructureID m_regExpStructure;
     421    WriteBarrierStructureID m_asyncFunctionStructure;
     422    WriteBarrierStructureID m_asyncGeneratorFunctionStructure;
     423    WriteBarrierStructureID m_generatorFunctionStructure;
     424    WriteBarrierStructureID m_generatorStructure;
     425    WriteBarrierStructureID m_asyncGeneratorStructure;
     426    WriteBarrierStructureID m_arrayIteratorStructure;
     427    WriteBarrierStructureID m_mapIteratorStructure;
     428    WriteBarrierStructureID m_setIteratorStructure;
     429    WriteBarrierStructureID m_regExpMatchesArrayStructure;
     430    WriteBarrierStructureID m_regExpMatchesArrayWithIndicesStructure;
     431    WriteBarrierStructureID m_regExpMatchesIndicesArrayStructure;
    416432
    417433    LazyProperty<JSGlobalObject, Structure> m_boundFunctionStructure;
    … …  
    419435    LazyProperty<JSGlobalObject, Structure> m_customSetterFunctionStructure;
    420436    LazyProperty<JSGlobalObject, Structure> m_nativeStdFunctionStructure;
    421     PropertyOffset m_functionNameOffset;
    422     WriteBarrier<Structure> m_shadowRealmObjectStructure;
    423     WriteBarrier<Structure> m_regExpStructure;
    424437    WriteBarrier<AsyncFunctionPrototype> m_asyncFunctionPrototype;
    425438    WriteBarrier<AsyncGeneratorFunctionPrototype> m_asyncGeneratorFunctionPrototype;
    426     WriteBarrier<Structure> m_asyncFunctionStructure;
    427     WriteBarrier<Structure> m_asyncGeneratorFunctionStructure;
    428     WriteBarrier<Structure> m_generatorFunctionStructure;
    429     WriteBarrier<Structure> m_generatorStructure;
    430     WriteBarrier<Structure> m_asyncGeneratorStructure;
    431     WriteBarrier<Structure> m_arrayIteratorStructure;
    432     WriteBarrier<Structure> m_mapIteratorStructure;
    433     WriteBarrier<Structure> m_setIteratorStructure;
    434439    LazyProperty<JSGlobalObject, Structure> m_iteratorResultObjectStructure;
    435440    LazyProperty<JSGlobalObject, Structure> m_dataPropertyDescriptorObjectStructure;
    436441    LazyProperty<JSGlobalObject, Structure> m_accessorPropertyDescriptorObjectStructure;
    437     WriteBarrier<Structure> m_regExpMatchesArrayStructure;
    438     WriteBarrier<Structure> m_regExpMatchesArrayWithIndicesStructure;
    439     WriteBarrier<Structure> m_regExpMatchesIndicesArrayStructure;
    440442    LazyProperty<JSGlobalObject, Structure> m_moduleRecordStructure;
    441443    LazyProperty<JSGlobalObject, Structure> m_moduleNamespaceObjectStructure;
    … …  
    445447    LazyClassStructure m_sharedArrayBufferStructure;
    446448
    447 #define DEFINE_STORAGE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \
    448     WriteBarrier<capitalName ## Prototype> m_ ## lowerName ## Prototype; \
    449     WriteBarrier<Structure> m_ ## properName ## Structure;
     449#define DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \
     450    WriteBarrier<capitalName ## Prototype> m_ ## lowerName ## Prototype;
     451
     452#define DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \
     453    WriteBarrierStructureID m_ ## properName ## Structure;
    450454
    451455#define DEFINE_STORAGE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase, featureFlag) \
    452456    LazyClassStructure m_ ## properName ## Structure;
    453457
    454     FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
    455     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
     458    FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE)
     459    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE)
     460    FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE)
     461    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE)
    456462   
    457463#if ENABLE(WEBASSEMBLY)
    … …  
    465471    FOR_EACH_LAZY_BUILTIN_TYPE(DEFINE_STORAGE_FOR_LAZY_TYPE)
    466472
    467 #undef DEFINE_STORAGE_FOR_SIMPLE_TYPE
     473#undef DEFINE_STORAGE_FOR_SIMPLE_TYPE_PROTOTYPE
     474#undef DEFINE_STORAGE_FOR_SIMPLE_TYPE_STRUCTURE
    468475#undef DEFINE_STORAGE_FOR_LAZY_TYPE
    469476
    … …  
    575582    bool m_evalEnabled { true };
    576583    bool m_webAssemblyEnabled { true };
     584    bool m_needsSiteSpecificQuirks { false };
    577585    unsigned m_globalLexicalBindingEpoch { 1 };
    578586    String m_evalDisabledErrorMessage;
    … …  
    11951203    JS_EXPORT_PRIVATE static void clearRareData(JSCell*);
    11961204
    1197     bool m_needsSiteSpecificQuirks { false };
    11981205#if JSC_OBJC_API_ENABLED
    11991206    RetainPtr<JSWrapperMap> m_wrapperMap;

  • trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp

    r286572 r286667  
    5151    : JSCell(vm, vm.propertyNameEnumeratorStructure.get())
    5252    , m_propertyNames(vm, this, propertyNamesBuffer)
    53     , m_cachedStructureID(structure ? structure->id() : StructureID())
     53    , m_cachedStructureID(vm, this, structure, WriteBarrierStructureID::MayBeNull)
    5454    , m_indexedLength(indexedLength)
    5555    , m_endStructurePropertyIndex(numberStructureProperties)
    … …  
    8787        visitor.append(propertyNames, propertyNames + thisObject->sizeOfPropertyNames());
    8888    }
    89 
    90     if (thisObject->cachedStructureID())
    91         visitor.appendUnbarriered(thisObject->cachedStructureID().decode());
     89    visitor.append(thisObject->m_cachedStructureID);
    9290}
    9391

  • trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h

    r286347 r286667  
    7474    {
    7575        UNUSED_PARAM(vm);
    76         if (!m_cachedStructureID)
    77             return nullptr;
    78         return m_cachedStructureID.decode();
     76        return m_cachedStructureID.get();
    7977    }
    80     StructureID cachedStructureID() const { return m_cachedStructureID; }
     78    StructureID cachedStructureID() const { return m_cachedStructureID.value(); }
    8179    uint32_t indexedLength() const { return m_indexedLength; }
    8280    uint32_t endStructurePropertyIndex() const { return m_endStructurePropertyIndex; }
    … …  
    109107    // After instantiating JSPropertyNameEnumerator, we must not change any fields.
    110108    AuxiliaryBarrier<WriteBarrier<JSString>*> m_propertyNames;
    111     StructureID m_cachedStructureID;
     109    WriteBarrierStructureID m_cachedStructureID;
    112110    uint32_t m_indexedLength;
    113111    uint32_t m_endStructurePropertyIndex;

  • trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp

    r285730 r286667  
    6161StructureRareData::StructureRareData(VM& vm, Structure* previous)
    6262    : JSCell(vm, vm.structureRareDataStructure.get())
     63    , m_previous(vm, this, previous, WriteBarrierStructureID::MayBeNull)
    6364    , m_maxOffset(invalidOffset)
    6465    , m_transitionOffset(invalidOffset)
    6566{
    66     if (previous)
    67         m_previous.set(vm, this, previous);
    6867}
    6968

  • trunk/Source/JavaScriptCore/runtime/StructureRareData.h

    r286347 r286667  
    141141    bool tryCachePropertyNameEnumeratorViaWatchpoint(VM&, Structure*, StructureChain*);
    142142
    143     WriteBarrier<Structure> m_previous;
    144143    // FIXME: We should have some story for clearing these property names caches in GC.
    145144    // https://bugs.webkit.org/show_bug.cgi?id=192659
    … …  
    157156    Box<InlineWatchpointSet> m_polyProtoWatchpoint;
    158157
     158    WriteBarrierStructureID m_previous;
    159159    PropertyOffset m_maxOffset;
    160160    PropertyOffset m_transitionOffset;

  • trunk/Source/JavaScriptCore/runtime/WriteBarrier.h

    r268993 r286667  
    2828#include "GCAssertions.h"
    2929#include "HandleTypes.h"
     30#include "StructureID.h"
    3031#include <type_traits>
    3132#include <wtf/RawPtrTraits.h>
    … …  
    249250}
    250251
     252class WriteBarrierStructureID {
     253public:
     254    constexpr WriteBarrierStructureID() = default;
     255
     256    WriteBarrierStructureID(VM& vm, const JSCell* owner, Structure* value)
     257    {
     258        set(vm, owner, value);
     259    }
     260
     261    WriteBarrierStructureID(DFG::DesiredWriteBarrier&, Structure* value)
     262    {
     263        ASSERT(isCompilationThread());
     264        setWithoutWriteBarrier(value);
     265    }
     266
     267    enum MayBeNullTag { MayBeNull };
     268    WriteBarrierStructureID(VM& vm, const JSCell* owner, Structure* value, MayBeNullTag)
     269    {
     270        setMayBeNull(vm, owner, value);
     271    }
     272
     273    void set(VM&, const JSCell* owner, Structure* value);
     274
     275    void setMayBeNull(VM&, const JSCell* owner, Structure* value);
     276
     277    // Should only be used by JSCell during early initialisation
     278    // when some basic types aren't yet completely instantiated
     279    void setEarlyValue(VM&, const JSCell* owner, Structure* value);
     280
     281    Structure* get() const
     282    {
     283        // Copy m_structureID to a local to avoid multiple-read issues. (See <http://webkit.org/b/110854>)
     284        StructureID structureID = m_structureID;
     285        if (structureID) {
     286            Structure* structure = structureID.decode();
     287            validateCell(reinterpret_cast<JSCell*>(structure));
     288            return structure;
     289        }
     290        return nullptr;
     291    }
     292
     293    Structure* operator*() const
     294    {
     295        StructureID structureID = m_structureID;
     296        ASSERT(structureID);
     297        Structure* structure = structureID.decode();
     298        validateCell(reinterpret_cast<JSCell*>(structure));
     299        return structure;
     300    }
     301
     302    Structure* operator->() const
     303    {
     304        StructureID structureID = m_structureID;
     305        ASSERT(structureID);
     306        Structure* structure = structureID.decode();
     307        validateCell(reinterpret_cast<JSCell*>(structure));
     308        return structure;
     309    }
     310
     311    void clear()
     312    {
     313        m_structureID = { };
     314    }
     315
     316    explicit operator bool() const
     317    {
     318        return !!m_structureID;
     319    }
     320
     321    bool operator!() const
     322    {
     323        return !m_structureID;
     324    }
     325
     326    void setWithoutWriteBarrier(Structure* value)
     327    {
     328#if ENABLE(WRITE_BARRIER_PROFILING)
     329        WriteBarrierCounters::usesWithoutBarrierFromCpp.count();
     330#endif
     331        if (!value) {
     332            m_structureID = { };
     333            return;
     334        }
     335        m_structureID = StructureID::encode(value);
     336    }
     337
     338    Structure* unvalidatedGet() const
     339    {
     340        StructureID structureID = m_structureID;
     341        if (structureID)
     342            return structureID.decode();
     343        return nullptr;
     344    }
     345
     346    StructureID value() const { return m_structureID; }
     347
     348private:
     349    StructureID m_structureID;
     350};
     351
    251352} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/WriteBarrierInlines.h

    r285687 r286667  
    6262}
    6363
     64inline void WriteBarrierStructureID::set(VM& vm, const JSCell* owner, Structure* value)
     65{
     66    ASSERT(value);
     67    ASSERT(!Options::useConcurrentJIT() || !isCompilationThread());
     68    validateCell(reinterpret_cast<JSCell*>(value));
     69    setEarlyValue(vm, owner, value);
     70}
     71
     72inline void WriteBarrierStructureID::setMayBeNull(VM& vm, const JSCell* owner, Structure* value)
     73{
     74    if (value)
     75        validateCell(reinterpret_cast<JSCell*>(value));
     76    setEarlyValue(vm, owner, value);
     77}
     78
     79inline void WriteBarrierStructureID::setEarlyValue(VM& vm, const JSCell* owner, Structure* value)
     80{
     81    if (!value) {
     82        m_structureID = { };
     83        return;
     84    }
     85    m_structureID = StructureID::encode(value);
     86    vm.writeBarrier(owner, reinterpret_cast<JSCell*>(value));
     87}
     88
    6489} // namespace JSC

  • trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp

    r286347 r286667  
    40134013    addFunction(vm, "ensureArrayStorage", functionEnsureArrayStorage, 1);
    40144014
    4015     m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure.set(vm, this, ObjectDoingSideEffectPutWithoutCorrectSlotStatus::createStructure(vm, globalObject, jsNull()));
     4015    m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructureID.set(vm, this, ObjectDoingSideEffectPutWithoutCorrectSlotStatus::createStructure(vm, globalObject, jsNull()));
    40164016}
    40174017
    … …  
    40354035    JSDollarVM* thisObject = jsCast<JSDollarVM*>(cell);
    40364036    Base::visitChildren(thisObject, visitor);
    4037     visitor.append(thisObject->m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure);
     4037    visitor.append(thisObject->m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructureID);
    40384038}
    40394039

  • trunk/Source/JavaScriptCore/tools/JSDollarVM.h

    r286347 r286667  
    6262    }
    6363
    64     Structure* objectDoingSideEffectPutWithoutCorrectSlotStatusStructure() { return m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure.get(); }
     64    Structure* objectDoingSideEffectPutWithoutCorrectSlotStatusStructure() { return m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructureID.get(); }
    6565   
    6666private:
    … …  
    7777    DECLARE_VISIT_CHILDREN;
    7878
    79     WriteBarrier<Structure> m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructure;
     79    WriteBarrierStructureID m_objectDoingSideEffectPutWithoutCorrectSlotStatusStructureID;
    8080};
    8181
Note: See TracChangeset for help on using the changeset viewer.