Changeset 163450 in webkit

Timestamp:

Feb 5, 2014, 9:31:47 AM (11 years ago)

Author:

mhahnenberg@apple.com

Message:

Malloc called beneath MachineThreads::gatherFromOtherThread(), while forbidden
​https://bugs.webkit.org/show_bug.cgi?id=128202

Reviewed by Geoffrey Garen.

This patch uses the new GCSegmentedArray to replace the Vector that was used
to record the set of currently executing CodeBlocks during the conservative
stack scan. This is primarily to avoid the possibility of the Vector resizing
while FastMalloc is forbidden.

• heap/BlockAllocator.h:
• heap/CodeBlockSet.cpp:

(JSC::CodeBlockSet::CodeBlockSet):
(JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):

• heap/CodeBlockSet.h:
• heap/GCSegmentedArray.h:

(JSC::GCSegmentedArray::begin):
(JSC::GCSegmentedArray::end):
(JSC::GCSegmentedArrayIterator::GCSegmentedArrayIterator):
(JSC::GCSegmentedArrayIterator::get):
(JSC::GCSegmentedArrayIterator::operator*):
(JSC::GCSegmentedArrayIterator::operator->):
(JSC::GCSegmentedArrayIterator::operator==):
(JSC::GCSegmentedArrayIterator::operator!=):
(JSC::GCSegmentedArrayIterator::operator++):

• heap/Heap.cpp:

(JSC::Heap::Heap):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• heap/BlockAllocator.h (modified) (2 diffs)
• heap/CodeBlockSet.cpp (modified) (2 diffs)
• heap/CodeBlockSet.h (modified) (3 diffs)
• heap/GCSegmentedArray.h (modified) (3 diffs)
• heap/Heap.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-02-05  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        Malloc called beneath MachineThreads::gatherFromOtherThread(), while forbidden
+        https://bugs.webkit.org/show_bug.cgi?id=128202
+
+        Reviewed by Geoffrey Garen.
+
+        This patch uses the new GCSegmentedArray to replace the Vector that was used 
+        to record the set of currently executing CodeBlocks during the conservative 
+        stack scan. This is primarily to avoid the possibility of the Vector resizing 
+        while FastMalloc is forbidden.
+
+        * heap/BlockAllocator.h:
+        * heap/CodeBlockSet.cpp:
+        (JSC::CodeBlockSet::CodeBlockSet):
+        (JSC::CodeBlockSet::rememberCurrentlyExecutingCodeBlocks):
+        * heap/CodeBlockSet.h:
+        * heap/GCSegmentedArray.h:
+        (JSC::GCSegmentedArray::begin):
+        (JSC::GCSegmentedArray::end):
+        (JSC::GCSegmentedArrayIterator::GCSegmentedArrayIterator):
+        (JSC::GCSegmentedArrayIterator::get):
+        (JSC::GCSegmentedArrayIterator::operator*):
+        (JSC::GCSegmentedArrayIterator::operator->):
+        (JSC::GCSegmentedArrayIterator::operator==):
+        (JSC::GCSegmentedArrayIterator::operator!=):
+        (JSC::GCSegmentedArrayIterator::operator++):
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+
 2014-02-05  Wojciech Bielawski  <w.bielawski@samsung.com>
 

trunk/Source/JavaScriptCore/heap/BlockAllocator.h

@@ -40 +40 @@
 
 class BlockAllocator;
+class CodeBlock;
 class CopiedBlock;
 class CopyWorkListSegment;
@@ -234 +235 @@
 REGION_SET_FOR(WeakBlock, m_fourKBBlockRegionSet);
 REGION_SET_FOR(GCArraySegment<const JSCell*>, m_fourKBBlockRegionSet);
+REGION_SET_FOR(GCArraySegment<CodeBlock*>, m_fourKBBlockRegionSet);
 REGION_SET_FOR(CopyWorkListSegment, m_workListRegionSet);
 REGION_SET_FOR(HandleBlock, m_fourKBBlockRegionSet);

trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp

@@ -34 +34 @@
 static const bool verbose = false;
 
-CodeBlockSet::CodeBlockSet() { }
+CodeBlockSet::CodeBlockSet(BlockAllocator& blockAllocator)
+    : m_currentlyExecuting(blockAllocator)
+{
+}
 
 CodeBlockSet::~CodeBlockSet()
@@ -110 +113 @@
 {
 #if ENABLE(GGC)
-    for (size_t i = 0; i < m_currentlyExecuting.size(); ++i)
-        heap->addToRememberedSet(m_currentlyExecuting[i]->ownerExecutable());
+    for (CodeBlock* codeBlock : m_currentlyExecuting)
+        heap->addToRememberedSet(codeBlock->ownerExecutable());
     m_currentlyExecuting.clear();
 #else

trunk/Source/JavaScriptCore/heap/CodeBlockSet.h

@@ -27 +27 @@
 #define CodeBlockSet_h
 
+#include "GCSegmentedArray.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
 
 namespace JSC {
 
+class BlockAllocator;
 class CodeBlock;
 class Heap;
@@ -47 +48 @@
 
 public:
-    CodeBlockSet();
+    CodeBlockSet(BlockAllocator&);
     ~CodeBlockSet();
     
@@ -89 +90 @@
     // and all, but that seemed like overkill.
     HashSet<CodeBlock* > m_set;
-    Vector<CodeBlock*> m_currentlyExecuting;
+    GCSegmentedArray<CodeBlock*> m_currentlyExecuting;
 };
 

trunk/Source/JavaScriptCore/heap/GCSegmentedArray.h

@@ -60 +60 @@
 };
 
+template <typename T> class GCSegmentedArrayIterator;
+
 template <typename T>
 class GCSegmentedArray {
+    friend class GCSegmentedArrayIterator<T>;
 public:
     GCSegmentedArray(BlockAllocator&);
@@ -77 +80 @@
     void fillVector(Vector<T>&);
     void clear();
+
+    typedef GCSegmentedArrayIterator<T> iterator;
+    iterator begin() { return GCSegmentedArrayIterator<T>(m_segments.head(), m_top); }
+    iterator end() { return GCSegmentedArrayIterator<T>(); }
 
 protected:
@@ -101 +108 @@
 };
 
+template <typename T>
+class GCSegmentedArrayIterator {
+    friend class GCSegmentedArray<T>;
+public:
+    GCSegmentedArrayIterator()
+        : m_currentSegment(0)
+        , m_currentOffset(0)
+    {
+    }
+
+    T& get() { return m_currentSegment->data()[m_currentOffset]; }
+    T& operator*() { return get(); }
+    T& operator->() { return get(); }
+
+    bool operator==(const GCSegmentedArrayIterator& other)
+    {
+        return m_currentSegment == other.m_currentSegment && m_currentOffset == other.m_currentOffset;
+    }
+
+    bool operator!=(const GCSegmentedArrayIterator& other)
+    {
+        return !(*this == other);
+    }
+
+    GCSegmentedArrayIterator& operator++()
+    {
+        ASSERT(m_currentSegment);
+
+        m_currentOffset++;
+
+        if (m_currentOffset >= m_offsetLimit) {
+            m_currentSegment = m_currentSegment->next();
+            m_currentOffset = 0;
+            m_offsetLimit = GCSegmentedArray<T>::s_segmentCapacity;
+        }
+
+        return *this;
+    }
+
+private:
+    GCSegmentedArrayIterator(GCArraySegment<T>* start, size_t top)
+        : m_currentSegment(start)
+        , m_currentOffset(0)
+        , m_offsetLimit(top)
+    {
+        if (!m_offsetLimit)
+            m_currentSegment = nullptr;
+    }
+
+    GCArraySegment<T>* m_currentSegment;
+    size_t m_currentOffset;
+    size_t m_offsetLimit;
+};
+
 } // namespace JSC
 

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -271 +271 @@
     , m_copyVisitor(m_sharedData)
     , m_handleSet(vm)
+    , m_codeBlocks(m_blockAllocator)
     , m_isSafeToCollect(false)
     , m_writeBarrierBuffer(256)