Changeset 167467 in webkit

Timestamp:

Apr 17, 2014, 4:33:32 PM (11 years ago)

Author:

fpizlo@apple.com

Message:

InlineCallFrameSet should be refcounted
​https://bugs.webkit.org/show_bug.cgi?id=131829

Reviewed by Geoffrey Garen.

And DFG::Plan should hold a ref to it. Previously it was owned by Graph until it
became owned by JITCode. Except that if we're "failing" to compile, JITCode may die.
Even as it dies, the GC may still want to scan the DFG::Plan, which leads to scanning
the DesiredWriteBarriers, which leads to scanning the InlineCallFrameSet.

So, just make the darn thing refcounted.

• bytecode/InlineCallFrameSet.h:
• dfg/DFGArgumentsSimplificationPhase.cpp:

(JSC::DFG::ArgumentsSimplificationPhase::run):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

• dfg/DFGCommonData.h:
• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::Graph):
(JSC::DFG::Graph::requiredRegisterCountForExit):

• dfg/DFGGraph.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::link):

• dfg/DFGPlan.cpp:

(JSC::DFG::Plan::Plan):

• dfg/DFGPlan.h:
• dfg/DFGStackLayoutPhase.cpp:

(JSC::DFG::StackLayoutPhase::run):

• ftl/FTLFail.cpp:

(JSC::FTL::fail):

• ftl/FTLLink.cpp:

(JSC::FTL::link):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/InlineCallFrameSet.h (modified) (1 diff)
• dfg/DFGArgumentsSimplificationPhase.cpp (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (1 diff)
• dfg/DFGCommonData.h (modified) (1 diff)
• dfg/DFGGraph.cpp (modified) (2 diffs)
• dfg/DFGGraph.h (modified) (2 diffs)
• dfg/DFGJITCompiler.cpp (modified) (1 diff)
• dfg/DFGPlan.cpp (modified) (1 diff)
• dfg/DFGPlan.h (modified) (1 diff)
• dfg/DFGStackLayoutPhase.cpp (modified) (1 diff)
• ftl/FTLFail.cpp (modified) (1 diff)
• ftl/FTLLink.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-04-17  Filip Pizlo  <fpizlo@apple.com>
+
+        InlineCallFrameSet should be refcounted
+        https://bugs.webkit.org/show_bug.cgi?id=131829
+
+        Reviewed by Geoffrey Garen.
+        
+        And DFG::Plan should hold a ref to it. Previously it was owned by Graph until it
+        became owned by JITCode. Except that if we're "failing" to compile, JITCode may die.
+        Even as it dies, the GC may still want to scan the DFG::Plan, which leads to scanning
+        the DesiredWriteBarriers, which leads to scanning the InlineCallFrameSet.
+        
+        So, just make the darn thing refcounted.
+
+        * bytecode/InlineCallFrameSet.h:
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):
+        * dfg/DFGCommonData.h:
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::Graph):
+        (JSC::DFG::Graph::requiredRegisterCountForExit):
+        * dfg/DFGGraph.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::link):
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::Plan):
+        * dfg/DFGPlan.h:
+        * dfg/DFGStackLayoutPhase.cpp:
+        (JSC::DFG::StackLayoutPhase::run):
+        * ftl/FTLFail.cpp:
+        (JSC::FTL::fail):
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link):
+
 2014-04-17  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/bytecode/InlineCallFrameSet.h

@@ -29 +29 @@
 #include "CodeOrigin.h"
 #include <wtf/Bag.h>
-#include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
 
 namespace JSC {
 
-class InlineCallFrameSet {
-    WTF_MAKE_NONCOPYABLE(InlineCallFrameSet);
+class InlineCallFrameSet : public RefCounted<InlineCallFrameSet> {
 public:
     InlineCallFrameSet();

trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp

@@ -123 +123 @@
         
         // Record which arguments are known to escape no matter what.
-        for (InlineCallFrameSet::iterator iter = m_graph.m_inlineCallFrames->begin(); !!iter; ++iter)
+        for (InlineCallFrameSet::iterator iter = m_graph.m_plan.inlineCallFrames->begin(); !!iter; ++iter)
             pruneObviousArgumentCreations(*iter);
         pruneObviousArgumentCreations(0); // the machine call frame.

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -3401 +3401 @@
         ASSERT(callsiteBlockHead);
         
-        m_inlineCallFrame = byteCodeParser->m_graph.m_inlineCallFrames->add();
+        m_inlineCallFrame = byteCodeParser->m_graph.m_plan.inlineCallFrames->add();
         initializeLazyWriteBarrierForInlineCallFrameExecutable(
             byteCodeParser->m_graph.m_plan.writeBarriers,

trunk/Source/JavaScriptCore/dfg/DFGCommonData.h

@@ -90 +90 @@
     }
 
-    OwnPtr<InlineCallFrameSet> inlineCallFrames;
+    RefPtr<InlineCallFrameSet> inlineCallFrames;
     Vector<CodeOrigin, 0, UnsafeVectorOverflow> codeOrigins;
     

trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

@@ -62 +62 @@
     , m_allocator(longLivedState.m_allocator)
     , m_mustHandleAbstractValues(OperandsLike, plan.mustHandleValues)
-    , m_inlineCallFrames(adoptPtr(new InlineCallFrameSet()))
     , m_hasArguments(false)
     , m_nextMachineLocal(0)
@@ -762 +761 @@
 {
     unsigned count = JIT::frameRegisterCountFor(m_profiledBlock);
-    for (InlineCallFrameSet::iterator iter = m_inlineCallFrames->begin(); !!iter; ++iter) {
+    for (InlineCallFrameSet::iterator iter = m_plan.inlineCallFrames->begin(); !!iter; ++iter) {
         InlineCallFrame* inlineCallFrame = *iter;
         CodeBlock* codeBlock = baselineCodeBlockForInlineCallFrame(inlineCallFrame);

trunk/Source/JavaScriptCore/dfg/DFGGraph.h

@@ -40 +40 @@
 #include "DFGPlan.h"
 #include "DFGScannable.h"
-#include "InlineCallFrameSet.h"
 #include "JSStack.h"
 #include "MethodOfGettingAValueProfile.h"
@@ -832 +831 @@
     Bag<MultiPutByOffsetData> m_multiPutByOffsetData;
     Vector<InlineVariableData, 4> m_inlineVariableData;
-    OwnPtr<InlineCallFrameSet> m_inlineCallFrames;
     HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
     bool m_hasArguments;

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -154 +154 @@
     m_jitCode->common.requiredRegisterCountForExit = m_graph.requiredRegisterCountForExit();
 
-    if (!m_graph.m_inlineCallFrames->isEmpty())
-        m_jitCode->common.inlineCallFrames = m_graph.m_inlineCallFrames.release();
+    if (!m_graph.m_plan.inlineCallFrames->isEmpty())
+        m_jitCode->common.inlineCallFrames = m_graph.m_plan.inlineCallFrames;
     
     m_jitCode->common.machineCaptureStart = m_graph.m_machineCaptureStart;

trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp

@@ -121 +121 @@
     , mustHandleValues(mustHandleValues)
     , compilation(codeBlock->vm()->m_perBytecodeProfiler ? adoptRef(new Profiler::Compilation(codeBlock->vm()->m_perBytecodeProfiler->ensureBytecodesFor(codeBlock.get()), profilerCompilationKindForMode(mode))) : 0)
+    , inlineCallFrames(adoptRef(new InlineCallFrameSet()))
     , identifiers(codeBlock.get())
     , weakReferences(codeBlock.get())

trunk/Source/JavaScriptCore/dfg/DFGPlan.h

@@ -86 +86 @@
     OwnPtr<Finalizer> finalizer;
     
+    RefPtr<InlineCallFrameSet> inlineCallFrames;
     DesiredWatchpoints watchpoints;
     DesiredIdentifiers identifiers;

trunk/Source/JavaScriptCore/dfg/DFGStackLayoutPhase.cpp

@@ -104 +104 @@
         if (codeBlock()->uncheckedActivationRegister().isValid())
             usedLocals.set(codeBlock()->activationRegister().toLocal());
-        for (InlineCallFrameSet::iterator iter = m_graph.m_inlineCallFrames->begin(); !!iter; ++iter) {
+        for (InlineCallFrameSet::iterator iter = m_graph.m_plan.inlineCallFrames->begin(); !!iter; ++iter) {
             InlineCallFrame* inlineCallFrame = *iter;
             if (!inlineCallFrame->executable->usesArguments())

trunk/Source/JavaScriptCore/ftl/FTLFail.cpp

@@ -41 +41 @@
     state.graph.m_plan.finalizer = adoptPtr(new FailedFinalizer(state.graph.m_plan));
     
-    if (!state.graph.m_inlineCallFrames->isEmpty())
-        state.jitCode->common.inlineCallFrames = std::move(state.graph.m_inlineCallFrames);
-
     if (state.module)
         llvm->DisposeModule(state.module);

trunk/Source/JavaScriptCore/ftl/FTLLink.cpp

@@ -61 +61 @@
     state.jitCode->common.requiredRegisterCountForExit = graph.requiredRegisterCountForExit();
     
-    if (!graph.m_inlineCallFrames->isEmpty())
-        state.jitCode->common.inlineCallFrames = std::move(graph.m_inlineCallFrames);
+    if (!graph.m_plan.inlineCallFrames->isEmpty())
+        state.jitCode->common.inlineCallFrames = graph.m_plan.inlineCallFrames;
     
     // Create the entrypoint. Note that we use this entrypoint totally differently