Changeset 247900 in webkit
- Timestamp:
- Jul 28, 2019 9:31:04 PM (5 years ago)
- Location:
- trunk/Source
- Files:
-
- 16 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r247889 r247900 1 2019-07-28 Commit Queue <commit-queue@webkit.org> 2 3 Unreviewed, rolling out r247886. 4 https://bugs.webkit.org/show_bug.cgi?id=200214 5 6 "Causes PLT5 regression on some machines" (Requested by mlam|a 7 on #webkit). 8 9 Reverted changeset: 10 11 "Add crash diagnostics for debugging unexpected zapped cells." 12 https://bugs.webkit.org/show_bug.cgi?id=200149 13 https://trac.webkit.org/changeset/247886 14 1 15 2019-07-27 Justin Michaud <justin_michaud@apple.com> 2 16 -
trunk/Source/JavaScriptCore/heap/FreeList.h
r247886 r247900 1 1 /* 2 * Copyright (C) 2016-201 9Apple Inc. All rights reserved.2 * Copyright (C) 2016-2017 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 54 54 } 55 55 56 static ptrdiff_t offsetOfScrambledNext() { return OBJECT_OFFSETOF(FreeCell, scrambledNext); }57 58 uint64_t preservedBitsForCrashAnalysis;59 56 uintptr_t scrambledNext; 60 57 }; -
trunk/Source/JavaScriptCore/heap/HeapCell.h
r247886 r247900 1 1 /* 2 * Copyright (C) 2016-201 9Apple Inc. All rights reserved.2 * Copyright (C) 2016-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 48 48 HeapCell() { } 49 49 50 // We're intentionally only zapping the bits for the structureID and leaving 51 // the rest of the cell header bits intact for crash analysis uses. 52 enum ZapReason : int8_t { Unspecified, Destruction, StopAllocating }; 53 void zap(ZapReason reason) 54 { 55 uint32_t* cellWords = bitwise_cast<uint32_t*>(this); 56 cellWords[0] = 0; 57 // Leaving cellWords[1] alone for crash analysis if needed. 58 cellWords[2] = reason; 59 } 60 bool isZapped() const { return !*bitwise_cast<const uint32_t*>(this); } 50 void zap() { *reinterpret_cast_ptr<uintptr_t**>(this) = 0; } 51 bool isZapped() const { return !*reinterpret_cast_ptr<uintptr_t* const*>(this); } 61 52 62 53 bool isLive(); -
trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp
r247886 r247900 162 162 dataLog("Free cell: ", RawPointer(cell), "\n"); 163 163 if (m_attributes.destruction == NeedsDestruction) 164 cell->zap( HeapCell::StopAllocating);164 cell->zap(); 165 165 block().clearNewlyAllocated(cell); 166 166 }); -
trunk/Source/JavaScriptCore/heap/MarkedBlock.h
r247886 r247900 199 199 void didRemoveFromDirectory(); 200 200 201 void* start() const { return &m_block->atoms()[0]; }202 void* end() const { return &m_block->atoms()[m_endAtom]; }203 bool contains(void* p) const { return start() <= p && p < end(); }204 205 201 void dumpState(PrintStream&); 206 202 -
trunk/Source/JavaScriptCore/heap/MarkedBlockInlines.h
r247886 r247900 1 1 /* 2 * Copyright (C) 2016-201 9Apple Inc. All rights reserved.2 * Copyright (C) 2016-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 259 259 if (!jsCell->isZapped()) { 260 260 destroyFunc(vm, jsCell); 261 jsCell->zap( HeapCell::Destruction);261 jsCell->zap(); 262 262 } 263 263 }; -
trunk/Source/JavaScriptCore/heap/MarkedSpace.h
r247886 r247900 125 125 template<typename Functor> void forEachDeadCell(HeapIterationScope&, const Functor&); 126 126 template<typename Functor> void forEachBlock(const Functor&); 127 template<typename Functor> void forEachSubspace(const Functor&);128 127 129 128 void shrink(); … … 242 241 } 243 242 244 template<typename Functor>245 void MarkedSpace::forEachSubspace(const Functor& functor)246 {247 for (auto subspace : m_subspaces) {248 if (functor(*subspace) == IterationStatus::Done)249 return;250 }251 }252 253 254 243 ALWAYS_INLINE size_t MarkedSpace::optimalSizeFor(size_t bytes) 255 244 { -
trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp
r247886 r247900 287 287 { 288 288 ASSERT(m_heap.isMarked(cell)); 289 #if CPU(X86_64)290 if (UNLIKELY(cell->isZapped()))291 reportZappedCellAndCrash(cell);292 #else293 289 ASSERT(!cell->isZapped()); 294 #endif 295 290 296 291 container.noteMarked(); 297 292 … … 391 386 // FIXME: This could be so much better. 392 387 // https://bugs.webkit.org/show_bug.cgi?id=162462 393 #if CPU(X86_64)394 Structure* structure = cell->structure(vm());395 if (LIKELY(structure)) {396 const MethodTable* methodTable = &structure->classInfo()->methodTable;397 methodTable->visitChildren(const_cast<JSCell*>(cell), *this);398 break;399 }400 reportZappedCellAndCrash(const_cast<JSCell*>(cell));401 #else402 388 cell->methodTable(vm())->visitChildren(const_cast<JSCell*>(cell), *this); 403 #endif404 389 break; 405 390 } … … 820 805 } 821 806 822 #if CPU(X86_64)823 NEVER_INLINE NO_RETURN_DUE_TO_CRASH NOT_TAIL_CALLED void SlotVisitor::reportZappedCellAndCrash(JSCell* cell)824 {825 MarkedBlock::Handle* foundBlock = nullptr;826 uint32_t* cellWords = reinterpret_cast_ptr<uint32_t*>(this);827 828 uintptr_t cellAddress = bitwise_cast<uintptr_t>(cell);829 uintptr_t headerWord = cellWords[1];830 uintptr_t zapReason = cellWords[2];831 unsigned subspaceHash = 0;832 size_t cellSize = 0;833 834 // FIXME: This iteration may crash because the mutator may race against us835 // to add / remove blocks. That said, this should be rare and is not too836 // detrimental to the purpose of this function. We will crash imminently837 // anyway, and the most profitable crash info comes from the crash trace.838 // If the race does not crash this iteration (which should be the common839 // case), then we'll get additional info to debug the crash with. If the840 // race does crash this iteration, then we still have the crash trace to841 // work with.842 // https://bugs.webkit.org/show_bug.cgi?id=200183843 m_heap.objectSpace().forEachBlock([&] (MarkedBlock::Handle* block) {844 if (block->contains(cell)) {845 foundBlock = block;846 return IterationStatus::Done;847 }848 return IterationStatus::Continue;849 });850 851 if (foundBlock) {852 subspaceHash = StringHasher::computeHash(foundBlock->subspace()->name());853 cellSize = foundBlock->cellSize();854 }855 856 CRASH_WITH_INFO(cellAddress, headerWord, zapReason, subspaceHash, cellSize);857 }858 #endif // CPU(X86_64)859 860 807 } // namespace JSC -
trunk/Source/JavaScriptCore/heap/SlotVisitor.h
r247886 r247900 226 226 bool didReachTermination(const AbstractLocker&); 227 227 228 #if CPU(X86_64)229 NEVER_INLINE NO_RETURN_DUE_TO_CRASH NOT_TAIL_CALLED void reportZappedCellAndCrash(JSCell*);230 #endif231 232 228 template<typename Func> 233 229 IterationStatus forEachMarkStack(const Func&); -
trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp
r247886 r247900 547 547 // The object is half-allocated: we have what we know is a fresh object, but 548 548 // it's still on the GC's free list. 549 loadPtr(Address(resultGPR , FreeCell::offsetOfScrambledNext()), scratchGPR);549 loadPtr(Address(resultGPR), scratchGPR); 550 550 storePtr(scratchGPR, Address(allocatorGPR, LocalAllocator::offsetOfFreeList() + FreeList::offsetOfScrambledHead())); 551 551 -
trunk/Source/JavaScriptCore/runtime/VM.cpp
r247888 r247900 266 266 , webAssemblyFunctionHeapCellType(std::make_unique<WebAssemblyFunctionHeapCellType>()) 267 267 #endif 268 , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get()) // Hash:0x3e7cd762269 , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get()) // Hash:0x241e946270 , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get()) // Hash:0x7a945300271 , cellSpace("JSCell", heap, cellHeapCellType.get(), fastMallocAllocator.get()) // Hash:0xadfb5a79272 , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellHeapCellType.get(), jsValueGigacageAllocator.get()) // Hash:0x2f5b102b273 , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get()) // Hash:0xbfff3d73274 , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x90cf758f275 , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x4f5ed7a9276 , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x6ebf28e2277 , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge) // Hash:0x7b730b20278 , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction) // Hash:0x800fca72279 , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction) // Hash:0xf845c464280 , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable) // Hash:0x67567f95281 , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable) // Hash:0xc6bc9f12282 , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData) // Hash:0xaca4e62d283 , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure) // Hash:0x1f1bcdca284 , symbolTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), SymbolTable) // Hash:0xc5215afd268 , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get()) 269 , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get()) 270 , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get()) 271 , cellSpace("JSCell", heap, cellHeapCellType.get(), fastMallocAllocator.get()) 272 , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellHeapCellType.get(), jsValueGigacageAllocator.get()) 273 , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get()) 274 , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get()) 275 , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) 276 , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) 277 , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ExecutableToCodeBlockEdge) 278 , functionSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSFunction) 279 , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction) 280 , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable) 281 , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable) 282 , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData) 283 , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure) 284 , symbolTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), SymbolTable) 285 285 , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace) 286 286 , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace) 287 , codeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), CodeBlock) // Hash:0x77e66ec9288 , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable) // Hash:0x5d158f3289 , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable) // Hash:0x527c77e7290 , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable) // Hash:0xf6b828d9287 , codeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), CodeBlock) 288 , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable) 289 , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable) 290 , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable) 291 291 , vmType(vmType) 292 292 , clientData(0) … … 1244 1244 1245 1245 1246 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType.get(), JSBoundFunction) // Hash:0xd7916d411247 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, destructibleObjectHeapCellType.get(), JSCallbackFunction) // Hash:0xe7648ebc1248 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterSetterFunctionSpace, cellHeapCellType.get(), JSCustomGetterSetterFunction) // Hash:0x180910001249 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, destructibleObjectHeapCellType.get(), ErrorInstance) // Hash:0x3f40d4a1250 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType.get(), JSNativeStdFunction) // Hash:0x70ed61e41251 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, destructibleObjectHeapCellType.get(), ProxyRevoke) // Hash:0xb506a9391252 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, destructibleObjectHeapCellType.get(), JSWeakMap) // Hash:0x662b12a31253 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, destructibleObjectHeapCellType.get(), JSWeakSet) // Hash:0x4c781b301254 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakObjectRefSpace, cellHeapCellType.get(), JSWeakObjectRef) // Hash:0x8ec68f1f1246 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType.get(), JSBoundFunction) 1247 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, destructibleObjectHeapCellType.get(), JSCallbackFunction) 1248 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterSetterFunctionSpace, cellHeapCellType.get(), JSCustomGetterSetterFunction) 1249 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, destructibleObjectHeapCellType.get(), ErrorInstance) 1250 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType.get(), JSNativeStdFunction) 1251 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, destructibleObjectHeapCellType.get(), ProxyRevoke) 1252 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, destructibleObjectHeapCellType.get(), JSWeakMap) 1253 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, destructibleObjectHeapCellType.get(), JSWeakSet) 1254 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakObjectRefSpace, cellHeapCellType.get(), JSWeakObjectRef) 1255 1255 #if JSC_OBJC_API_ENABLED 1256 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, destructibleObjectHeapCellType.get(), ObjCCallbackFunction) // Hash:0x10f610b81256 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, destructibleObjectHeapCellType.get(), ObjCCallbackFunction) 1257 1257 #endif 1258 1258 #if ENABLE(WEBASSEMBLY) 1259 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock) // Hash:0x9ad995cd1260 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, webAssemblyFunctionHeapCellType.get(), WebAssemblyFunction) // Hash:0x8b7c32db1261 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, cellHeapCellType.get(), WebAssemblyWrapperFunction) // Hash:0xd4a5ff011259 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock) 1260 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, webAssemblyFunctionHeapCellType.get(), WebAssemblyFunction) 1261 DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, cellHeapCellType.get(), WebAssemblyWrapperFunction) 1262 1262 #endif 1263 1263 … … 1274 1274 } 1275 1275 1276 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, destructibleCellHeapCellType.get(), EvalExecutable) // Hash:0x958e3e9d1277 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, destructibleCellHeapCellType.get(), ModuleProgramExecutable) // Hash:0x6506fa3c1276 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, destructibleCellHeapCellType.get(), EvalExecutable) 1277 DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, destructibleCellHeapCellType.get(), ModuleProgramExecutable) 1278 1278 1279 1279 #undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW -
trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp
r247886 r247900 1 1 /* 2 * Copyright (C) 2015-201 9Apple Inc. All rights reserved.2 * Copyright (C) 2015-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 1394 1394 } 1395 1395 1396 // Dumps the hashes of all subspaces currently registered with the VM.1397 // Usage: $vm.dumpSubspaceHashes()1398 static EncodedJSValue JSC_HOST_CALL functionDumpSubspaceHashes(ExecState* exec)1399 {1400 VM& vm = exec->vm();1401 VMInspector::dumpSubspaceHashes(&vm);1402 return JSValue::encode(jsUndefined());1403 }1404 1405 1396 // Gets a JSDollarVMCallFrame for a specified frame index. 1406 1397 // Usage: var callFrame = $vm.callFrame(0) // frame 0 is the top frame. … … 2229 2220 addFunction(vm, "gc", functionGC, 0); 2230 2221 addFunction(vm, "edenGC", functionEdenGC, 0); 2231 addFunction(vm, "dumpSubspaceHashes", functionDumpSubspaceHashes, 0);2232 2222 2233 2223 addFunction(vm, "callFrame", functionCallFrame, 1); -
trunk/Source/JavaScriptCore/tools/VMInspector.cpp
r247886 r247900 1 1 /* 2 * Copyright (C) 2017-201 9Apple Inc. All rights reserved.2 * Copyright (C) 2017-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 627 627 } 628 628 629 void VMInspector::dumpSubspaceHashes(VM* vm)630 {631 unsigned count = 0;632 vm->heap.objectSpace().forEachSubspace([&] (const Subspace& subspace) -> IterationStatus {633 const char* name = subspace.name();634 unsigned hash = StringHasher::computeHash(name);635 void* hashAsPtr = reinterpret_cast<void*>(static_cast<uintptr_t>(hash));636 dataLogLn(" [", count++, "] ", name, " Hash:", RawPointer(hashAsPtr));637 return IterationStatus::Continue;638 });639 dataLogLn();640 }641 642 629 } // namespace JSC -
trunk/Source/JavaScriptCore/tools/VMInspector.h
r247886 r247900 1 1 /* 2 * Copyright (C) 2017-201 9Apple Inc. All rights reserved.2 * Copyright (C) 2017-2018 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 79 79 JS_EXPORT_PRIVATE static void dumpCellMemory(JSCell*); 80 80 JS_EXPORT_PRIVATE static void dumpCellMemoryToStream(JSCell*, PrintStream&); 81 JS_EXPORT_PRIVATE static void dumpSubspaceHashes(VM*);82 81 83 82 private: -
trunk/Source/WebCore/ChangeLog
r247899 r247900 1 2019-07-28 Commit Queue <commit-queue@webkit.org> 2 3 Unreviewed, rolling out r247886. 4 https://bugs.webkit.org/show_bug.cgi?id=200214 5 6 "Causes PLT5 regression on some machines" (Requested by mlam|a 7 on #webkit). 8 9 Reverted changeset: 10 11 "Add crash diagnostics for debugging unexpected zapped cells." 12 https://bugs.webkit.org/show_bug.cgi?id=200149 13 https://trac.webkit.org/changeset/247886 14 1 15 2019-07-28 Tim Horton <timothy_horton@apple.com> 2 16 -
trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp
r247886 r247900 44 44 : m_builtinFunctions(vm) 45 45 , m_builtinNames(&vm) 46 , m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType.get(), RuntimeMethod) // Hash:0xf70c4a8547 , m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap, vm.destructibleObjectHeapCellType.get(), vm.fastMallocAllocator.get()) // Hash:0x7724c2e448 , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.cellHeapCellType.get(), vm.fastMallocAllocator.get()) // Hash:0x522d6ec946 , m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType.get(), RuntimeMethod) 47 , m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap, vm.destructibleObjectHeapCellType.get(), vm.fastMallocAllocator.get()) 48 , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.cellHeapCellType.get(), vm.fastMallocAllocator.get()) 49 49 { 50 50 }
Note: See TracChangeset
for help on using the changeset viewer.