Changeset 91218 in webkit

Timestamp:

Jul 18, 2011, 3:55:47 PM (14 years ago)

Author:

commit-queue@webkit.org

Message:

JSC GC lazy sweep does not inline the common cases of cell destruction.
​https://bugs.webkit.org/show_bug.cgi?id=64745

Patch by Filip Pizlo <​fpizlo@apple.com> on 2011-07-18
Reviewed by Oliver Hunt.

This inlines the case of JSFinalObject destruction.

• heap/MarkedBlock.cpp:

(JSC::MarkedBlock::lazySweep):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• heap/MarkedBlock.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-07-18  Filip Pizlo  <fpizlo@apple.com>
+
+        JSC GC lazy sweep does not inline the common cases of cell destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=64745
+
+        Reviewed by Oliver Hunt.
+        
+        This inlines the case of JSFinalObject destruction.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::lazySweep):
+
 2011-07-18  Oliver Hunt  <oliver@apple.com>
 

trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp

@@ -87 +87 @@
     // order of the free list.
     
+    void* jsFinalObjectVPtr = m_heap->globalData()->jsFinalObjectVPtr;
+    
     FreeCell* result = 0;
     
@@ -92 +94 @@
         if (!m_marks.testAndSet(i)) {
             JSCell* cell = reinterpret_cast<JSCell*>(&atoms()[i]);
-            cell->~JSCell();
+            if (cell->vptr() == jsFinalObjectVPtr) {
+                JSFinalObject* object = reinterpret_cast<JSFinalObject*>(cell);
+                object->JSFinalObject::~JSFinalObject();
+            } else
+                cell->~JSCell();
             FreeCell* freeCell = reinterpret_cast<FreeCell*>(cell);
             freeCell->next = result;