Changeset 94920 in webkit

Timestamp:

Sep 10, 2011 10:49:36 PM (13 years ago)

Author:

fpizlo@apple.com

Message:

The executable allocator makes it difficult to free individual
chunks of executable memory
​https://bugs.webkit.org/show_bug.cgi?id=66363

Reviewed by Oliver Hunt.

Introduced a best-fit, balanced-tree based allocator. The allocator
required a balanced tree that does not allocate memory and that
permits the removal of individual nodes directly (as opposed to by
key); neither AVLTree nor WebCore's PODRedBlackTree supported this.
Changed all references to executable code to use a reference counted
handle.

Source/JavaScriptCore:

• GNUmakefile.list.am:
• JavaScriptCore.exp:
• JavaScriptCore.vcproj/WTF/WTF.vcproj:
• JavaScriptCore.xcodeproj/project.pbxproj:
• assembler/AssemblerBuffer.h:

(JSC::AssemblerBuffer::executableCopy):

• assembler/LinkBuffer.h:

(JSC::LinkBuffer::LinkBuffer):
(JSC::LinkBuffer::finalizeCode):
(JSC::LinkBuffer::linkCode):

• assembler/MacroAssemblerCodeRef.h:

(JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
(JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
(JSC::MacroAssemblerCodeRef::executableMemory):
(JSC::MacroAssemblerCodeRef::code):
(JSC::MacroAssemblerCodeRef::size):
(JSC::MacroAssemblerCodeRef::operator!):

• assembler/X86Assembler.h:

(JSC::X86Assembler::executableCopy):
(JSC::X86Assembler::X86InstructionFormatter::executableCopy):

• bytecode/CodeBlock.h:
• bytecode/Instruction.h:
• bytecode/StructureStubInfo.h:
• dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

• dfg/DFGRepatch.cpp:

(JSC::DFG::generateProtoChainAccessStub):
(JSC::DFG::tryCacheGetByID):
(JSC::DFG::tryBuildGetByIDList):
(JSC::DFG::tryBuildGetByIDProtoList):
(JSC::DFG::tryCachePutByID):

• jit/ExecutableAllocator.cpp:

(JSC::ExecutableAllocator::initializeAllocator):
(JSC::ExecutableAllocator::ExecutableAllocator):
(JSC::ExecutableAllocator::allocate):
(JSC::ExecutableAllocator::committedByteCount):
(JSC::ExecutableAllocator::dumpProfile):

• jit/ExecutableAllocator.h:

(JSC::ExecutableAllocator::dumpProfile):

• jit/ExecutableAllocatorFixedVMPool.cpp:

(JSC::ExecutableAllocator::initializeAllocator):
(JSC::ExecutableAllocator::ExecutableAllocator):
(JSC::ExecutableAllocator::isValid):
(JSC::ExecutableAllocator::underMemoryPressure):
(JSC::ExecutableAllocator::allocate):
(JSC::ExecutableAllocator::committedByteCount):
(JSC::ExecutableAllocator::dumpProfile):

• jit/JIT.cpp:

(JSC::JIT::privateCompile):

• jit/JIT.h:

(JSC::JIT::compileCTIMachineTrampolines):
(JSC::JIT::compileCTINativeCall):

• jit/JITCode.h:

(JSC::JITCode::operator !):
(JSC::JITCode::addressForCall):
(JSC::JITCode::offsetOf):
(JSC::JITCode::execute):
(JSC::JITCode::start):
(JSC::JITCode::size):
(JSC::JITCode::getExecutableMemory):
(JSC::JITCode::HostFunction):
(JSC::JITCode::JITCode):

• jit/JITOpcodes.cpp:

(JSC::JIT::privateCompileCTIMachineTrampolines):
(JSC::JIT::privateCompileCTINativeCall):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTIMachineTrampolines):
(JSC::JIT::privateCompileCTINativeCall):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::stringGetByValStubGenerator):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::privateCompilePutByIdTransition):
(JSC::JIT::privateCompilePatchGetArrayLength):
(JSC::JIT::privateCompileGetByIdProto):
(JSC::JIT::privateCompileGetByIdSelfList):
(JSC::JIT::privateCompileGetByIdProtoList):
(JSC::JIT::privateCompileGetByIdChainList):
(JSC::JIT::privateCompileGetByIdChain):

• jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::stringGetByValStubGenerator):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::privateCompilePutByIdTransition):
(JSC::JIT::privateCompilePatchGetArrayLength):
(JSC::JIT::privateCompileGetByIdProto):
(JSC::JIT::privateCompileGetByIdSelfList):
(JSC::JIT::privateCompileGetByIdProtoList):
(JSC::JIT::privateCompileGetByIdChainList):
(JSC::JIT::privateCompileGetByIdChain):

• jit/JITStubs.cpp:

(JSC::JITThunks::JITThunks):
(JSC::DEFINE_STUB_FUNCTION):
(JSC::getPolymorphicAccessStructureListSlot):
(JSC::JITThunks::ctiStub):
(JSC::JITThunks::hostFunctionStub):

• jit/JITStubs.h:
• jit/SpecializedThunkJIT.h:

(JSC::SpecializedThunkJIT::SpecializedThunkJIT):
(JSC::SpecializedThunkJIT::finalize):

• jit/ThunkGenerators.cpp:

(JSC::charCodeAtThunkGenerator):
(JSC::charAtThunkGenerator):
(JSC::fromCharCodeThunkGenerator):
(JSC::sqrtThunkGenerator):
(JSC::floorThunkGenerator):
(JSC::ceilThunkGenerator):
(JSC::roundThunkGenerator):
(JSC::expThunkGenerator):
(JSC::logThunkGenerator):
(JSC::absThunkGenerator):
(JSC::powThunkGenerator):

• jit/ThunkGenerators.h:
• runtime/Executable.h:

(JSC::NativeExecutable::create):

• runtime/InitializeThreading.cpp:

(JSC::initializeThreadingOnce):

• runtime/JSGlobalData.cpp:

(JSC::JSGlobalData::JSGlobalData):
(JSC::JSGlobalData::dumpSampleData):

• runtime/JSGlobalData.h:

(JSC::JSGlobalData::getCTIStub):

• wtf/CMakeLists.txt:
• wtf/MetaAllocator.cpp: Added.

(WTF::MetaAllocatorHandle::MetaAllocatorHandle):
(WTF::MetaAllocatorHandle::~MetaAllocatorHandle):
(WTF::MetaAllocatorHandle::shrink):
(WTF::MetaAllocator::MetaAllocator):
(WTF::MetaAllocator::allocate):
(WTF::MetaAllocator::currentStatistics):
(WTF::MetaAllocator::findAndRemoveFreeSpace):
(WTF::MetaAllocator::addFreeSpaceFromReleasedHandle):
(WTF::MetaAllocator::addFreshFreeSpace):
(WTF::MetaAllocator::debugFreeSpaceSize):
(WTF::MetaAllocator::addFreeSpace):
(WTF::MetaAllocator::incrementPageOccupancy):
(WTF::MetaAllocator::decrementPageOccupancy):
(WTF::MetaAllocator::roundUp):
(WTF::MetaAllocator::allocFreeSpaceNode):
(WTF::MetaAllocator::freeFreeSpaceNode):
(WTF::MetaAllocator::dumpProfile):

• wtf/MetaAllocator.h: Added.

(WTF::MetaAllocator::bytesAllocated):
(WTF::MetaAllocator::bytesReserved):
(WTF::MetaAllocator::bytesCommitted):
(WTF::MetaAllocator::dumpProfile):
(WTF::MetaAllocator::~MetaAllocator):

• wtf/MetaAllocatorHandle.h: Added.
• wtf/RedBlackTree.h: Added.

(WTF::RedBlackTree::Node::Node):
(WTF::RedBlackTree::Node::successor):
(WTF::RedBlackTree::Node::predecessor):
(WTF::RedBlackTree::Node::reset):
(WTF::RedBlackTree::Node::parent):
(WTF::RedBlackTree::Node::setParent):
(WTF::RedBlackTree::Node::left):
(WTF::RedBlackTree::Node::setLeft):
(WTF::RedBlackTree::Node::right):
(WTF::RedBlackTree::Node::setRight):
(WTF::RedBlackTree::Node::color):
(WTF::RedBlackTree::Node::setColor):
(WTF::RedBlackTree::RedBlackTree):
(WTF::RedBlackTree::insert):
(WTF::RedBlackTree::remove):
(WTF::RedBlackTree::findExact):
(WTF::RedBlackTree::findLeastGreaterThanOrEqual):
(WTF::RedBlackTree::findGreatestLessThanOrEqual):
(WTF::RedBlackTree::first):
(WTF::RedBlackTree::last):
(WTF::RedBlackTree::size):
(WTF::RedBlackTree::isEmpty):
(WTF::RedBlackTree::treeMinimum):
(WTF::RedBlackTree::treeMaximum):
(WTF::RedBlackTree::treeInsert):
(WTF::RedBlackTree::leftRotate):
(WTF::RedBlackTree::rightRotate):
(WTF::RedBlackTree::removeFixup):

• wtf/wtf.pri:
• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::compile):

• yarr/YarrJIT.h:

(JSC::Yarr::YarrCodeBlock::execute):
(JSC::Yarr::YarrCodeBlock::getAddr):

Source/JavaScriptGlue:

• ForwardingHeaders/wtf/MetaAllocatorHandle.h: Added.

Source/WebCore:

No new layout tests because behavior is not changed. New API unit
tests:
Tests/WTF/RedBlackTree.cpp
Tests/WTF/MetaAllocator.cpp

• ForwardingHeaders/wtf/MetaAllocatorHandle.h: Added.

Tools:

• TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
• TestWebKitAPI/Tests/WTF/MetaAllocator.cpp: Added.

(TestWebKitAPI::TEST_F):

• TestWebKitAPI/Tests/WTF/RedBlackTree.cpp: Added.

(TestWebKitAPI::Pair::findExact):
(TestWebKitAPI::Pair::remove):
(TestWebKitAPI::Pair::findLeastGreaterThanOrEqual):
(TestWebKitAPI::Pair::assertFoundAndRemove):
(TestWebKitAPI::Pair::assertEqual):
(TestWebKitAPI::Pair::assertSameValuesForKey):
(TestWebKitAPI::Pair::testDriver):
(TestWebKitAPI::TEST_F):

Location:

trunk

Files:

• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/GNUmakefile.list.am (modified) (2 diffs)
• Source/JavaScriptCore/JavaScriptCore.exp (modified) (3 diffs)
• Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj (modified) (2 diffs)
• Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (modified) (7 diffs)
• Source/JavaScriptCore/assembler/AssemblerBuffer.h (modified) (2 diffs)
• Source/JavaScriptCore/assembler/LinkBuffer.h (modified) (6 diffs)
• Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h (modified) (1 diff)
• Source/JavaScriptCore/assembler/X86Assembler.h (modified) (2 diffs)
• Source/JavaScriptCore/bytecode/CodeBlock.h (modified) (1 diff)
• Source/JavaScriptCore/bytecode/Instruction.h (modified) (1 diff)
• Source/JavaScriptCore/bytecode/StructureStubInfo.h (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGJITCompiler.cpp (modified) (2 diffs)
• Source/JavaScriptCore/dfg/DFGRepatch.cpp (modified) (11 diffs)
• Source/JavaScriptCore/jit/ExecutableAllocator.cpp (modified) (3 diffs)
• Source/JavaScriptCore/jit/ExecutableAllocator.h (modified) (4 diffs)
• Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp (modified) (2 diffs)
• Source/JavaScriptCore/jit/JIT.cpp (modified) (1 diff)
• Source/JavaScriptCore/jit/JIT.h (modified) (3 diffs)
• Source/JavaScriptCore/jit/JITCode.h (modified) (6 diffs)
• Source/JavaScriptCore/jit/JITOpcodes.cpp (modified) (5 diffs)
• Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (modified) (6 diffs)
• Source/JavaScriptCore/jit/JITPropertyAccess.cpp (modified) (20 diffs)
• Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (modified) (20 diffs)
• Source/JavaScriptCore/jit/JITStubs.cpp (modified) (6 diffs)
• Source/JavaScriptCore/jit/JITStubs.h (modified) (2 diffs)
• Source/JavaScriptCore/jit/SpecializedThunkJIT.h (modified) (3 diffs)
• Source/JavaScriptCore/jit/ThunkGenerators.cpp (modified) (11 diffs)
• Source/JavaScriptCore/jit/ThunkGenerators.h (modified) (1 diff)
• Source/JavaScriptCore/runtime/Executable.h (modified) (1 diff)
• Source/JavaScriptCore/runtime/InitializeThreading.cpp (modified) (3 diffs)
• Source/JavaScriptCore/runtime/JSGlobalData.cpp (modified) (2 diffs)
• Source/JavaScriptCore/runtime/JSGlobalData.h (modified) (2 diffs)
• Source/JavaScriptCore/wtf/CMakeLists.txt (modified) (2 diffs)
• Source/JavaScriptCore/wtf/MetaAllocator.cpp (added)
• Source/JavaScriptCore/wtf/MetaAllocator.h (added)
• Source/JavaScriptCore/wtf/MetaAllocatorHandle.h (added)
• Source/JavaScriptCore/wtf/RedBlackTree.h (added)
• Source/JavaScriptCore/wtf/wtf.pri (modified) (1 diff)
• Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (1 diff)
• Source/JavaScriptCore/yarr/YarrJIT.h (modified) (1 diff)
• Source/JavaScriptGlue/ChangeLog (modified) (1 diff)
• Source/JavaScriptGlue/ForwardingHeaders/wtf/MetaAllocatorHandle.h (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/ForwardingHeaders/wtf/MetaAllocatorHandle.h (added)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj (modified) (4 diffs)
• Tools/TestWebKitAPI/Tests/WTF/MetaAllocator.cpp (added)
• Tools/TestWebKitAPI/Tests/WTF/RedBlackTree.cpp (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-08  Filip Pizlo  <fpizlo@apple.com>
+
+        The executable allocator makes it difficult to free individual
+        chunks of executable memory
+        https://bugs.webkit.org/show_bug.cgi?id=66363
+
+        Reviewed by Oliver Hunt.
+        
+        Introduced a best-fit, balanced-tree based allocator. The allocator
+        required a balanced tree that does not allocate memory and that
+        permits the removal of individual nodes directly (as opposed to by
+        key); neither AVLTree nor WebCore's PODRedBlackTree supported this.
+        Changed all references to executable code to use a reference counted
+        handle.
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::LinkBuffer):
+        (JSC::LinkBuffer::finalizeCode):
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        (JSC::MacroAssemblerCodeRef::createSelfManagedCodeRef):
+        (JSC::MacroAssemblerCodeRef::executableMemory):
+        (JSC::MacroAssemblerCodeRef::code):
+        (JSC::MacroAssemblerCodeRef::size):
+        (JSC::MacroAssemblerCodeRef::operator!):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormatter::executableCopy):
+        * bytecode/CodeBlock.h:
+        * bytecode/Instruction.h:
+        * bytecode/StructureStubInfo.h:
+        * dfg/DFGJITCompiler.cpp:
+        (JSC::DFG::JITCompiler::compile):
+        (JSC::DFG::JITCompiler::compileFunction):
+        * dfg/DFGRepatch.cpp:
+        (JSC::DFG::generateProtoChainAccessStub):
+        (JSC::DFG::tryCacheGetByID):
+        (JSC::DFG::tryBuildGetByIDList):
+        (JSC::DFG::tryBuildGetByIDProtoList):
+        (JSC::DFG::tryCachePutByID):
+        * jit/ExecutableAllocator.cpp:
+        (JSC::ExecutableAllocator::initializeAllocator):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::ExecutableAllocator::initializeAllocator):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::isValid):
+        (JSC::ExecutableAllocator::underMemoryPressure):
+        (JSC::ExecutableAllocator::allocate):
+        (JSC::ExecutableAllocator::committedByteCount):
+        (JSC::ExecutableAllocator::dumpProfile):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compileCTINativeCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator !):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::start):
+        (JSC::JITCode::size):
+        (JSC::JITCode::getExecutableMemory):
+        (JSC::JITCode::HostFunction):
+        (JSC::JITCode::JITCode):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::stringGetByValStubGenerator):
+        (JSC::JIT::emitSlow_op_get_by_val):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::JITThunks::ctiStub):
+        (JSC::JITThunks::hostFunctionStub):
+        * jit/JITStubs.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::SpecializedThunkJIT):
+        (JSC::SpecializedThunkJIT::finalize):
+        * jit/ThunkGenerators.cpp:
+        (JSC::charCodeAtThunkGenerator):
+        (JSC::charAtThunkGenerator):
+        (JSC::fromCharCodeThunkGenerator):
+        (JSC::sqrtThunkGenerator):
+        (JSC::floorThunkGenerator):
+        (JSC::ceilThunkGenerator):
+        (JSC::roundThunkGenerator):
+        (JSC::expThunkGenerator):
+        (JSC::logThunkGenerator):
+        (JSC::absThunkGenerator):
+        (JSC::powThunkGenerator):
+        * jit/ThunkGenerators.h:
+        * runtime/Executable.h:
+        (JSC::NativeExecutable::create):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::dumpSampleData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::getCTIStub):
+        * wtf/CMakeLists.txt:
+        * wtf/MetaAllocator.cpp: Added.
+        (WTF::MetaAllocatorHandle::MetaAllocatorHandle):
+        (WTF::MetaAllocatorHandle::~MetaAllocatorHandle):
+        (WTF::MetaAllocatorHandle::shrink):
+        (WTF::MetaAllocator::MetaAllocator):
+        (WTF::MetaAllocator::allocate):
+        (WTF::MetaAllocator::currentStatistics):
+        (WTF::MetaAllocator::findAndRemoveFreeSpace):
+        (WTF::MetaAllocator::addFreeSpaceFromReleasedHandle):
+        (WTF::MetaAllocator::addFreshFreeSpace):
+        (WTF::MetaAllocator::debugFreeSpaceSize):
+        (WTF::MetaAllocator::addFreeSpace):
+        (WTF::MetaAllocator::incrementPageOccupancy):
+        (WTF::MetaAllocator::decrementPageOccupancy):
+        (WTF::MetaAllocator::roundUp):
+        (WTF::MetaAllocator::allocFreeSpaceNode):
+        (WTF::MetaAllocator::freeFreeSpaceNode):
+        (WTF::MetaAllocator::dumpProfile):
+        * wtf/MetaAllocator.h: Added.
+        (WTF::MetaAllocator::bytesAllocated):
+        (WTF::MetaAllocator::bytesReserved):
+        (WTF::MetaAllocator::bytesCommitted):
+        (WTF::MetaAllocator::dumpProfile):
+        (WTF::MetaAllocator::~MetaAllocator):
+        * wtf/MetaAllocatorHandle.h: Added.
+        * wtf/RedBlackTree.h: Added.
+        (WTF::RedBlackTree::Node::Node):
+        (WTF::RedBlackTree::Node::successor):
+        (WTF::RedBlackTree::Node::predecessor):
+        (WTF::RedBlackTree::Node::reset):
+        (WTF::RedBlackTree::Node::parent):
+        (WTF::RedBlackTree::Node::setParent):
+        (WTF::RedBlackTree::Node::left):
+        (WTF::RedBlackTree::Node::setLeft):
+        (WTF::RedBlackTree::Node::right):
+        (WTF::RedBlackTree::Node::setRight):
+        (WTF::RedBlackTree::Node::color):
+        (WTF::RedBlackTree::Node::setColor):
+        (WTF::RedBlackTree::RedBlackTree):
+        (WTF::RedBlackTree::insert):
+        (WTF::RedBlackTree::remove):
+        (WTF::RedBlackTree::findExact):
+        (WTF::RedBlackTree::findLeastGreaterThanOrEqual):
+        (WTF::RedBlackTree::findGreatestLessThanOrEqual):
+        (WTF::RedBlackTree::first):
+        (WTF::RedBlackTree::last):
+        (WTF::RedBlackTree::size):
+        (WTF::RedBlackTree::isEmpty):
+        (WTF::RedBlackTree::treeMinimum):
+        (WTF::RedBlackTree::treeMaximum):
+        (WTF::RedBlackTree::treeInsert):
+        (WTF::RedBlackTree::leftRotate):
+        (WTF::RedBlackTree::rightRotate):
+        (WTF::RedBlackTree::removeFixup):
+        * wtf/wtf.pri:
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile):
+        * yarr/YarrJIT.h:
+        (JSC::Yarr::YarrCodeBlock::execute):
+        (JSC::Yarr::YarrCodeBlock::getAddr):
+
 2011-09-10  Sam Weinig  <sam@webkit.org>
 

trunk/Source/JavaScriptCore/GNUmakefile.list.am

@@ -530 +530 @@
         Source/JavaScriptCore/wtf/MD5.cpp \
         Source/JavaScriptCore/wtf/MD5.h \
+        Source/JavaScriptCore/wtf/MetaAllocator.cpp \
+        Source/JavaScriptCore/wtf/MetaAllocator.h \
+        Source/JavaScriptCore/wtf/MetaAllocatorHandle.h \
         Source/JavaScriptCore/wtf/MessageQueue.h \
         Source/JavaScriptCore/wtf/NonCopyingSort.h \
@@ -562 +565 @@
         Source/JavaScriptCore/wtf/RandomNumber.h \
         Source/JavaScriptCore/wtf/RandomNumberSeed.h \
+        Source/JavaScriptCore/wtf/RedBlackTree.h \
         Source/JavaScriptCore/wtf/RefCounted.h \
         Source/JavaScriptCore/wtf/RefCountedLeakCounter.cpp \

trunk/Source/JavaScriptCore/JavaScriptCore.exp

@@ -408 +408 @@
 __ZN3WTF12isMainThreadEv
 __ZN3WTF12randomNumberEv
+__ZN3WTF13MetaAllocator17addFreshFreeSpaceEPvm
+__ZN3WTF13MetaAllocator17freeFreeSpaceNodeEPNS_12RedBlackTreeImPvE4NodeE
+__ZN3WTF13MetaAllocator18debugFreeSpaceSizeEv
+__ZN3WTF13MetaAllocator8allocateEm
+__ZN3WTF13MetaAllocatorC2Em
 __ZN3WTF13StringBuilder11reifyStringEv
 __ZN3WTF13StringBuilder11shrinkToFitEv
@@ -442 +447 @@
 __ZN3WTF18dateToDaysFrom1970Eiii
 __ZN3WTF18monthFromDayInYearEib
+__ZN3WTF19MetaAllocatorHandle6shrinkEm
+__ZN3WTF19MetaAllocatorHandleD1Ev
 __ZN3WTF19initializeThreadingEv
 __ZN3WTF20equalIgnoringNullityEPNS_10StringImplES1_
@@ -522 +529 @@
 __ZN3WTF8msToYearEd
 __ZN3WTF8nullAtomE
+__ZN3WTF8pageSizeEv
 __ZN3WTF8starAtomE
 __ZN3WTF8textAtomE

trunk/Source/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj

@@ -838 +838 @@
                 </File>
                 <File
+                        RelativePath="..\..\wtf\MetaAllocator.cpp"
+                        >
+                </File>
+                <File
+                        RelativePath="..\..\wtf\MetaAllocator.h"
+                        >
+                </File>
+                <File
+                        RelativePath="..\..\wtf\MetaAllocatorHandle.h"
+                        >
+                </File>
+                <File
                         RelativePath="..\..\wtf\MD5.cpp"
                         >
@@ -975 +987 @@
                 <File
                         RelativePath="..\..\wtf\RandomNumberSeed.h"
+                        >
+                </File>
+                <File
+                        RelativePath="..\..\wtf\RedBlackTree.h"
                         >
                 </File>

trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

@@ -52 +52 @@
                 0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F242DA513F3B1BB007ADD4C /* WeakReferenceHarvester.h */; settings = {ATTRIBUTES = (Private, ); }; };
                 0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7700911402FF280078EB39 /* SamplingCounter.cpp */; };
+                0F963B2713F753BB0002D9B2 /* RedBlackTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2613F753990002D9B2 /* RedBlackTree.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                0F963B2C13F853EC0002D9B2 /* MetaAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F963B2B13F853C70002D9B2 /* MetaAllocator.cpp */; settings = {COMPILER_FLAGS = "-fno-strict-aliasing"; }; };
+                0F963B2D13F854020002D9B2 /* MetaAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2A13F853BD0002D9B2 /* MetaAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                0F963B2F13FC66BB0002D9B2 /* MetaAllocatorHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B2E13FC66AE0002D9B2 /* MetaAllocatorHandle.h */; settings = {ATTRIBUTES = (Private, ); }; };
                 0F963B3813FC6FE90002D9B2 /* ValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
                 0FC8150A14043BF500CFA603 /* WriteBarrierSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC8150914043BD200CFA603 /* WriteBarrierSupport.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -559 +563 @@
                 BC18C46C0E16F5CD00B34460 /* TCPackedCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DA479650CFBCF56009328A0 /* TCPackedCache.h */; };
                 BC18C46D0E16F5CD00B34460 /* TCPageMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD6E08E80A17002CBEE7 /* TCPageMap.h */; };
-                BC18C46E0E16F5CD00B34460 /* TCSpinLock.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD6F08E80A17002CBEE7 /* TCSpinLock.h */; };
+                BC18C46E0E16F5CD00B34460 /* TCSpinLock.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD6F08E80A17002CBEE7 /* TCSpinLock.h */; settings = {ATTRIBUTES = (Private, ); }; };
                 BC18C46F0E16F5CD00B34460 /* TCSystemAlloc.h in Headers */ = {isa = PBXBuildFile; fileRef = 6541BD7108E80A17002CBEE7 /* TCSystemAlloc.h */; };
                 BC18C4700E16F5CD00B34460 /* Threading.h in Headers */ = {isa = PBXBuildFile; fileRef = E1EE79220D6C95CD00FEA3BA /* Threading.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -779 +783 @@
                 0F77008E1402FDD60078EB39 /* SamplingCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SamplingCounter.h; sourceTree = "<group>"; };
                 0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = "<group>"; };
+                0F963B2613F753990002D9B2 /* RedBlackTree.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RedBlackTree.h; sourceTree = "<group>"; };
+                0F963B2A13F853BD0002D9B2 /* MetaAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MetaAllocator.h; sourceTree = "<group>"; };
+                0F963B2B13F853C70002D9B2 /* MetaAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MetaAllocator.cpp; sourceTree = "<group>"; };
+                0F963B2E13FC66AE0002D9B2 /* MetaAllocatorHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MetaAllocatorHandle.h; sourceTree = "<group>"; };
                 0F963B3613FC6FDE0002D9B2 /* ValueProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueProfile.h; sourceTree = "<group>"; };
                 0FC8150814043BCA00CFA603 /* WriteBarrierSupport.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WriteBarrierSupport.cpp; sourceTree = "<group>"; };
@@ -1764 +1772 @@
                         isa = PBXGroup;
                         children = (
+                                0F963B2E13FC66AE0002D9B2 /* MetaAllocatorHandle.h */,
+                                0F963B2B13F853C70002D9B2 /* MetaAllocator.cpp */,
+                                0F963B2A13F853BD0002D9B2 /* MetaAllocator.h */,
+                                0F963B2613F753990002D9B2 /* RedBlackTree.h */,
                                 C2EE599D13FC972A009CEAFE /* DecimalNumber.cpp */,
                                 C2EE599E13FC972A009CEAFE /* DecimalNumber.h */,
@@ -2384 +2396 @@
                                 86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */,
                                 BC18C3E60E16F5CD00B34460 /* ArrayConstructor.h in Headers */,
+                                BC18C46E0E16F5CD00B34460 /* TCSpinLock.h in Headers */,
+                                0F963B2F13FC66BB0002D9B2 /* MetaAllocatorHandle.h in Headers */,
+                                0F963B2D13F854020002D9B2 /* MetaAllocator.h in Headers */,
+                                0F963B2713F753BB0002D9B2 /* RedBlackTree.h in Headers */,
                                 0FC815151405119B00CFA603 /* VTableSpectrum.h in Headers */,
                                 C22B31B9140577D700DB475A /* SamplingCounter.h in Headers */,
@@ -2687 +2703 @@
                                 BC18C46C0E16F5CD00B34460 /* TCPackedCache.h in Headers */,
                                 BC18C46D0E16F5CD00B34460 /* TCPageMap.h in Headers */,
-                                BC18C46E0E16F5CD00B34460 /* TCSpinLock.h in Headers */,
                                 BC18C46F0E16F5CD00B34460 /* TCSystemAlloc.h in Headers */,
                                 971EDEA61169E0D3005E4262 /* Terminator.h in Headers */,
@@ -3050 +3065 @@
                         buildActionMask = 2147483647;
                         files = (
+                                0F963B2C13F853EC0002D9B2 /* MetaAllocator.cpp in Sources */,
                                 0FD82E2114172CE300179C94 /* DFGCapabilities.cpp in Sources */,
                                 0FD3C82514115D4000FD81CB /* DFGPropagator.cpp in Sources */,

trunk/Source/JavaScriptCore/assembler/AssemblerBuffer.h

@@ -29 +29 @@
 #if ENABLE(ASSEMBLER)
 
+#include "JSGlobalData.h"
 #include "stdint.h"
 #include <string.h>
@@ -129 +130 @@
         }
 
-        void* executableCopy(JSGlobalData& globalData, ExecutablePool* allocator)
+        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData)
         {
             if (!m_index)
                 return 0;
 
-            void* result = allocator->alloc(globalData, m_index);
+            RefPtr<ExecutableMemoryHandle> result = globalData.executableAllocator.allocate(globalData, m_index);
 
             if (!result)
                 return 0;
 
-            ExecutableAllocator::makeWritable(result, m_index);
+            ExecutableAllocator::makeWritable(result->start(), result->sizeInBytes());
 
-            return memcpy(result, m_buffer, m_index);
+            memcpy(result->start(), m_buffer, m_index);
+            
+            return result.release();
         }
 

trunk/Source/JavaScriptCore/assembler/LinkBuffer.h

@@ -70 +70 @@
 
 public:
-    LinkBuffer(JSGlobalData& globalData, MacroAssembler* masm, PassRefPtr<ExecutablePool> executablePool)
-        : m_executablePool(executablePool)
-        , m_size(0)
+    LinkBuffer(JSGlobalData& globalData, MacroAssembler* masm)
+        : m_size(0)
         , m_code(0)
         , m_assembler(masm)
@@ -83 +82 @@
     }
 
-    LinkBuffer(JSGlobalData& globalData, MacroAssembler* masm, ExecutableAllocator& allocator)
-        : m_executablePool(allocator.poolForSize(globalData, masm->m_assembler.codeSize()))
-        , m_size(0)
-        , m_code(0)
-        , m_assembler(masm)
-        , m_globalData(&globalData)
-#ifndef NDEBUG
-        , m_completed(false)
-#endif
-    {
-        linkCode();
-    }
-
     ~LinkBuffer()
     {
@@ -186 +172 @@
         performFinalization();
 
-        return CodeRef(m_code, m_executablePool, m_size);
-    }
-
-    CodeLocationLabel finalizeCodeAddendum()
-    {
-        performFinalization();
-
-        return CodeLocationLabel(code());
+        return CodeRef(m_executableMemory);
     }
 
@@ -233 +212 @@
         ASSERT(!m_code);
 #if !ENABLE(BRANCH_COMPACTION)
-        m_code = m_assembler->m_assembler.executableCopy(*m_globalData, m_executablePool.get());
+        m_executableMemory = m_assembler->m_assembler.executableCopy(*m_globalData);
+        if (!m_executableMemory)
+            return;
+        m_code = m_executableMemory->start();
         m_size = m_assembler->m_assembler.codeSize();
         ASSERT(m_code);
 #else
         size_t initialSize = m_assembler->m_assembler.codeSize();
-        m_code = (uint8_t*)m_executablePool->alloc(*m_globalData, initialSize);
-        if (!m_code)
+        m_executableMemory = m_globalData->executableAllocator.allocate(*m_globalData, initialSize);
+        if (!m_executableMemory)
             return;
+        m_code = (uint8_t*)m_executableMemory->start();
+        ASSERT(m_code);
         ExecutableAllocator::makeWritable(m_code, initialSize);
         uint8_t* inData = (uint8_t*)m_assembler->unlinkedCode();
@@ -298 +282 @@
         jumpsToLink.clear();
         m_size = writePtr + initialSize - readPtr;
-        m_executablePool->tryShrink(m_code, initialSize, m_size);
+        m_executableMemory->shrink(m_size);
 
 #if DUMP_LINK_STATISTICS
@@ -367 +351 @@
 #endif
     
-    RefPtr<ExecutablePool> m_executablePool;
+    RefPtr<ExecutableMemoryHandle> m_executableMemory;
     size_t m_size;
     void* m_code;

trunk/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h

@@ -200 +200 @@
 // was allocated.
 class MacroAssemblerCodeRef {
+private:
+    // This is private because it's dangerous enough that we want uses of it
+    // to be easy to find - hence the static create method below.
+    explicit MacroAssemblerCodeRef(MacroAssemblerCodePtr codePtr)
+        : m_codePtr(codePtr)
+    {
+        ASSERT(m_codePtr);
+    }
+
 public:
     MacroAssemblerCodeRef()
-        : m_size(0)
-    {
-    }
-
-    MacroAssemblerCodeRef(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
-        : m_code(code)
-        , m_executablePool(executablePool)
-        , m_size(size)
-    {
-    }
-
-    MacroAssemblerCodePtr m_code;
-    RefPtr<ExecutablePool> m_executablePool;
-    size_t m_size;
+    {
+    }
+
+    MacroAssemblerCodeRef(PassRefPtr<ExecutableMemoryHandle> executableMemory)
+        : m_codePtr(executableMemory->start())
+        , m_executableMemory(executableMemory)
+    {
+        ASSERT(m_executableMemory->isManaged());
+        ASSERT(m_executableMemory->start());
+        ASSERT(m_codePtr);
+    }
+    
+    // Use this only when you know that the codePtr refers to code that is
+    // already being kept alive through some other means. Typically this means
+    // that codePtr is immortal.
+    static MacroAssemblerCodeRef createSelfManagedCodeRef(MacroAssemblerCodePtr codePtr)
+    {
+        return MacroAssemblerCodeRef(codePtr);
+    }
+    
+    ExecutableMemoryHandle* executableMemory() const
+    {
+        return m_executableMemory.get();
+    }
+    
+    MacroAssemblerCodePtr code() const
+    {
+        return m_codePtr;
+    }
+    
+    size_t size() const
+    {
+        if (!m_executableMemory)
+            return 0;
+        return m_executableMemory->sizeInBytes();
+    }
+    
+    bool operator!() const { return !m_codePtr; }
+
+private:
+    MacroAssemblerCodePtr m_codePtr;
+    RefPtr<ExecutableMemoryHandle> m_executableMemory;
 };
 

trunk/Source/JavaScriptCore/assembler/X86Assembler.h

@@ -1596 +1596 @@
     }
     
-    void* executableCopy(JSGlobalData& globalData, ExecutablePool* allocator)
-    {
-        return m_formatter.executableCopy(globalData, allocator);
+    PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData)
+    {
+        return m_formatter.executableCopy(globalData);
     }
 
@@ -1940 +1940 @@
         void* data() const { return m_buffer.data(); }
 
-        void* executableCopy(JSGlobalData& globalData, ExecutablePool* allocator)
-        {
-            return m_buffer.executableCopy(globalData, allocator);
+        PassRefPtr<ExecutableMemoryHandle> executableCopy(JSGlobalData& globalData)
+        {
+            return m_buffer.executableCopy(globalData);
         }
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -325 +325 @@
         JITCode& getJITCode() { return m_jitCode; }
         JITCode::JITType getJITType() { return m_jitCode.jitType(); }
-        ExecutablePool* executablePool() { return getJITCode().getExecutablePool(); }
+        ExecutableMemoryHandle* executableMemory() { return getJITCode().getExecutableMemory(); }
         virtual JSObject* compileOptimized(ExecState*, ScopeChainNode*) = 0;
         virtual CodeBlock* replacement() = 0;

trunk/Source/JavaScriptCore/bytecode/Instruction.h

@@ -51 +51 @@
 
 #if ENABLE(JIT)
-    typedef CodeLocationLabel PolymorphicAccessStructureListStubRoutineType;
+    typedef MacroAssemblerCodeRef PolymorphicAccessStructureListStubRoutineType;
 
     // Structure used by op_get_by_id_self_list and op_get_by_id_proto_list instruction to hold data off the main opcode stream.

trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h

@@ -174 +174 @@
         } u;
 
-        CodeLocationLabel stubRoutine;
+        MacroAssemblerCodeRef stubRoutine;
         CodeLocationCall callReturnLocation;
         CodeLocationLabel hotPathBegin;

trunk/Source/JavaScriptCore/dfg/DFGJITCompiler.cpp

@@ -956 +956 @@
     compileBody();
     // Link
-    LinkBuffer linkBuffer(*m_globalData, this, m_globalData->executableAllocator);
+    LinkBuffer linkBuffer(*m_globalData, this);
     link(linkBuffer);
     entry = JITCode(linkBuffer.finalizeCode(), JITCode::DFGJIT);
@@ -1014 +1014 @@
 
     // === Link ===
-    LinkBuffer linkBuffer(*m_globalData, this, m_globalData->executableAllocator);
+    LinkBuffer linkBuffer(*m_globalData, this);
     link(linkBuffer);
     

trunk/Source/JavaScriptCore/dfg/DFGRepatch.cpp

@@ -94 +94 @@
 }
 
-static void generateProtoChainAccessStub(ExecState* exec, StructureStubInfo& stubInfo, StructureChain* chain, size_t count, size_t offset, Structure* structure, CodeLocationLabel successLabel, CodeLocationLabel slowCaseLabel, CodeLocationLabel& stubRoutine)
+static void generateProtoChainAccessStub(ExecState* exec, StructureStubInfo& stubInfo, StructureChain* chain, size_t count, size_t offset, Structure* structure, CodeLocationLabel successLabel, CodeLocationLabel slowCaseLabel, MacroAssemblerCodeRef& stubRoutine)
 {
     JSGlobalData* globalData = &exec->globalData();
@@ -134 +134 @@
     emitRestoreScratch(stubJit, needToRestoreScratch, scratchGPR, success, fail, failureCases);
     
-    LinkBuffer patchBuffer(*globalData, &stubJit, exec->codeBlock()->executablePool());
+    LinkBuffer patchBuffer(*globalData, &stubJit);
     
     linkRestoreScratch(patchBuffer, needToRestoreScratch, success, fail, failureCases, successLabel, slowCaseLabel);
     
-    stubRoutine = patchBuffer.finalizeCodeAddendum();
+    stubRoutine = patchBuffer.finalizeCode();
 }
 
@@ -177 +177 @@
         emitRestoreScratch(stubJit, needToRestoreScratch, scratchGPR, success, fail, failureCases);
         
-        LinkBuffer patchBuffer(*globalData, &stubJit, codeBlock->executablePool());
+        LinkBuffer patchBuffer(*globalData, &stubJit);
         
         linkRestoreScratch(patchBuffer, needToRestoreScratch, stubInfo, success, fail, failureCases);
         
-        CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-        stubInfo.stubRoutine = entryLabel;
+        stubInfo.stubRoutine = patchBuffer.finalizeCode();
         
         RepatchBuffer repatchBuffer(codeBlock);
-        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), entryLabel);
+        repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine.code()));
         repatchBuffer.relink(stubInfo.callReturnLocation, operationGetById);
         
@@ -232 +231 @@
     
     RepatchBuffer repatchBuffer(codeBlock);
-    repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), stubInfo.stubRoutine);
+    repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine.code()));
     repatchBuffer.relink(stubInfo.callReturnLocation, operationGetByIdProtoBuildList);
     
@@ -325 +324 @@
     if (stubInfo.accessType == access_get_by_id_self) {
         ASSERT(!stubInfo.stubRoutine);
-        polymorphicStructureList = new PolymorphicAccessStructureList(*globalData, codeBlock->ownerExecutable(), stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase), stubInfo.u.getByIdSelf.baseObjectStructure.get());
+        polymorphicStructureList = new PolymorphicAccessStructureList(*globalData, codeBlock->ownerExecutable(), MacroAssemblerCodeRef::createSelfManagedCodeRef(stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase)), stubInfo.u.getByIdSelf.baseObjectStructure.get());
         stubInfo.initGetByIdSelfList(polymorphicStructureList, 1);
     } else {
@@ -351 +350 @@
         MacroAssembler::Jump success = stubJit.jump();
         
-        LinkBuffer patchBuffer(*globalData, &stubJit, codeBlock->executablePool());
-        
-        CodeLocationLabel lastProtoBegin = polymorphicStructureList->list[listIndex - 1].stubRoutine;
+        LinkBuffer patchBuffer(*globalData, &stubJit);
+        
+        CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructureList->list[listIndex - 1].stubRoutine.code());
         ASSERT(!!lastProtoBegin);
         
@@ -359 +358 @@
         patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
         
-        CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-        
-        polymorphicStructureList->list[listIndex].set(*globalData, codeBlock->ownerExecutable(), entryLabel, structure);
+        MacroAssemblerCodeRef stubRoutine = patchBuffer.finalizeCode();
+        
+        polymorphicStructureList->list[listIndex].set(*globalData, codeBlock->ownerExecutable(), stubRoutine, structure);
         
         CodeLocationJump jumpLocation = stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck);
         RepatchBuffer repatchBuffer(codeBlock);
-        repatchBuffer.relink(jumpLocation, entryLabel);
+        repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
         
         if (listIndex < (POLYMORPHIC_LIST_CACHE_SIZE - 1))
@@ -409 +408 @@
         ASSERT(!!stubInfo.stubRoutine);
         polymorphicStructureList = new PolymorphicAccessStructureList(*globalData, codeBlock->ownerExecutable(), stubInfo.stubRoutine, stubInfo.u.getByIdChain.baseObjectStructure.get(), stubInfo.u.getByIdChain.chain.get());
-        stubInfo.stubRoutine = CodeLocationLabel();
+        stubInfo.stubRoutine = MacroAssemblerCodeRef();
         stubInfo.initGetByIdProtoList(polymorphicStructureList, 1);
     } else {
@@ -420 +419 @@
         stubInfo.u.getByIdProtoList.listSize++;
         
-        CodeLocationLabel lastProtoBegin = polymorphicStructureList->list[listIndex - 1].stubRoutine;
+        CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructureList->list[listIndex - 1].stubRoutine.code());
         ASSERT(!!lastProtoBegin);
 
-        CodeLocationLabel entryLabel;
-        
-        generateProtoChainAccessStub(exec, stubInfo, prototypeChain, count, offset, structure, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone), lastProtoBegin, entryLabel);
-        
-        polymorphicStructureList->list[listIndex].set(*globalData, codeBlock->ownerExecutable(), entryLabel, structure);
+        MacroAssemblerCodeRef stubRoutine;
+        
+        generateProtoChainAccessStub(exec, stubInfo, prototypeChain, count, offset, structure, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone), lastProtoBegin, stubRoutine);
+        
+        polymorphicStructureList->list[listIndex].set(*globalData, codeBlock->ownerExecutable(), stubRoutine, structure);
         
         CodeLocationJump jumpLocation = stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck);
         RepatchBuffer repatchBuffer(codeBlock);
-        repatchBuffer.relink(jumpLocation, entryLabel);
+        repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
         
         if (listIndex < (POLYMORPHIC_LIST_CACHE_SIZE - 1))
@@ -549 +548 @@
                 success = stubJit.jump();
             
-            LinkBuffer patchBuffer(*globalData, &stubJit, codeBlock->executablePool());
+            LinkBuffer patchBuffer(*globalData, &stubJit);
             patchBuffer.link(success, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToDone));
             if (needToRestoreScratch)
@@ -556 +555 @@
                 patchBuffer.link(failureCases, stubInfo.callReturnLocation.labelAtOffset(stubInfo.deltaCallToSlowCase));
             
-            CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-            stubInfo.stubRoutine = entryLabel;
+            stubInfo.stubRoutine = patchBuffer.finalizeCode();
             
             RepatchBuffer repatchBuffer(codeBlock);
-            repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), entryLabel);
+            repatchBuffer.relink(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.deltaCallToStructCheck), CodeLocationLabel(stubInfo.stubRoutine.code()));
             repatchBuffer.relink(stubInfo.callReturnLocation, appropriatePutByIdFunction(slot, putKind));
             

trunk/Source/JavaScriptCore/jit/ExecutableAllocator.cpp

@@ -28 +28 @@
 #include "ExecutableAllocator.h"
 
+#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
+#include <wtf/MetaAllocator.h>
+#include <wtf/PageReservation.h>
+#include <wtf/VMTags.h>
+#endif
+
 #if ENABLE(ASSEMBLER)
+
+using namespace WTF;
 
 namespace JSC {
@@ -34 +42 @@
 #if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
 
-ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t size)
+class DemandExecutableAllocator: public MetaAllocator {
+public:
+    DemandExecutableAllocator()
+        : MetaAllocator(32) // round up all allocations to 32 bytes
+    {
+        // Don't preallocate any memory here.
+    }
+    
+    virtual ~DemandExecutableAllocator()
+    {
+        for (unsigned i = 0; i < reservations.size(); ++i)
+            reservations.at(i).deallocate();
+    }
+
+protected:
+    virtual void* allocateNewSpace(size_t& numPages)
+    {
+        size_t newNumPages = (((numPages * pageSize() + JIT_ALLOCATOR_LARGE_ALLOC_SIZE - 1) / JIT_ALLOCATOR_LARGE_ALLOC_SIZE * JIT_ALLOCATOR_LARGE_ALLOC_SIZE) + pageSize() - 1) / pageSize();
+        
+        ASSERT(newNumPages >= numPages);
+        
+        numPages = newNumPages;
+        
+        PageReservation reservation = PageReservation::reserve(numPages * pageSize(), OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
+        if (!reservation)
+            CRASH();
+        
+        reservations.append(reservation);
+        
+        return reservation.base();
+    }
+    
+    virtual void notifyNeedPage(void* page)
+    {
+        OSAllocator::commit(page, pageSize(), EXECUTABLE_POOL_WRITABLE, true);
+    }
+    
+    virtual void notifyPageIsFree(void* page)
+    {
+        OSAllocator::decommit(page, pageSize());
+    }
+
+private:
+    Vector<PageReservation, 16> reservations;
+};
+
+static DemandExecutableAllocator* allocator;
+
+void ExecutableAllocator::initializeAllocator()
 {
-    PageAllocation allocation = PageAllocation::allocate(size, OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
-    if (!allocation)
-        CRASH();
-    return allocation;
+    ASSERT(!allocator);
+    allocator = new DemandExecutableAllocator();
 }
 
-void ExecutablePool::systemRelease(ExecutablePool::Allocation& allocation)
+ExecutableAllocator::ExecutableAllocator(JSGlobalData&)
 {
-    allocation.deallocate();
+    ASSERT(allocator);
 }
 
@@ -51 +105 @@
     return true;
 }
-    
+
 bool ExecutableAllocator::underMemoryPressure()
 {
     return false;
 }
-    
+
+PassRefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(JSGlobalData&, size_t sizeInBytes)
+{
+    RefPtr<ExecutableMemoryHandle> result = allocator->allocate(sizeInBytes);
+    if (!result)
+        CRASH();
+    return result.release();
+}
+
 size_t ExecutableAllocator::committedByteCount()
 {
-    return 0;
-} 
+    return allocator->bytesCommitted();
+}
 
+#if ENABLE(META_ALLOCATOR_PROFILE)
+void ExecutableAllocator::dumpProfile()
+{
+    allocator->dumpProfile();
+}
 #endif
+
+#endif // ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)

trunk/Source/JavaScriptCore/jit/ExecutableAllocator.h

@@ -29 +29 @@
 #include <limits>
 #include <wtf/Assertions.h>
+#include <wtf/MetaAllocatorHandle.h>
 #include <wtf/PageAllocation.h>
 #include <wtf/PassRefPtr.h>
@@ -103 +104 @@
 namespace JSC {
 
-class ExecutablePool : public RefCounted<ExecutablePool> {
-public:
-#if ENABLE(EXECUTABLE_ALLOCATOR_DEMAND)
-    typedef PageAllocation Allocation;
-#else
-    class Allocation {
-    public:
-        Allocation(void* base, size_t size)
-            : m_base(base)
-            , m_size(size)
-        {
-        }
-        void* base() { return m_base; }
-        size_t size() { return m_size; }
-        bool operator!() const { return !m_base; }
-
-    private:
-        void* m_base;
-        size_t m_size;
-    };
-#endif
-    typedef Vector<Allocation, 2> AllocationList;
-
-    static PassRefPtr<ExecutablePool> create(JSGlobalData& globalData, size_t n)
-    {
-        return adoptRef(new ExecutablePool(globalData, n));
-    }
-
-    void* alloc(JSGlobalData& globalData, size_t n)
-    {
-        ASSERT(m_freePtr <= m_end);
-
-        // Round 'n' up to a multiple of word size; if all allocations are of
-        // word sized quantities, then all subsequent allocations will be aligned.
-        n = roundUpAllocationSize(n, sizeof(void*));
-
-        if (static_cast<ptrdiff_t>(n) < (m_end - m_freePtr)) {
-            void* result = m_freePtr;
-            m_freePtr += n;
-            return result;
-        }
-
-        // Insufficient space to allocate in the existing pool
-        // so we need allocate into a new pool
-        return poolAllocate(globalData, n);
-    }
-    
-    void tryShrink(void* allocation, size_t oldSize, size_t newSize)
-    {
-        if (static_cast<char*>(allocation) + oldSize != m_freePtr)
-            return;
-        m_freePtr = static_cast<char*>(allocation) + roundUpAllocationSize(newSize, sizeof(void*));
-    }
-
-    ~ExecutablePool()
-    {
-        AllocationList::iterator end = m_pools.end();
-        for (AllocationList::iterator ptr = m_pools.begin(); ptr != end; ++ptr)
-            ExecutablePool::systemRelease(*ptr);
-    }
-
-    size_t available() const { return (m_pools.size() > 1) ? 0 : m_end - m_freePtr; }
-
-private:
-    static Allocation systemAlloc(size_t n);
-    static void systemRelease(Allocation& alloc);
-
-    ExecutablePool(JSGlobalData&, size_t n);
-
-    void* poolAllocate(JSGlobalData&, size_t n);
-
-    char* m_freePtr;
-    char* m_end;
-    AllocationList m_pools;
-};
+typedef WTF::MetaAllocatorHandle ExecutableMemoryHandle;
 
 class ExecutableAllocator {
@@ -183 +110 @@
 
 public:
-    ExecutableAllocator(JSGlobalData& globalData)
-    {
-        if (isValid())
-            m_smallAllocationPool = ExecutablePool::create(globalData, JIT_ALLOCATOR_LARGE_ALLOC_SIZE);
-#if !ENABLE(INTERPRETER)
-        else
-            CRASH();
-#endif
-    }
+    ExecutableAllocator(JSGlobalData&);
+    
+    static void initializeAllocator();
 
     bool isValid() const;
 
     static bool underMemoryPressure();
-
-    PassRefPtr<ExecutablePool> poolForSize(JSGlobalData& globalData, size_t n)
-    {
-        // Try to fit in the existing small allocator
-        ASSERT(m_smallAllocationPool);
-        if (n < m_smallAllocationPool->available())
-            return m_smallAllocationPool;
-
-        // If the request is large, we just provide a unshared allocator
-        if (n > JIT_ALLOCATOR_LARGE_ALLOC_SIZE)
-            return ExecutablePool::create(globalData, n);
-
-        // Create a new allocator
-        RefPtr<ExecutablePool> pool = ExecutablePool::create(globalData, JIT_ALLOCATOR_LARGE_ALLOC_SIZE);
-
-        // If the new allocator will result in more free space than in
-        // the current small allocator, then we will use it instead
-        if ((pool->available() - n) > m_smallAllocationPool->available())
-            m_smallAllocationPool = pool;
-        return pool.release();
-    }
+    
+#if ENABLE(META_ALLOCATOR_PROFILE)
+    static void dumpProfile();
+#else
+    static void dumpProfile() { }
+#endif
+
+    PassRefPtr<ExecutableMemoryHandle> allocate(JSGlobalData&, size_t sizeInBytes);
 
 #if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
@@ -349 +257 @@
     static void reprotectRegion(void*, size_t, ProtectionSetting);
 #endif
-
-    RefPtr<ExecutablePool> m_smallAllocationPool;
 };
 
-inline ExecutablePool::ExecutablePool(JSGlobalData& globalData, size_t n)
-{
-    size_t allocSize = roundUpAllocationSize(n, pageSize());
-    Allocation mem = systemAlloc(allocSize);
-    if (!mem.base()) {
-        releaseExecutableMemory(globalData);
-        mem = systemAlloc(allocSize);
-    }
-    m_pools.append(mem);
-    m_freePtr = static_cast<char*>(mem.base());
-    if (!m_freePtr)
-        CRASH(); // Failed to allocate
-    m_end = m_freePtr + allocSize;
-    deprecatedTurnOffVerifier();
-}
-
-inline void* ExecutablePool::poolAllocate(JSGlobalData& globalData, size_t n)
-{
-    size_t allocSize = roundUpAllocationSize(n, pageSize());
-    
-    Allocation result = systemAlloc(allocSize);
-    if (!result.base()) {
-        releaseExecutableMemory(globalData);
-        result = systemAlloc(allocSize);
-        if (!result.base())
-            CRASH(); // Failed to allocate
-    }
-    
-    ASSERT(m_end >= m_freePtr);
-    if ((allocSize - n) > static_cast<size_t>(m_end - m_freePtr)) {
-        // Replace allocation pool
-        m_freePtr = static_cast<char*>(result.base()) + n;
-        m_end = static_cast<char*>(result.base()) + allocSize;
-    }
-
-    m_pools.append(result);
-    return result.base();
-}
-
-}
+} // namespace JSC
 
 #endif // ENABLE(JIT) && ENABLE(ASSEMBLER)

trunk/Source/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp

@@ -32 +32 @@
 #include <errno.h>
 
-#include "TCSpinLock.h"
 #include <sys/mman.h>
 #include <unistd.h>
-#include <wtf/AVLTree.h>
+#include <wtf/MetaAllocator.h>
 #include <wtf/PageReservation.h>
 #include <wtf/VMTags.h>
@@ -47 +46 @@
 namespace JSC {
     
-#define TwoPow(n) (1ull << n)
+#if CPU(ARM)
+static const size_t fixedPoolSize = 16 * 1024 * 1024;
+#elif CPU(X86_64)
+static const size_t fixedPoolSize = 1024 * 1024 * 1024;
+#else
+static const size_t fixedPoolSize = 32 * 1024 * 1024;
+#endif
 
-class AllocationTableSizeClass {
+class FixedVMPoolExecutableAllocator: public MetaAllocator {
 public:
-    AllocationTableSizeClass(size_t size, size_t blockSize, unsigned log2BlockSize)
-        : m_blockSize(blockSize)
+    FixedVMPoolExecutableAllocator()
+        : MetaAllocator(32) // round up all allocations to 32 bytes
     {
-        ASSERT(blockSize == TwoPow(log2BlockSize));
-
-        // Calculate the number of blocks needed to hold size.
-        size_t blockMask = blockSize - 1;
-        m_blockCount = (size + blockMask) >> log2BlockSize;
-
-        // Align to the smallest power of two >= m_blockCount.
-        m_blockAlignment = 1;
-        while (m_blockAlignment < m_blockCount)
-            m_blockAlignment += m_blockAlignment;
+        m_reservation = PageReservation::reserveWithGuardPages(fixedPoolSize, OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
+#if !ENABLE(INTERPRETER)
+        if (!m_reservation)
+            CRASH();
+#endif
+        if (m_reservation) {
+            ASSERT(m_reservation.size() == fixedPoolSize);
+            addFreshFreeSpace(m_reservation.base(), m_reservation.size());
+        }
     }
-
-    size_t blockSize() const { return m_blockSize; }
-    size_t blockCount() const { return m_blockCount; }
-    size_t blockAlignment() const { return m_blockAlignment; }
-
-    size_t size()
+    
+protected:
+    virtual void* allocateNewSpace(size_t&)
     {
-        return m_blockSize * m_blockCount;
+        // We're operating in a fixed pool, so new allocation is always prohibited.
+        return 0;
+    }
+    
+    virtual void notifyNeedPage(void* page)
+    {
+        m_reservation.commit(page, pageSize());
+    }
+    
+    virtual void notifyPageIsFree(void* page)
+    {
+        m_reservation.decommit(page, pageSize());
     }
 
 private:
-    size_t m_blockSize;
-    size_t m_blockCount;
-    size_t m_blockAlignment;
+    PageReservation m_reservation;
 };
 
-template<unsigned log2Entries>
-class AllocationTableLeaf {
-    typedef uint64_t BitField;
+static FixedVMPoolExecutableAllocator* allocator;
 
-public:
-    static const unsigned log2SubregionSize = 12; // 2^12 == pagesize
-    static const unsigned log2RegionSize = log2SubregionSize + log2Entries;
+void ExecutableAllocator::initializeAllocator()
+{
+    ASSERT(!allocator);
+    allocator = new FixedVMPoolExecutableAllocator();
+}
 
-    static const size_t subregionSize = TwoPow(log2SubregionSize);
-    static const size_t regionSize = TwoPow(log2RegionSize);
-    static const unsigned entries = TwoPow(log2Entries);
-    COMPILE_ASSERT(entries <= (sizeof(BitField) * 8), AllocationTableLeaf_entries_fit_in_BitField);
-
-    AllocationTableLeaf()
-        : m_allocated(0)
-    {
-    }
-
-    ~AllocationTableLeaf()
-    {
-        ASSERT(isEmpty());
-    }
-
-    size_t allocate(AllocationTableSizeClass& sizeClass)
-    {
-        ASSERT(sizeClass.blockSize() == subregionSize);
-        ASSERT(!isFull());
-
-        size_t alignment = sizeClass.blockAlignment();
-        size_t count = sizeClass.blockCount();
-        // Use this mask to check for spans of free blocks.
-        BitField mask = ((1ull << count) - 1) << (alignment - count);
-
-        // Step in units of alignment size.
-        for (unsigned i = 0; i < entries; i += alignment) {
-            if (!(m_allocated & mask)) {
-                m_allocated |= mask;
-                return (i + (alignment - count)) << log2SubregionSize;
-            }
-            mask <<= alignment;
-        }
-        return notFound;
-    }
-
-    void free(size_t location, AllocationTableSizeClass& sizeClass)
-    {
-        ASSERT(sizeClass.blockSize() == subregionSize);
-
-        size_t entry = location >> log2SubregionSize;
-        size_t count = sizeClass.blockCount();
-        BitField mask = ((1ull << count) - 1) << entry;
-
-        ASSERT((m_allocated & mask) == mask);
-        m_allocated &= ~mask;
-    }
-
-    bool isEmpty()
-    {
-        return !m_allocated;
-    }
-
-    bool isFull()
-    {
-        return !~m_allocated;
-    }
-
-    static size_t size()
-    {
-        return regionSize;
-    }
-
-    static AllocationTableSizeClass classForSize(size_t size)
-    {
-        return AllocationTableSizeClass(size, subregionSize, log2SubregionSize);
-    }
-
-#ifndef NDEBUG
-    void dump(size_t parentOffset = 0, unsigned indent = 0)
-    {
-        for (unsigned i = 0; i < indent; ++i)
-            fprintf(stderr, "    ");
-        fprintf(stderr, "%08x: [%016llx]\n", (int)parentOffset, m_allocated);
-    }
-#endif
-
-private:
-    BitField m_allocated;
-};
-
-
-template<class NextLevel>
-class LazyAllocationTable {
-public:
-    static const unsigned log2RegionSize = NextLevel::log2RegionSize;
-    static const unsigned entries = NextLevel::entries;
-
-    LazyAllocationTable()
-        : m_ptr(0)
-    {
-    }
-
-    ~LazyAllocationTable()
-    {
-        ASSERT(isEmpty());
-    }
-
-    size_t allocate(AllocationTableSizeClass& sizeClass)
-    {
-        if (!m_ptr)
-            m_ptr = new NextLevel();
-        return m_ptr->allocate(sizeClass);
-    }
-
-    void free(size_t location, AllocationTableSizeClass& sizeClass)
-    {
-        ASSERT(m_ptr);
-        m_ptr->free(location, sizeClass);
-        if (m_ptr->isEmpty()) {
-            delete m_ptr;
-            m_ptr = 0;
-        }
-    }
-
-    bool isEmpty()
-    {
-        return !m_ptr;
-    }
-
-    bool isFull()
-    {
-        return m_ptr && m_ptr->isFull();
-    }
-
-    static size_t size()
-    {
-        return NextLevel::size();
-    }
-
-#ifndef NDEBUG
-    void dump(size_t parentOffset = 0, unsigned indent = 0)
-    {
-        ASSERT(m_ptr);
-        m_ptr->dump(parentOffset, indent);
-    }
-#endif
-
-    static AllocationTableSizeClass classForSize(size_t size)
-    {
-        return NextLevel::classForSize(size);
-    }
-
-private:
-    NextLevel* m_ptr;
-};
-
-template<class NextLevel, unsigned log2Entries>
-class AllocationTableDirectory {
-    typedef uint64_t BitField;
-
-public:
-    static const unsigned log2SubregionSize = NextLevel::log2RegionSize;
-    static const unsigned log2RegionSize = log2SubregionSize + log2Entries;
-
-    static const size_t subregionSize = TwoPow(log2SubregionSize);
-    static const size_t regionSize = TwoPow(log2RegionSize);
-    static const unsigned entries = TwoPow(log2Entries);
-    COMPILE_ASSERT(entries <= (sizeof(BitField) * 8), AllocationTableDirectory_entries_fit_in_BitField);
-
-    AllocationTableDirectory()
-        : m_full(0)
-        , m_hasSuballocation(0)
-    {
-    }
-
-    ~AllocationTableDirectory()
-    {
-        ASSERT(isEmpty());
-    }
-
-    size_t allocate(AllocationTableSizeClass& sizeClass)
-    {
-        ASSERT(sizeClass.blockSize() <= subregionSize);
-        ASSERT(!isFull());
-
-        if (sizeClass.blockSize() < subregionSize) {
-            BitField bit = 1;
-            for (unsigned i = 0; i < entries; ++i, bit += bit) {
-                if (m_full & bit)
-                    continue;
-                size_t location = m_suballocations[i].allocate(sizeClass);
-                if (location != notFound) {
-                    // If this didn't already have a subregion, it does now!
-                    m_hasSuballocation |= bit;
-                    // Mirror the suballocation's full bit.
-                    if (m_suballocations[i].isFull())
-                        m_full |= bit;
-                    return (i * subregionSize) | location;
-                }
-            }
-            return notFound;
-        }
-
-        // A block is allocated if either it is fully allocated or contains suballocations.
-        BitField allocated = m_full | m_hasSuballocation;
-
-        size_t alignment = sizeClass.blockAlignment();
-        size_t count = sizeClass.blockCount();
-        // Use this mask to check for spans of free blocks.
-        BitField mask = ((1ull << count) - 1) << (alignment - count);
-
-        // Step in units of alignment size.
-        for (unsigned i = 0; i < entries; i += alignment) {
-            if (!(allocated & mask)) {
-                m_full |= mask;
-                return (i + (alignment - count)) << log2SubregionSize;
-            }
-            mask <<= alignment;
-        }
-        return notFound;
-    }
-
-    void free(size_t location, AllocationTableSizeClass& sizeClass)
-    {
-        ASSERT(sizeClass.blockSize() <= subregionSize);
-
-        size_t entry = location >> log2SubregionSize;
-
-        if (sizeClass.blockSize() < subregionSize) {
-            BitField bit = 1ull << entry;
-            m_suballocations[entry].free(location & (subregionSize - 1), sizeClass);
-            // Check if the suballocation is now empty.
-            if (m_suballocations[entry].isEmpty())
-                m_hasSuballocation &= ~bit;
-            // No need to check, it clearly isn't full any more!
-            m_full &= ~bit;
-        } else {
-            size_t count = sizeClass.blockCount();
-            BitField mask = ((1ull << count) - 1) << entry;
-            ASSERT((m_full & mask) == mask);
-            ASSERT(!(m_hasSuballocation & mask));
-            m_full &= ~mask;
-        }
-    }
-
-    bool isEmpty()
-    {
-        return !(m_full | m_hasSuballocation);
-    }
-
-    bool isFull()
-    {   
-        return !~m_full;
-    }
-
-    static size_t size()
-    {
-        return regionSize;
-    }
-
-    static AllocationTableSizeClass classForSize(size_t size)
-    {
-        if (size < subregionSize) {
-            AllocationTableSizeClass sizeClass = NextLevel::classForSize(size);
-            if (sizeClass.size() < NextLevel::size())
-                return sizeClass;
-        }
-        return AllocationTableSizeClass(size, subregionSize, log2SubregionSize);
-    }
-
-#ifndef NDEBUG
-    void dump(size_t parentOffset = 0, unsigned indent = 0)
-    {
-        for (unsigned i = 0; i < indent; ++i)
-            fprintf(stderr, "    ");
-        fprintf(stderr, "%08x: [", (int)parentOffset);
-        for (unsigned i = 0; i < entries; ++i) {
-            BitField bit = 1ull << i;
-            char c = m_hasSuballocation & bit
-                ? (m_full & bit ? 'N' : 'n')
-                : (m_full & bit ? 'F' : '-');
-            fprintf(stderr, "%c", c);
-        }
-        fprintf(stderr, "]\n");
-
-        for (unsigned i = 0; i < entries; ++i) {
-            BitField bit = 1ull << i;
-            size_t offset = parentOffset | (subregionSize * i);
-            if (m_hasSuballocation & bit)
-                m_suballocations[i].dump(offset, indent + 1);
-        }
-    }
-#endif
-
-private:
-    NextLevel m_suballocations[entries];
-    // Subregions exist in one of four states:
-    // (1) empty (both bits clear)
-    // (2) fully allocated as a single allocation (m_full set)
-    // (3) partially allocated through suballocations (m_hasSuballocation set)
-    // (4) fully allocated through suballocations (both bits set)
-    BitField m_full;
-    BitField m_hasSuballocation;
-};
-
-
-typedef AllocationTableLeaf<6> PageTables256KB;
-typedef AllocationTableDirectory<PageTables256KB, 6> PageTables16MB;
-typedef AllocationTableDirectory<LazyAllocationTable<PageTables16MB>, 1> PageTables32MB;
-typedef AllocationTableDirectory<LazyAllocationTable<PageTables16MB>, 6> PageTables1GB;
-
-#if CPU(ARM)
-typedef PageTables16MB FixedVMPoolPageTables;
-#elif CPU(X86_64)
-typedef PageTables1GB FixedVMPoolPageTables;
-#else
-typedef PageTables32MB FixedVMPoolPageTables;
-#endif
-
-
-class FixedVMPoolAllocator
+ExecutableAllocator::ExecutableAllocator(JSGlobalData&)
 {
-public:
-    FixedVMPoolAllocator()
-    {
-        ASSERT(PageTables256KB::size() == 256 * 1024);
-        ASSERT(PageTables16MB::size() == 16 * 1024 * 1024);
-        ASSERT(PageTables32MB::size() == 32 * 1024 * 1024);
-        ASSERT(PageTables1GB::size() == 1024 * 1024 * 1024);
-
-        m_reservation = PageReservation::reserveWithGuardPages(FixedVMPoolPageTables::size(), OSAllocator::JSJITCodePages, EXECUTABLE_POOL_WRITABLE, true);
-#if !ENABLE(INTERPRETER)
-        if (!isValid())
-            CRASH();
-#endif
-    }
- 
-    ExecutablePool::Allocation alloc(size_t requestedSize)
-    {
-        ASSERT(requestedSize);
-        AllocationTableSizeClass sizeClass = classForSize(requestedSize);
-        size_t size = sizeClass.size();
-        ASSERT(size);
-
-        if (size >= FixedVMPoolPageTables::size())
-            return ExecutablePool::Allocation(0, 0);
-        if (m_pages.isFull())
-            return ExecutablePool::Allocation(0, 0);
-
-        size_t offset = m_pages.allocate(sizeClass);
-        if (offset == notFound)
-            return ExecutablePool::Allocation(0, 0);
-
-        void* pointer = offsetToPointer(offset);
-        m_reservation.commit(pointer, size);
-        return ExecutablePool::Allocation(pointer, size);
-    }
-
-    void free(ExecutablePool::Allocation allocation)
-    {
-        void* pointer = allocation.base();
-        size_t size = allocation.size();
-        ASSERT(size);
-
-        m_reservation.decommit(pointer, size);
-
-        AllocationTableSizeClass sizeClass = classForSize(size);
-        ASSERT(sizeClass.size() == size);
-        m_pages.free(pointerToOffset(pointer), sizeClass);
-    }
-
-    size_t allocated()
-    {
-        return m_reservation.committed();
-    }
-
-    bool isValid() const
-    {
-        return !!m_reservation;
-    }
-
-private:
-    AllocationTableSizeClass classForSize(size_t size)
-    {
-        return FixedVMPoolPageTables::classForSize(size);
-    }
-
-    void* offsetToPointer(size_t offset)
-    {
-        return reinterpret_cast<void*>(reinterpret_cast<intptr_t>(m_reservation.base()) + offset);
-    }
-
-    size_t pointerToOffset(void* pointer)
-    {
-        return reinterpret_cast<intptr_t>(pointer) - reinterpret_cast<intptr_t>(m_reservation.base());
-    }
-
-    PageReservation m_reservation;
-    FixedVMPoolPageTables m_pages;
-};
-
-
-static SpinLock spinlock = SPINLOCK_INITIALIZER;
-static FixedVMPoolAllocator* allocator = 0;
-
-
-size_t ExecutableAllocator::committedByteCount()
-{
-    SpinLockHolder lockHolder(&spinlock);
-    return allocator ? allocator->allocated() : 0;
-}   
+    ASSERT(allocator);
+}
 
 bool ExecutableAllocator::isValid() const
 {
-    SpinLockHolder lock_holder(&spinlock);
-    if (!allocator)
-        allocator = new FixedVMPoolAllocator();
-    return allocator->isValid();
+    return !!allocator->bytesReserved();
 }
 
 bool ExecutableAllocator::underMemoryPressure()
 {
-    // Technically we should take the spin lock here, but we don't care if we get stale data.
-    // This is only really a heuristic anyway.
-    return allocator && (allocator->allocated() > (FixedVMPoolPageTables::size() / 2));
+    MetaAllocator::Statistics statistics = allocator->currentStatistics();
+    return statistics.bytesAllocated > statistics.bytesReserved / 2;
 }
 
-ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t size)
+PassRefPtr<ExecutableMemoryHandle> ExecutableAllocator::allocate(JSGlobalData& globalData, size_t sizeInBytes)
 {
-    SpinLockHolder lock_holder(&spinlock);
-    ASSERT(allocator);
-    return allocator->alloc(size);
+    RefPtr<ExecutableMemoryHandle> result = allocator->allocate(sizeInBytes);
+    if (!result) {
+        releaseExecutableMemory(globalData);
+        result = allocator->allocate(sizeInBytes);
+        if (!result)
+            CRASH();
+    }
+    return result.release();
 }
 
-void ExecutablePool::systemRelease(ExecutablePool::Allocation& allocation) 
+size_t ExecutableAllocator::committedByteCount()
 {
-    SpinLockHolder lock_holder(&spinlock);
-    ASSERT(allocator);
-    allocator->free(allocation);
+    return allocator->bytesCommitted();
 }
+
+#if ENABLE(META_ALLOCATOR_PROFILE)
+void ExecutableAllocator::dumpProfile()
+{
+    allocator->dumpProfile();
+}
+#endif
 
 }
 
 
-#endif // HAVE(ASSEMBLER)
+#endif // ENABLE(EXECUTABLE_ALLOCATOR_FIXED)

trunk/Source/JavaScriptCore/jit/JIT.cpp

@@ -571 +571 @@
     ASSERT(m_jmpTable.isEmpty());
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_globalData->executableAllocator);
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     // Translate vPC offsets into addresses in JIT generated code, for switch tables.

trunk/Source/JavaScriptCore/jit/JIT.h

@@ -222 +222 @@
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, TrampolineStructure *trampolines)
+        static PassRefPtr<ExecutableMemoryHandle> compileCTIMachineTrampolines(JSGlobalData* globalData, TrampolineStructure *trampolines)
         {
             if (!globalData->canUseJIT())
-                return;
+                return 0;
             JIT jit(globalData, 0);
-            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, trampolines);
-        }
-
-        static CodePtr compileCTINativeCall(JSGlobalData* globalData, PassRefPtr<ExecutablePool> executablePool, NativeFunction func)
+            return jit.privateCompileCTIMachineTrampolines(globalData, trampolines);
+        }
+
+        static CodeRef compileCTINativeCall(JSGlobalData* globalData, NativeFunction func)
         {
             if (!globalData->canUseJIT())
-                return CodePtr();
+                return CodeRef();
             JIT jit(globalData, 0);
-            return jit.privateCompileCTINativeCall(executablePool, globalData, func);
+            return jit.privateCompileCTINativeCall(globalData, func);
         }
 
@@ -275 +275 @@
         void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ReturnAddressPtr returnAddress, bool direct);
 
-        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, TrampolineStructure *trampolines);
+        PassRefPtr<ExecutableMemoryHandle> privateCompileCTIMachineTrampolines(JSGlobalData*, TrampolineStructure*);
         Label privateCompileCTINativeCall(JSGlobalData*, bool isConstruct = false);
-        CodePtr privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executablePool, JSGlobalData* data, NativeFunction func);
+        CodeRef privateCompileCTINativeCall(JSGlobalData*, NativeFunction);
         void privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress);
 
@@ -1051 +1051 @@
 #endif
         WeakRandom m_randomGenerator;
-        static CodePtr stringGetByValStubGenerator(JSGlobalData* globalData, ExecutablePool* pool);
+        static CodeRef stringGetByValStubGenerator(JSGlobalData*);
         
 #if ENABLE(TIERED_COMPILATION)

trunk/Source/JavaScriptCore/jit/JITCode.h

@@ -84 +84 @@
         bool operator !() const
         {
-            return !m_ref.m_code.executableAddress();
+            return !m_ref;
         }
 
         CodePtr addressForCall()
         {
-            return m_ref.m_code;
+            return m_ref.code();
         }
 
@@ -97 +97 @@
         unsigned offsetOf(void* pointerIntoCode)
         {
-            intptr_t result = reinterpret_cast<intptr_t>(pointerIntoCode) - reinterpret_cast<intptr_t>(m_ref.m_code.executableAddress());
+            intptr_t result = reinterpret_cast<intptr_t>(pointerIntoCode) - reinterpret_cast<intptr_t>(m_ref.code().executableAddress());
             ASSERT(static_cast<intptr_t>(static_cast<unsigned>(result)) == result);
             return static_cast<unsigned>(result);
@@ -105 +105 @@
         inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData)
         {
-            JSValue result = JSValue::decode(ctiTrampoline(m_ref.m_code.executableAddress(), registerFile, callFrame, 0, Profiler::enabledProfilerReference(), globalData));
+            JSValue result = JSValue::decode(ctiTrampoline(m_ref.code().executableAddress(), registerFile, callFrame, 0, Profiler::enabledProfilerReference(), globalData));
             return globalData->exception ? jsNull() : result;
         }
@@ -111 +111 @@
         void* start()
         {
-            return m_ref.m_code.dataLocation();
+            return m_ref.code().dataLocation();
         }
 
         size_t size()
         {
-            ASSERT(m_ref.m_code.executableAddress());
-            return m_ref.m_size;
+            ASSERT(m_ref.code().executableAddress());
+            return m_ref.size();
         }
 
-        ExecutablePool* getExecutablePool()
+        ExecutableMemoryHandle* getExecutableMemory()
         {
-            return m_ref.m_executablePool.get();
+            return m_ref.executableMemory();
         }
         
@@ -132 +132 @@
         // Host functions are a bit special; they have a m_code pointer but they
         // do not individully ref the executable pool containing the trampoline.
-        static JITCode HostFunction(CodePtr code)
+        static JITCode HostFunction(CodeRef code)
         {
-            return JITCode(code.dataLocation(), 0, 0, HostCallThunk);
+            return JITCode(code, HostCallThunk);
         }
 
@@ -144 +144 @@
 
     private:
-        JITCode(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size, JITType jitType)
-            : m_ref(code, executablePool, size)
+        JITCode(PassRefPtr<ExecutableMemoryHandle> executableMemory, JITType jitType)
+            : m_ref(executableMemory)
             , m_jitType(jitType)
         {

trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp

@@ -43 +43 @@
 #if USE(JSVALUE64)
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
+PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
     // (2) The second function provides fast property access for string length
@@ -154 +154 @@
 
     // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
-    LinkBuffer patchBuffer(*m_globalData, this, m_globalData->executableAllocator);
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     patchBuffer.link(string_failureCases1Call, FunctionPtr(cti_op_get_by_id_string_fail));
@@ -165 +165 @@
 
     CodeRef finalCode = patchBuffer.finalizeCode();
-    *executablePool = finalCode.m_executablePool;
+    RefPtr<ExecutableMemoryHandle> executableMemory = finalCode.executableMemory();
 
     trampolines->ctiVirtualCallLink = patchBuffer.trampolineAt(virtualCallLinkBegin);
@@ -174 +174 @@
     trampolines->ctiNativeConstruct = patchBuffer.trampolineAt(nativeConstructThunk);
     trampolines->ctiStringLengthTrampoline = patchBuffer.trampolineAt(stringLengthBegin);
+    
+    return executableMemory.release();
 }
 
@@ -292 +294 @@
 }
 
-JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool>, JSGlobalData* globalData, NativeFunction)
-{
-    return globalData->jitStubs->ctiNativeCall();
+JIT::CodeRef JIT::privateCompileCTINativeCall(JSGlobalData* globalData, NativeFunction)
+{
+    return CodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
 }
 

trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

@@ -41 +41 @@
 namespace JSC {
 
-void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, TrampolineStructure *trampolines)
+PassRefPtr<ExecutableMemoryHandle> JIT::privateCompileCTIMachineTrampolines(JSGlobalData* globalData, TrampolineStructure *trampolines)
 {
 #if ENABLE(JIT_USE_SOFT_MODULO)
@@ -153 +153 @@
 
     // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
-    LinkBuffer patchBuffer(*m_globalData, this, m_globalData->executableAllocator);
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     patchBuffer.link(string_failureCases1Call, FunctionPtr(cti_op_get_by_id_string_fail));
@@ -164 +164 @@
 
     CodeRef finalCode = patchBuffer.finalizeCode();
-    *executablePool = finalCode.m_executablePool;
+    RefPtr<ExecutableMemoryHandle> executableMemory = finalCode.executableMemory();
 
     trampolines->ctiVirtualCall = patchBuffer.trampolineAt(virtualCallBegin);
@@ -176 +176 @@
     trampolines->ctiSoftModulo = patchBuffer.trampolineAt(softModBegin);
 #endif
+    
+    return executableMemory.release();
 }
 
@@ -313 +315 @@
 }
 
-JIT::CodePtr JIT::privateCompileCTINativeCall(PassRefPtr<ExecutablePool> executablePool, JSGlobalData* globalData, NativeFunction func)
+JIT::CodeRef JIT::privateCompileCTINativeCall(JSGlobalData* globalData, NativeFunction func)
 {
     Call nativeCall;
-    Label nativeCallThunk = align();
 
     emitPutImmediateToCallFrameHeader(0, RegisterFile::CodeBlock);
@@ -448 +449 @@
 
     // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
-    LinkBuffer patchBuffer(*m_globalData, this, executablePool);
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     patchBuffer.link(nativeCall, FunctionPtr(func));
-    patchBuffer.finalizeCode();
-
-    return patchBuffer.trampolineAt(nativeCallThunk);
+    return patchBuffer.finalizeCode();
 }
 

trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -51 +51 @@
 #if USE(JSVALUE64)
 
-JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, ExecutablePool* pool)
+JIT::CodeRef JIT::stringGetByValStubGenerator(JSGlobalData* globalData)
 {
     JSInterfaceJIT jit;
@@ -78 +78 @@
     jit.ret();
     
-    LinkBuffer patchBuffer(*globalData, &jit, pool);
-    return patchBuffer.finalizeCode().m_code;
+    LinkBuffer patchBuffer(*globalData, &jit);
+    return patchBuffer.finalizeCode();
 }
 
@@ -123 +123 @@
     linkSlowCase(iter); // base array check
     Jump notString = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
-    emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator));
+    emitNakedCall(CodeLocationLabel(m_globalData->getCTIStub(stringGetByValStubGenerator).code()));
     Jump failed = branchTestPtr(Zero, regT0);
     emitPutVirtualRegister(dst, regT0);
@@ -556 +556 @@
     Call failureCall = tailRecursiveCall();
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     patchBuffer.link(failureCall, FunctionPtr(direct ? cti_op_put_by_id_direct_fail : cti_op_put_by_id_fail));
@@ -565 +565 @@
     }
     
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    stubInfo->stubRoutine = patchBuffer.finalizeCode();
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, CodeLocationLabel(stubInfo->stubRoutine.code()));
 }
 
@@ -616 +615 @@
     Jump success = jump();
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     // Use the patch information to link the failure cases back to the original slow case routine.
@@ -627 +626 @@
 
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    stubInfo->stubRoutine = patchBuffer.finalizeCode();
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
@@ -674 +672 @@
         compileGetDirectOffset(protoObject, regT0, cachedOffset);
     Jump success = jump();
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     // Use the patch information to link the failure cases back to the original slow case routine.
@@ -691 +689 @@
     }
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    stubInfo->stubRoutine = patchBuffer.finalizeCode();
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
@@ -727 +724 @@
     Jump success = jump();
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     if (needsStubLink) {
@@ -737 +734 @@
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructures->list[currentIndex - 1].stubRoutine.code());
     if (!lastProtoBegin)
         lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
@@ -746 +743 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure);
+    MacroAssemblerCodeRef stubCode = patchBuffer.finalizeCode();
+
+    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), stubCode, structure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubCode.code()));
 }
 
@@ -792 +789 @@
     Jump success = jump();
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     if (needsStubLink) {
@@ -802 +799 @@
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
     patchBuffer.link(failureCases1, lastProtoBegin);
     patchBuffer.link(failureCases2, lastProtoBegin);
@@ -809 +806 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    prototypeStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure, prototypeStructure);
+    MacroAssemblerCodeRef stubCode = patchBuffer.finalizeCode();
+    prototypeStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), stubCode, structure, prototypeStructure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubCode.code()));
 }
 
@@ -858 +855 @@
     Jump success = jump();
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     
     if (needsStubLink) {
@@ -868 +865 @@
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
 
     patchBuffer.link(bucketsOfFail, lastProtoBegin);
@@ -875 +872 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    CodeRef stubRoutine = patchBuffer.finalizeCode();
 
     // Track the stub we have created so that it will be deleted later.
-    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), stubRoutine, structure, chain);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
 }
 
@@ -926 +923 @@
     Jump success = jump();
 
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
 
     if (needsStubLink) {
@@ -942 +939 @@
 
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    CodeRef stubRoutine = patchBuffer.finalizeCode();
+    stubInfo->stubRoutine = stubRoutine;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
 
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.

trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp

@@ -166 +166 @@
 }
 
-JIT::CodePtr JIT::stringGetByValStubGenerator(JSGlobalData* globalData, ExecutablePool* pool)
+JIT::CodeRef JIT::stringGetByValStubGenerator(JSGlobalData* globalData)
 {
     JSInterfaceJIT jit;
@@ -194 +194 @@
     jit.ret();
     
-    LinkBuffer patchBuffer(*globalData, &jit, pool);
-    return patchBuffer.finalizeCode().m_code;
+    LinkBuffer patchBuffer(*globalData, &jit);
+    return patchBuffer.finalizeCode();
 }
 
@@ -233 +233 @@
     linkSlowCase(iter); // base array check
     Jump notString = branchPtr(NotEqual, Address(regT0), TrustedImmPtr(m_globalData->jsStringVPtr));
-    emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator));
+    emitNakedCall(m_globalData->getCTIStub(stringGetByValStubGenerator).code());
     Jump failed = branchTestPtr(Zero, regT0);
     emitStore(dst, regT1, regT0);
@@ -542 +542 @@
     Call failureCall = tailRecursiveCall();
     
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     
     patchBuffer.link(failureCall, FunctionPtr(direct ? cti_op_put_by_id_direct_fail : cti_op_put_by_id_fail));
@@ -551 +551 @@
     }
     
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    stubInfo->stubRoutine = patchBuffer.finalizeCode();
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, CodeLocationLabel(stubInfo->stubRoutine.code()));
 }
 
@@ -607 +606 @@
     Jump success = jump();
     
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     
     // Use the patch information to link the failure cases back to the original slow case routine.
@@ -618 +617 @@
     
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    stubInfo->stubRoutine = patchBuffer.finalizeCode();
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
     
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
@@ -667 +665 @@
     Jump success = jump();
     
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     
     // Use the patch information to link the failure cases back to the original slow case routine.
@@ -685 +683 @@
 
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    stubInfo->stubRoutine = patchBuffer.finalizeCode();
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubInfo->stubRoutine.code()));
     
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
@@ -724 +721 @@
     Jump success = jump();
     
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     if (needsStubLink) {
         for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
@@ -732 +729 @@
     }    
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(polymorphicStructures->list[currentIndex - 1].stubRoutine.code());
     if (!lastProtoBegin)
         lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
@@ -741 +738 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), entryLabel, structure);
+    CodeRef stubRoutine = patchBuffer.finalizeCode();
+
+    polymorphicStructures->list[currentIndex].set(*m_globalData, m_codeBlock->ownerExecutable(), stubRoutine, structure);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
 }
 
@@ -788 +785 @@
     Jump success = jump();
     
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     if (needsStubLink) {
         for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
@@ -796 +793 @@
     }
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
     patchBuffer.link(failureCases1, lastProtoBegin);
     patchBuffer.link(failureCases2, lastProtoBegin);
@@ -803 +800 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
     
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-
-    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, prototypeStructure);
+    CodeRef stubRoutine = patchBuffer.finalizeCode();
+
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), stubRoutine, structure, prototypeStructure);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
 }
 
@@ -855 +852 @@
     Jump success = jump();
     
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     if (needsStubLink) {
         for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
@@ -863 +860 @@
     }
     // Use the patch information to link the failure cases back to the original slow case routine.
-    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = CodeLocationLabel(prototypeStructures->list[currentIndex - 1].stubRoutine.code());
     
     patchBuffer.link(bucketsOfFail, lastProtoBegin);
@@ -870 +867 @@
     patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
     
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    CodeRef stubRoutine = patchBuffer.finalizeCode();
     
     // Track the stub we have created so that it will be deleted later.
-    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), entryLabel, structure, chain);
+    prototypeStructures->list[currentIndex].set(callFrame->globalData(), m_codeBlock->ownerExecutable(), stubRoutine, structure, chain);
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
 }
 
@@ -922 +919 @@
     Jump success = jump();
     
-    LinkBuffer patchBuffer(*m_globalData, this, m_codeBlock->executablePool());
+    LinkBuffer patchBuffer(*m_globalData, this);
     if (needsStubLink) {
         for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
@@ -936 +933 @@
     
     // Track the stub we have created so that it will be deleted later.
-    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
-    stubInfo->stubRoutine = entryLabel;
+    CodeRef stubRoutine = patchBuffer.finalizeCode();
+    stubInfo->stubRoutine = stubRoutine;
     
     // Finally patch the jump to slow case back in the hot path to jump here instead.
     CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
     RepatchBuffer repatchBuffer(m_codeBlock);
-    repatchBuffer.relink(jumpLocation, entryLabel);
+    repatchBuffer.relink(jumpLocation, CodeLocationLabel(stubRoutine.code()));
     
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.

trunk/Source/JavaScriptCore/jit/JITStubs.cpp

@@ -758 +758 @@
         return;
 
-    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_trampolineStructure);
-    ASSERT(m_executablePool);
+    m_executableMemory = JIT::compileCTIMachineTrampolines(globalData, &m_trampolineStructure);
+    ASSERT(!!m_executableMemory);
 #if CPU(ARM_THUMB2)
     // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
@@ -1609 +1609 @@
         if (stubInfo->accessType == access_get_by_id_self) {
             ASSERT(!stubInfo->stubRoutine);
-            polymorphicStructureList = new PolymorphicAccessStructureList(callFrame->globalData(), codeBlock->ownerExecutable(), CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure.get());
+            polymorphicStructureList = new PolymorphicAccessStructureList(callFrame->globalData(), codeBlock->ownerExecutable(), MacroAssemblerCodeRef(), stubInfo->u.getByIdSelf.baseObjectStructure.get());
             stubInfo->initGetByIdSelfList(polymorphicStructureList, 1);
         } else {
@@ -1635 +1635 @@
     case access_get_by_id_proto:
         prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure.get(), stubInfo->u.getByIdProto.prototypeStructure.get());
-        stubInfo->stubRoutine = CodeLocationLabel();
+        stubInfo->stubRoutine = MacroAssemblerCodeRef();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
     case access_get_by_id_chain:
         prototypeStructureList = new PolymorphicAccessStructureList(globalData, owner, stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure.get(), stubInfo->u.getByIdChain.chain.get());
-        stubInfo->stubRoutine = CodeLocationLabel();
+        stubInfo->stubRoutine = MacroAssemblerCodeRef();
         stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
         break;
@@ -3599 +3599 @@
 }
 
-MacroAssemblerCodePtr JITThunks::ctiStub(JSGlobalData* globalData, ThunkGenerator generator)
-{
-    std::pair<CTIStubMap::iterator, bool> entry = m_ctiStubMap.add(generator, MacroAssemblerCodePtr());
+MacroAssemblerCodeRef JITThunks::ctiStub(JSGlobalData* globalData, ThunkGenerator generator)
+{
+    std::pair<CTIStubMap::iterator, bool> entry = m_ctiStubMap.add(generator, MacroAssemblerCodeRef());
     if (entry.second)
-        entry.first->second = generator(globalData, m_executablePool.get());
+        entry.first->second = generator(globalData);
     return entry.first->second;
 }
@@ -3611 +3611 @@
     std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Weak<NativeExecutable>());
     if (!*entry.first->second)
-        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, JIT::compileCTINativeCall(globalData, m_executablePool, function), function, ctiNativeConstruct(), callHostFunctionAsConstructor));
+        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, JIT::compileCTINativeCall(globalData, function), function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct()), callHostFunctionAsConstructor));
     return entry.first->second.get();
 }
@@ -3619 +3619 @@
     std::pair<HostFunctionStubMap::iterator, bool> entry = m_hostFunctionStubMap->add(function, Weak<NativeExecutable>());
     if (!*entry.first->second) {
-        MacroAssemblerCodePtr code = globalData->canUseJIT() ? generator(globalData, m_executablePool.get()) : MacroAssemblerCodePtr();
-        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, code, function, ctiNativeConstruct(), callHostFunctionAsConstructor));
+        MacroAssemblerCodeRef code = globalData->canUseJIT() ? generator(globalData) : MacroAssemblerCodeRef();
+        entry.first->second.set(*globalData, NativeExecutable::create(*globalData, code, function, MacroAssemblerCodeRef::createSelfManagedCodeRef(ctiNativeConstruct()), callHostFunctionAsConstructor));
     }
     return entry.first->second.get();

trunk/Source/JavaScriptCore/jit/JITStubs.h

@@ -295 +295 @@
         MacroAssemblerCodePtr ctiSoftModulo() { return m_trampolineStructure.ctiSoftModulo; }
 
-        MacroAssemblerCodePtr ctiStub(JSGlobalData* globalData, ThunkGenerator generator);
+        MacroAssemblerCodeRef ctiStub(JSGlobalData*, ThunkGenerator);
 
         NativeExecutable* hostFunctionStub(JSGlobalData*, NativeFunction);
@@ -303 +303 @@
 
     private:
-        typedef HashMap<ThunkGenerator, MacroAssemblerCodePtr> CTIStubMap;
+        typedef HashMap<ThunkGenerator, MacroAssemblerCodeRef> CTIStubMap;
         CTIStubMap m_ctiStubMap;
         typedef HashMap<NativeFunction, Weak<NativeExecutable> > HostFunctionStubMap;
         OwnPtr<HostFunctionStubMap> m_hostFunctionStubMap;
-        RefPtr<ExecutablePool> m_executablePool;
+        RefPtr<ExecutableMemoryHandle> m_executableMemory;
 
         TrampolineStructure m_trampolineStructure;

trunk/Source/JavaScriptCore/jit/SpecializedThunkJIT.h

@@ -38 +38 @@
     public:
         static const int ThisArgument = -1;
-        SpecializedThunkJIT(int expectedArgCount, JSGlobalData* globalData, ExecutablePool* pool)
+        SpecializedThunkJIT(int expectedArgCount, JSGlobalData* globalData)
             : m_expectedArgCount(expectedArgCount)
             , m_globalData(globalData)
-            , m_pool(pool)
         {
             // Check that we have the expected number of arguments
@@ -135 +134 @@
         }
         
-        MacroAssemblerCodePtr finalize(JSGlobalData& globalData, MacroAssemblerCodePtr fallback)
+        MacroAssemblerCodeRef finalize(JSGlobalData& globalData, MacroAssemblerCodePtr fallback)
         {
-            LinkBuffer patchBuffer(globalData, this, m_pool.get());
+            LinkBuffer patchBuffer(globalData, this);
             patchBuffer.link(m_failures, CodeLocationLabel(fallback));
             for (unsigned i = 0; i < m_calls.size(); i++)
                 patchBuffer.link(m_calls[i].first, m_calls[i].second);
-            return patchBuffer.finalizeCode().m_code;
+            return patchBuffer.finalizeCode();
         }
 
@@ -175 +174 @@
         int m_expectedArgCount;
         JSGlobalData* m_globalData;
-        RefPtr<ExecutablePool> m_pool;
         MacroAssembler::JumpList m_failures;
         Vector<std::pair<Call, FunctionPtr> > m_calls;

trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

@@ -64 +64 @@
 }
 
-MacroAssemblerCodePtr charCodeAtThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef charCodeAtThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     stringCharLoad(jit);
     jit.returnInt32(SpecializedThunkJIT::regT0);
@@ -72 +72 @@
 }
 
-MacroAssemblerCodePtr charAtThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef charAtThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     stringCharLoad(jit);
     charToString(jit, globalData, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT0, SpecializedThunkJIT::regT1);
@@ -81 +81 @@
 }
 
-MacroAssemblerCodePtr fromCharCodeThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef fromCharCodeThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     // load char code
     jit.loadInt32Argument(0, SpecializedThunkJIT::regT0);
@@ -91 +91 @@
 }
 
-MacroAssemblerCodePtr sqrtThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef sqrtThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     if (!jit.supportsFloatingPointSqrt())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
 
     jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
@@ -179 +179 @@
 defineUnaryDoubleOpWrapper(ceil);
 
-MacroAssemblerCodePtr floorThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef floorThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     MacroAssembler::Jump nonIntJump;
     if (!UnaryDoubleOpWrapper(floor) || !jit.supportsFloatingPoint())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
     jit.returnInt32(SpecializedThunkJIT::regT0);
@@ -198 +198 @@
 }
 
-MacroAssemblerCodePtr ceilThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef ceilThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     if (!UnaryDoubleOpWrapper(ceil) || !jit.supportsFloatingPoint())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     MacroAssembler::Jump nonIntJump;
     jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
@@ -221 +221 @@
 static const double negativeHalfConstant = -0.5;
     
-MacroAssemblerCodePtr roundThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef roundThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     if (!UnaryDoubleOpWrapper(jsRound) || !jit.supportsFloatingPoint())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     MacroAssembler::Jump nonIntJump;
     jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
@@ -240 +240 @@
 }
 
-MacroAssemblerCodePtr expThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
+MacroAssemblerCodeRef expThunkGenerator(JSGlobalData* globalData)
 {
     if (!UnaryDoubleOpWrapper(exp))
-        return globalData->jitStubs->ctiNativeCall();
-    SpecializedThunkJIT jit(1, globalData, pool);
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
+    SpecializedThunkJIT jit(1, globalData);
     if (!jit.supportsFloatingPoint())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
     jit.callDoubleToDouble(UnaryDoubleOpWrapper(exp));
@@ -253 +253 @@
 }
 
-MacroAssemblerCodePtr logThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
+MacroAssemblerCodeRef logThunkGenerator(JSGlobalData* globalData)
 {
     if (!UnaryDoubleOpWrapper(log))
-        return globalData->jitStubs->ctiNativeCall();
-    SpecializedThunkJIT jit(1, globalData, pool);
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
+    SpecializedThunkJIT jit(1, globalData);
     if (!jit.supportsFloatingPoint())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     jit.loadDoubleArgument(0, SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::regT0);
     jit.callDoubleToDouble(UnaryDoubleOpWrapper(log));
@@ -266 +266 @@
 }
 
-MacroAssemblerCodePtr absThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(1, globalData, pool);
+MacroAssemblerCodeRef absThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(1, globalData);
     if (!jit.supportsDoubleBitops())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
     MacroAssembler::Jump nonIntJump;
     jit.loadInt32Argument(0, SpecializedThunkJIT::regT0, nonIntJump);
@@ -287 +287 @@
 }
 
-MacroAssemblerCodePtr powThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
-{
-    SpecializedThunkJIT jit(2, globalData, pool);
+MacroAssemblerCodeRef powThunkGenerator(JSGlobalData* globalData)
+{
+    SpecializedThunkJIT jit(2, globalData);
     if (!jit.supportsFloatingPoint())
-        return globalData->jitStubs->ctiNativeCall();
+        return MacroAssemblerCodeRef::createSelfManagedCodeRef(globalData->jitStubs->ctiNativeCall());
 
     jit.loadDouble(&oneConstant, SpecializedThunkJIT::fpRegT1);

trunk/Source/JavaScriptCore/jit/ThunkGenerators.h

@@ -32 +32 @@
     class JSGlobalData;
     class NativeExecutable;
-    class MacroAssemblerCodePtr;
+    class MacroAssemblerCodeRef;
 
-    typedef MacroAssemblerCodePtr (*ThunkGenerator)(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr charCodeAtThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr charAtThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr fromCharCodeThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr absThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr ceilThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr expThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr floorThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr logThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr roundThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr sqrtThunkGenerator(JSGlobalData*, ExecutablePool*);
-    MacroAssemblerCodePtr powThunkGenerator(JSGlobalData*, ExecutablePool*);
+    typedef MacroAssemblerCodeRef (*ThunkGenerator)(JSGlobalData*);
+    MacroAssemblerCodeRef charCodeAtThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef charAtThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef fromCharCodeThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef absThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef ceilThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef expThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef floorThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef logThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef roundThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef sqrtThunkGenerator(JSGlobalData*);
+    MacroAssemblerCodeRef powThunkGenerator(JSGlobalData*);
 }
 #endif

trunk/Source/JavaScriptCore/runtime/Executable.h

@@ -174 +174 @@
 
 #if ENABLE(JIT)
-        static NativeExecutable* create(JSGlobalData& globalData, MacroAssemblerCodePtr callThunk, NativeFunction function, MacroAssemblerCodePtr constructThunk, NativeFunction constructor)
+        static NativeExecutable* create(JSGlobalData& globalData, MacroAssemblerCodeRef callThunk, NativeFunction function, MacroAssemblerCodeRef constructThunk, NativeFunction constructor)
         {
             NativeExecutable* executable;

trunk/Source/JavaScriptCore/runtime/InitializeThreading.cpp

@@ -30 +30 @@
 #include "InitializeThreading.h"
 
+#include "ExecutableAllocator.h"
 #include "Heap.h"
 #include "Identifier.h"
@@ -35 +36 @@
 #include "UString.h"
 #include "WriteBarrier.h"
+#include "dtoa.h"
 #include <wtf/DateMath.h>
 #include <wtf/Threading.h>
@@ -55 +57 @@
 #endif
     JSGlobalData::storeVPtrs();
+    ExecutableAllocator::initializeAllocator();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     RegisterFile::initializeThreading();

trunk/Source/JavaScriptCore/runtime/JSGlobalData.cpp

@@ -187 +187 @@
 #if ENABLE(ASSEMBLER)
     , executableAllocator(*this)
-    , regexAllocator(*this)
 #endif
     , lexer(new Lexer(this))
@@ -441 +440 @@
 {
     interpreter->dumpSampleData(exec);
+#if ENABLE(ASSEMBLER)
+    ExecutableAllocator::dumpProfile();
+#endif
 }
 

trunk/Source/JavaScriptCore/runtime/JSGlobalData.h

@@ -194 +194 @@
 #if ENABLE(ASSEMBLER)
         ExecutableAllocator executableAllocator;
-        ExecutableAllocator regexAllocator;
 #endif
 
@@ -217 +216 @@
 #if ENABLE(JIT)
         OwnPtr<JITThunks> jitStubs;
-        MacroAssemblerCodePtr getCTIStub(ThunkGenerator generator)
+        MacroAssemblerCodeRef getCTIStub(ThunkGenerator generator)
         {
             return jitStubs->ctiStub(this, generator);

trunk/Source/JavaScriptCore/wtf/CMakeLists.txt

@@ -43 +43 @@
     MathExtras.h
     MessageQueue.h
+    MetaAllocator.cpp
+    MetaAllocator.h
+    MetaAllocatorHandle.h
     NonCopyingSort.h
     ThreadRestrictionVerifier.h
@@ -70 +73 @@
     RandomNumber.h
     RandomNumberSeed.h
+    RedBlackTree.h
     RefCounted.h
     RefCountedLeakCounter.h

trunk/Source/JavaScriptCore/wtf/wtf.pri

@@ -23 +23 @@
     wtf/MD5.cpp \
     wtf/MainThread.cpp \
+    wtf/MetaAllocator.cpp \
     wtf/NullPtr.cpp \
     wtf/OSRandomSource.cpp \

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -2430 +2430 @@
 
         // Link & finalize the code.
-        LinkBuffer linkBuffer(*globalData, this, globalData->regexAllocator);
+        LinkBuffer linkBuffer(*globalData, this);
         m_backtrackingState.linkDataLabels(linkBuffer);
         jitObject.set(linkBuffer.finalizeCode());

trunk/Source/JavaScriptCore/yarr/YarrJIT.h

@@ -66 +66 @@
     int execute(const UChar* input, unsigned start, unsigned length, int* output)
     {
-        return reinterpret_cast<YarrJITCode>(m_ref.m_code.executableAddress())(input, start, length, output);
+        return reinterpret_cast<YarrJITCode>(m_ref.code().executableAddress())(input, start, length, output);
     }
 
 #if ENABLE(REGEXP_TRACING)
-    void *getAddr() { return m_ref.m_code.executableAddress(); }
+    void *getAddr() { return m_ref.code().executableAddress(); }
 #endif
 

trunk/Source/JavaScriptGlue/ChangeLog

@@ +1 @@
+2011-08-18  Filip Pizlo  <fpizlo@apple.com>
+
+        The executable allocator makes it difficult to free individual
+        chunks of executable memory
+        https://bugs.webkit.org/show_bug.cgi?id=66363
+
+        Reviewed by Oliver Hunt.
+        
+        Introduced a best-fit, balanced-tree based allocator. The allocator
+        required a balanced tree that does not allocate memory and that
+        permits the removal of individual nodes directly (as opposed to by
+        key); neither AVLTree nor WebCore's PODRedBlackTree supported this.
+        Changed all references to executable code to use a reference counted
+        handle.
+
+        * ForwardingHeaders/wtf/MetaAllocatorHandle.h: Added.
+
 2011-09-09  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-09-01  Filip Pizlo  <fpizlo@apple.com>
+
+        The executable allocator makes it difficult to free individual
+        chunks of executable memory
+        https://bugs.webkit.org/show_bug.cgi?id=66363
+
+        Reviewed by Oliver Hunt.
+        
+        Introduced a best-fit, balanced-tree based allocator. The allocator
+        required a balanced tree that does not allocate memory and that
+        permits the removal of individual nodes directly (as opposed to by
+        key); neither AVLTree nor WebCore's PODRedBlackTree supported this.
+        Changed all references to executable code to use a reference counted
+        handle.
+
+        No new layout tests because behavior is not changed.  New API unit
+        tests:
+        Tests/WTF/RedBlackTree.cpp
+        Tests/WTF/MetaAllocator.cpp
+
+        * ForwardingHeaders/wtf/MetaAllocatorHandle.h: Added.
+
 2011-09-10  Sam Weinig  <sam@webkit.org>
 

trunk/Tools/ChangeLog

@@ +1 @@
+2011-09-01  Filip Pizlo  <fpizlo@apple.com>
+
+        The executable allocator makes it difficult to free individual
+        chunks of executable memory
+        https://bugs.webkit.org/show_bug.cgi?id=66363
+
+        Reviewed by Oliver Hunt.
+        
+        Introduced a best-fit, balanced-tree based allocator. The allocator
+        required a balanced tree that does not allocate memory and that
+        permits the removal of individual nodes directly (as opposed to by
+        key); neither AVLTree nor WebCore's PODRedBlackTree supported this.
+        Changed all references to executable code to use a reference counted
+        handle.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WTF/MetaAllocator.cpp: Added.
+        (TestWebKitAPI::TEST_F):
+        * TestWebKitAPI/Tests/WTF/RedBlackTree.cpp: Added.
+        (TestWebKitAPI::Pair::findExact):
+        (TestWebKitAPI::Pair::remove):
+        (TestWebKitAPI::Pair::findLeastGreaterThanOrEqual):
+        (TestWebKitAPI::Pair::assertFoundAndRemove):
+        (TestWebKitAPI::Pair::assertEqual):
+        (TestWebKitAPI::Pair::assertSameValuesForKey):
+        (TestWebKitAPI::Pair::testDriver):
+        (TestWebKitAPI::TEST_F):
+
 2011-09-10  Andy Estes  <aestes@apple.com>
 

trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

@@ -8 +8 @@
 
 /* Begin PBXBuildFile section */
+                0FC6C4CC141027E0005B7F0C /* RedBlackTree.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC6C4CB141027E0005B7F0C /* RedBlackTree.cpp */; };
+                0FC6C4CF141034AD005B7F0C /* MetaAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FC6C4CE141034AD005B7F0C /* MetaAllocator.cpp */; };
                 1A02C84F125D4A8400E3F4BD /* Find.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A02C84E125D4A8400E3F4BD /* Find.cpp */; };
                 1A02C870125D4CFD00E3F4BD /* find.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 1A02C84B125D4A5E00E3F4BD /* find.html */; };
@@ -131 +133 @@
 
 /* Begin PBXFileReference section */
+                0FC6C4CB141027E0005B7F0C /* RedBlackTree.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RedBlackTree.cpp; path = WTF/RedBlackTree.cpp; sourceTree = "<group>"; };
+                0FC6C4CE141034AD005B7F0C /* MetaAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = MetaAllocator.cpp; path = WTF/MetaAllocator.cpp; sourceTree = "<group>"; };
                 1A02C84B125D4A5E00E3F4BD /* find.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = find.html; sourceTree = "<group>"; };
                 1A02C84E125D4A8400E3F4BD /* Find.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Find.cpp; sourceTree = "<group>"; };
@@ -368 +372 @@
                         isa = PBXGroup;
                         children = (
+                                0FC6C4CE141034AD005B7F0C /* MetaAllocator.cpp */,
+                                0FC6C4CB141027E0005B7F0C /* RedBlackTree.cpp */,
                                 A7A966DA140ECCC8005EF9B4 /* CheckedArithmeticOperations.cpp */,
                                 C01363C713C3997300EF3964 /* StringOperators.cpp */,
@@ -578 +584 @@
                                 C085880013FEC3A6001EF4E5 /* InstanceMethodSwizzler.mm in Sources */,
                                 37DC678D140D7C5000ABCCDB /* DOMRangeOfString.mm in Sources */,
+                                0FC6C4CC141027E0005B7F0C /* RedBlackTree.cpp in Sources */,
+                                0FC6C4CF141034AD005B7F0C /* MetaAllocator.cpp in Sources */,
                                 A7A966DB140ECCC8005EF9B4 /* CheckedArithmeticOperations.cpp in Sources */,
                                 939BA91714103412001A01BD /* DeviceScaleFactorOnBack.mm in Sources */,