Context Navigation

← Previous Period
Next Period →

Timeline

Mar 31, 2019:

11:51 PM Changeset in webkit [243688] by ysuzuki@apple.com

21 edits in trunk/Source

[JSC] Butterfly allocation from LargeAllocation should try "realloc" behavior if collector thread is not active
https://bugs.webkit.org/show_bug.cgi?id=196160

Reviewed by Saam Barati.

Source/JavaScriptCore:

"realloc" can be effective in terms of peak/current memory footprint when realloc succeeds because,

It does not allocate additional memory while expanding a vector
It does not deallocate an old memory, just reusing the current memory by expanding, so that memory footprint is tight even before scavenging

We found that we can "realloc" large butterflies in certain conditions are met because,

If it goes to LargeAllocation, this memory region is never reused until GC sweeps it.
Butterflies are owned by owner JSObjects, so we know the lifetime of Butterflies.

This patch attempts to use "realloc" onto butterflies if,

Butterflies are allocated in LargeAllocation kind
Concurrent collector is not active
Butterflies do not have property storage

The condition (2) is required to avoid deallocating butterflies while the concurrent collector looks into it. The condition (3) is
also required to avoid deallocating butterflies while the concurrent compiler looks into it.

We also change LargeAllocation mechanism to using "malloc" and "free" instead of "posix_memalign". This allows us to use "realloc"
safely in all the platforms. Since LargeAllocation uses alignment to distinguish LargeAllocation and MarkedBlock, we manually adjust
16B alignment by allocating 8B more memory in "malloc".

Speedometer2 and JetStream2 are neutral. RAMification shows about 1% progression (even in some of JIT tests).

heap/AlignedMemoryAllocator.h:
heap/CompleteSubspace.cpp:

(JSC::CompleteSubspace::tryAllocateSlow):
(JSC::CompleteSubspace::reallocateLargeAllocationNonVirtual):

heap/CompleteSubspace.h:
heap/FastMallocAlignedMemoryAllocator.cpp:

(JSC::FastMallocAlignedMemoryAllocator::tryAllocateMemory):
(JSC::FastMallocAlignedMemoryAllocator::freeMemory):
(JSC::FastMallocAlignedMemoryAllocator::tryReallocateMemory):

heap/FastMallocAlignedMemoryAllocator.h:
heap/GigacageAlignedMemoryAllocator.cpp:

(JSC::GigacageAlignedMemoryAllocator::tryAllocateMemory):
(JSC::GigacageAlignedMemoryAllocator::freeMemory):
(JSC::GigacageAlignedMemoryAllocator::tryReallocateMemory):

heap/GigacageAlignedMemoryAllocator.h:
heap/IsoAlignedMemoryAllocator.cpp:

(JSC::IsoAlignedMemoryAllocator::tryAllocateMemory):
(JSC::IsoAlignedMemoryAllocator::freeMemory):
(JSC::IsoAlignedMemoryAllocator::tryReallocateMemory):

heap/IsoAlignedMemoryAllocator.h:
heap/LargeAllocation.cpp:

(JSC::isAlignedForLargeAllocation):
(JSC::LargeAllocation::tryCreate):
(JSC::LargeAllocation::tryReallocate):
(JSC::LargeAllocation::LargeAllocation):
(JSC::LargeAllocation::destroy):

heap/LargeAllocation.h:

(JSC::LargeAllocation::indexInSpace):
(JSC::LargeAllocation::setIndexInSpace):
(JSC::LargeAllocation::basePointer const):

heap/MarkedSpace.cpp:

(JSC::MarkedSpace::sweepLargeAllocations):
(JSC::MarkedSpace::prepareForConservativeScan):

heap/WeakSet.h:

(JSC::WeakSet::isTriviallyDestructible const):

runtime/Butterfly.h:
runtime/ButterflyInlines.h:

(JSC::Butterfly::reallocArrayRightIfPossible):

runtime/JSObject.cpp:

(JSC::JSObject::ensureLengthSlow):

Source/WTF:

wtf/FastMalloc.h:

(WTF::FastMalloc::tryRealloc):

wtf/Gigacage.cpp:

(Gigacage::tryRealloc):

wtf/Gigacage.h:

11:42 PM Changeset in webkit [243687] by Manuel Rego Casasnovas

3 edits
2 adds in trunk

Scroll position gets reset when overflow:scroll is inside grid
https://bugs.webkit.org/show_bug.cgi?id=196337
<rdar://problem/49385784>

Reviewed by Simon Fraser.

Fix scroll position when there are changes inside a grid item with "overflow: scroll".

Source/WebCore:

Test: fast/css-grid-layout/grid-item-content-scroll-position.html

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::layoutBlock): Use beginUpdateScrollInfoAfterLayoutTransaction()
and endAndCommitUpdateScrollInfoAfterLayoutTransaction().

LayoutTests:

fast/css-grid-layout/grid-item-content-scroll-position-expected.txt: Added.
fast/css-grid-layout/grid-item-content-scroll-position.html: Added.

7:03 PM Changeset in webkit [243686] by rniwa@webkit.org

4 edits in trunk/Source/WebCore

Reduce the size of Node::deref by eliminating an explicit parentNode check
https://bugs.webkit.org/show_bug.cgi?id=195776

Reviewed by Darin Adler.

Address post-commit review comments.

dom/Document.cpp:

(WebCore::Document::removedLastRef):

dom/Node.cpp:

(WebCore::Node::~Node):
(WebCore::Node::removedLastRef):

dom/Node.h:

(WebCore::Node::deref):
(WebCore::Node::setParentNode):

6:38 PM Changeset in webkit [243685] by Fujii Hironori

3 edits in trunk/Tools

[Win][WebKit] MiniBrowser should support high DPI display
https://bugs.webkit.org/show_bug.cgi?id=196391

Reviewed by Alex Christensen.

MiniBrowser/win/WebKitBrowserWindow.cpp:

(WebKitBrowserWindow::WebKitBrowserWindow): Call resetZoom to set the page zoom factor.
(WebKitBrowserWindow::resetZoom): Changed the default page zoom factor from 1 to the device scale factor.

MiniBrowser/win/stdafx.h: Define WEBCORE_EXPORT.

1:01 PM Changeset in webkit [243684] by Wenson Hsieh

3 edits
2 adds in trunk

[iOS] Crash when changing inputmode for certain types of focusable elements
https://bugs.webkit.org/show_bug.cgi?id=196431
<rdar://problem/49454962>

Reviewed by Tim Horton.

Source/WebKit:

The crash is happening because WebPage::focusedElementDidChangeInputMode assumes that the document's focused
element must be the same as m_focusedElement in WebPage. However, this is not the case, since m_focusedElement
is only set for certain types of elements that require user input (e.g. text fields, editable content, select
menus, etc.). The function then attempts to dereference m_focusedElement, which may be null if the document's
focused element doesn't fall into one of the aforementioned categories.

To fix this, bail if the element that is changing inputmode is not equal to the WebPage's current focused
element. See below for more details.

Test: fast/forms/change-inputmode-crash.html

WebProcess/WebPage/WebPage.cpp:

(WebKit::isTextFormControlOrEditableContent):

Clean up some existing logic by introducing a helper method for determining whether an element should
propagate inputmode attribute changes to the UI process. Also, check the element type using type traits instead
of checking against the tag name.

(WebKit::WebPage::elementDidFocus):
(WebKit::WebPage::focusedElementDidChangeInputMode):

LayoutTests:

Add a layout test that exercises the edge case; see WebKit ChangeLogs for more details.

fast/forms/change-inputmode-crash-expected.txt: Added.
fast/forms/change-inputmode-crash.html: Added.

12:29 PM Changeset in webkit [243683] by weinig@apple.com

14 edits in trunk

Remove more i386 specific configurations
https://bugs.webkit.org/show_bug.cgi?id=196430

Reviewed by Alexey Proskuryakov.

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig: