Skip to content

Commit 484d996

Browse files
ConstellationConstellation
committed
[JSC] Put JSArray in IsoSubspace
https://bugs.webkit.org/show_bug.cgi?id=205049 Reviewed by Mark Lam. Source/JavaScriptCore: Put JSArray in IsoSubspace. * runtime/ArrayPrototype.h: * runtime/JSArray.h: (JSC::JSArray::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/JSDollarVM.cpp: Source/WebCore: RuntimeArray is inheriting JSArray. We should have separate IsoSubspace for this. * bindings/js/WebCoreJSClientData.cpp: (WebCore::JSVMClientData::JSVMClientData): * bindings/js/WebCoreJSClientData.h: (WebCore::JSVMClientData::runtimeArraySpace): * bridge/runtime_array.cpp: (JSC::RuntimeArray::subspaceForImpl): * bridge/runtime_array.h: (JSC::RuntimeArray::create): Deleted. (JSC::RuntimeArray::getLength const): Deleted. (JSC::RuntimeArray::getConcreteArray const): Deleted. (JSC::RuntimeArray::createPrototype): Deleted. (JSC::RuntimeArray::createStructure): Deleted. Canonical link: https://commits.webkit.org/218265@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@253321 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent c6f11e3 commit 484d996

11 files changed

Lines changed: 79 additions & 7 deletions

File tree

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,20 @@
1+
2019-12-10 Yusuke Suzuki <ysuzuki@apple.com>
2+
3+
[JSC] Put JSArray in IsoSubspace
4+
https://bugs.webkit.org/show_bug.cgi?id=205049
5+
6+
Reviewed by Mark Lam.
7+
8+
Put JSArray in IsoSubspace.
9+
10+
* runtime/ArrayPrototype.h:
11+
* runtime/JSArray.h:
12+
(JSC::JSArray::subspaceFor):
13+
* runtime/VM.cpp:
14+
(JSC::VM::VM):
15+
* runtime/VM.h:
16+
* tools/JSDollarVM.cpp:
17+
118
2019-12-09 Mark Lam <mark.lam@apple.com>
219

320
Fix the x86_64 probe so that we can get a full stack trace with libunwind and lldb.

‎Source/JavaScriptCore/runtime/ArrayPrototype.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ class ArrayPrototype final : public JSArray {
2929
ArrayPrototype(VM&, Structure*);
3030

3131
public:
32-
typedef JSArray Base;
32+
using Base = JSArray;
3333

3434
enum class SpeciesWatchpointStatus {
3535
Uninitialized,
@@ -49,6 +49,7 @@ class ArrayPrototype final : public JSArray {
4949
protected:
5050
void finishCreation(VM&, JSGlobalObject*);
5151
};
52+
STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ArrayPrototype, JSArray);
5253

5354
EncodedJSValue JSC_HOST_CALL arrayProtoFuncSpeciesCreate(JSGlobalObject*, CallFrame*);
5455
EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(JSGlobalObject*, CallFrame*);

‎Source/JavaScriptCore/runtime/JSArray.h‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,20 @@ class JSArray : public JSNonFinalObject {
3939
friend class JIT;
4040

4141
public:
42-
typedef JSNonFinalObject Base;
42+
using Base = JSNonFinalObject;
4343
static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
4444

4545
static size_t allocationSize(Checked<size_t> inlineCapacity)
4646
{
4747
ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
4848
return sizeof(JSArray);
4949
}
50+
51+
template<typename CellType, SubspaceAccess mode>
52+
static IsoSubspace* subspaceFor(VM& vm)
53+
{
54+
return &vm.arraySpace;
55+
}
5056

5157
protected:
5258
explicit JSArray(VM& vm, Structure* structure, Butterfly* butterfly)

‎Source/JavaScriptCore/runtime/VM.cpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,7 @@ VM::VM(VMType vmType, HeapType heapType)
331331
, variableSizedCellSpace("Variable Sized JSCell", heap, cellHeapCellType.get(), fastMallocAllocator.get()) // Hash:0xbcd769cc
332332
, destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get()) // Hash:0xbfff3d73
333333
, destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get()) // Hash:0x4f5ed7a9
334+
, arraySpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSArray)
334335
, bigIntSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), JSBigInt)
335336
, calleeSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), JSCallee)
336337
, clonedArgumentsSpace ISO_SUBSPACE_INIT(heap, cellHeapCellType.get(), ClonedArguments)

‎Source/JavaScriptCore/runtime/VM.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,7 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
421421
CompleteSubspace destructibleCellSpace;
422422
CompleteSubspace destructibleObjectSpace;
423423

424+
IsoSubspace arraySpace;
424425
IsoSubspace bigIntSpace;
425426
IsoSubspace calleeSpace;
426427
IsoSubspace clonedArgumentsSpace;

‎Source/JavaScriptCore/tools/JSDollarVM.cpp‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -492,11 +492,17 @@ class CustomGetter : public JSNonFinalObject {
492492
}
493493
};
494494

495-
class RuntimeArray : public JSArray {
495+
class RuntimeArray final : public JSArray {
496496
public:
497-
typedef JSArray Base;
497+
using Base = JSArray;
498498
static constexpr unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero | OverridesGetPropertyNames;
499499

500+
template<typename CellType, SubspaceAccess>
501+
static CompleteSubspace* subspaceFor(VM& vm)
502+
{
503+
return &vm.cellSpace;
504+
}
505+
500506
static RuntimeArray* create(JSGlobalObject* globalObject, CallFrame* callFrame)
501507
{
502508
DollarVMAssertScope assertScope;

‎Source/WebCore/ChangeLog‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,25 @@
1+
2019-12-10 Yusuke Suzuki <ysuzuki@apple.com>
2+
3+
[JSC] Put JSArray in IsoSubspace
4+
https://bugs.webkit.org/show_bug.cgi?id=205049
5+
6+
Reviewed by Mark Lam.
7+
8+
RuntimeArray is inheriting JSArray. We should have separate IsoSubspace for this.
9+
10+
* bindings/js/WebCoreJSClientData.cpp:
11+
(WebCore::JSVMClientData::JSVMClientData):
12+
* bindings/js/WebCoreJSClientData.h:
13+
(WebCore::JSVMClientData::runtimeArraySpace):
14+
* bridge/runtime_array.cpp:
15+
(JSC::RuntimeArray::subspaceForImpl):
16+
* bridge/runtime_array.h:
17+
(JSC::RuntimeArray::create): Deleted.
18+
(JSC::RuntimeArray::getLength const): Deleted.
19+
(JSC::RuntimeArray::getConcreteArray const): Deleted.
20+
(JSC::RuntimeArray::createPrototype): Deleted.
21+
(JSC::RuntimeArray::createStructure): Deleted.
22+
123
2019-12-09 Eric Carlson <eric.carlson@apple.com>
224

325
Rename media in the GPU process preference

‎Source/WebCore/bindings/js/WebCoreJSClientData.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,14 @@
2828

2929
#include "DOMGCOutputConstraint.h"
3030
#include "JSDOMBinding.h"
31+
#include "runtime_array.h"
32+
#include "runtime_method.h"
3133
#include <JavaScriptCore/FastMallocAlignedMemoryAllocator.h>
3234
#include <JavaScriptCore/HeapInlines.h>
3335
#include <JavaScriptCore/JSDestructibleObjectHeapCellType.h>
3436
#include <JavaScriptCore/MarkingConstraint.h>
3537
#include <JavaScriptCore/SubspaceInlines.h>
3638
#include <JavaScriptCore/VM.h>
37-
#include "runtime_method.h"
3839
#include <wtf/MainThread.h>
3940

4041
namespace WebCore {
@@ -43,6 +44,7 @@ using namespace JSC;
4344
JSVMClientData::JSVMClientData(VM& vm)
4445
: m_builtinFunctions(vm)
4546
, m_builtinNames(vm)
47+
, m_runtimeArraySpace ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType.get(), RuntimeArray)
4648
, m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType.get(), RuntimeMethod) // Hash:0xf70c4a85
4749
, m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap, vm.destructibleObjectHeapCellType.get(), vm.fastMallocAllocator.get()) // Hash:0x7724c2e4
4850
, m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, vm.cellHeapCellType.get(), vm.fastMallocAllocator.get()) // Hash:0x522d6ec9

‎Source/WebCore/bindings/js/WebCoreJSClientData.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ class JSVMClientData : public JSC::VM::ClientData {
5959
WebCoreBuiltinNames& builtinNames() { return m_builtinNames; }
6060
JSBuiltinFunctions& builtinFunctions() { return m_builtinFunctions; }
6161

62+
JSC::IsoSubspace& runtimeArraySpace() { return m_runtimeArraySpace; }
6263
JSC::IsoSubspace& runtimeMethodSpace() { return m_runtimeMethodSpace; }
6364

6465
JSC::CompleteSubspace& outputConstraintSpace() { return m_outputConstraintSpace; }
@@ -78,6 +79,7 @@ class JSVMClientData : public JSC::VM::ClientData {
7879
JSBuiltinFunctions m_builtinFunctions;
7980
WebCoreBuiltinNames m_builtinNames;
8081

82+
JSC::IsoSubspace m_runtimeArraySpace;
8183
JSC::IsoSubspace m_runtimeMethodSpace;
8284

8385
JSC::CompleteSubspace m_outputConstraintSpace;

‎Source/WebCore/bridge/runtime_array.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
#include "runtime_array.h"
2828

2929
#include "JSDOMBinding.h"
30+
#include "WebCoreJSClientData.h"
3031
#include <JavaScriptCore/ArrayPrototype.h>
3132
#include <JavaScriptCore/Error.h>
3233
#include <JavaScriptCore/JSGlobalObjectInlines.h>
@@ -158,4 +159,9 @@ bool RuntimeArray::deletePropertyByIndex(JSCell*, JSGlobalObject*, unsigned)
158159
return false;
159160
}
160161

162+
IsoSubspace* RuntimeArray::subspaceForImpl(VM& vm)
163+
{
164+
return &static_cast<JSVMClientData*>(vm.clientData)->runtimeArraySpace();
165+
}
166+
161167
}

0 commit comments

Comments
 (0)