Skip to content

Commit 5a2e209

Browse files
author
Filip Pizlo
committed
Primitive auxiliaries and JSValue auxiliaries should have separate gigacages
https://bugs.webkit.org/show_bug.cgi?id=174919 Reviewed by Keith Miller. Source/bmalloc: This introduces two kinds of Gigacage, Primitive and JSValue. This translates to two kinds of HeapKind, PrimitiveGigacage and JSValueGigacage. The new support functionality required turning Inline.h into BInline.h, and INLINE into BINLINE, and NO_INLINE into BNO_INLINE. * bmalloc.xcodeproj/project.pbxproj: * bmalloc/Allocator.cpp: (bmalloc::Allocator::refillAllocatorSlowCase): (bmalloc::Allocator::refillAllocator): (bmalloc::Allocator::allocateLarge): (bmalloc::Allocator::allocateLogSizeClass): * bmalloc/AsyncTask.h: * bmalloc/BInline.h: Copied from Source/bmalloc/bmalloc/Inline.h. * bmalloc/Cache.cpp: (bmalloc::Cache::tryAllocateSlowCaseNullCache): (bmalloc::Cache::allocateSlowCaseNullCache): (bmalloc::Cache::deallocateSlowCaseNullCache): (bmalloc::Cache::reallocateSlowCaseNullCache): * bmalloc/Deallocator.cpp: * bmalloc/Gigacage.cpp: (Gigacage::PrimitiveDisableCallbacks::PrimitiveDisableCallbacks): (Gigacage::ensureGigacage): (Gigacage::disablePrimitiveGigacage): (Gigacage::addPrimitiveDisableCallback): (Gigacage::removePrimitiveDisableCallback): (Gigacage::Callbacks::Callbacks): Deleted. (Gigacage::disableGigacage): Deleted. (Gigacage::addDisableCallback): Deleted. (Gigacage::removeDisableCallback): Deleted. * bmalloc/Gigacage.h: (Gigacage::name): (Gigacage::basePtr): (Gigacage::forEachKind): (Gigacage::caged): (Gigacage::isCaged): * bmalloc/Heap.cpp: (bmalloc::Heap::Heap): (bmalloc::Heap::usingGigacage): (bmalloc::Heap::gigacageBasePtr): * bmalloc/Heap.h: * bmalloc/HeapKind.h: (bmalloc::isGigacage): (bmalloc::gigacageKind): (bmalloc::heapKind): * bmalloc/Inline.h: Removed. * bmalloc/Map.h: * bmalloc/PerProcess.h: (bmalloc::PerProcess<T>::getFastCase): (bmalloc::PerProcess<T>::get): (bmalloc::PerProcess<T>::getSlowCase): * bmalloc/PerThread.h: (bmalloc::PerThread<T>::getFastCase): * bmalloc/Vector.h: (bmalloc::Vector<T>::push): (bmalloc::Vector<T>::shrinkCapacity): (bmalloc::Vector<T>::growCapacity): Source/JavaScriptCore: This adapts JSC to there being two gigacages. To make matters simpler, this turns AlignedMemoryAllocators into per-VM instances rather than singletons. I don't think we were gaining anything by making them be singletons. This makes it easy to teach GigacageAlignedMemoryAllocator that there are multiple kinds of gigacages. We'll have one of those allocators per cage. From there, this change teaches everyone who previously knew about cages that there are two cages. This means having to specify either Gigacage::Primitive or Gigacage::JSValue. In most places, this is easy: typed arrays are Primitive and butterflies are JSValue. But there are a few places where it's not so obvious, so this change introduces some helpers to make it easy to define what cage you want to use in one place and refer to it abstractly. We do this in DirectArguments and GenericArguments.h A lot of the magic of this change is due to CagedBarrierPtr, which combines AuxiliaryBarrier and CagedPtr. This removes one layer of "get()" calls from a bunch of places. * JavaScriptCore.xcodeproj/project.pbxproj: * bytecode/AccessCase.cpp: (JSC::AccessCase::generateImpl): * dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::emitAllocateRawObject): (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage): (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage): (JSC::DFG::SpeculativeJIT::compileNewTypedArray): (JSC::DFG::SpeculativeJIT::emitAllocateButterfly): * ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly): (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage): (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray): (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname): (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject): (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl): (JSC::FTL::DFG::LowerDFGToB3::allocateJSArray): (JSC::FTL::DFG::LowerDFGToB3::caged): * heap/FastMallocAlignedMemoryAllocator.cpp: (JSC::FastMallocAlignedMemoryAllocator::instance): Deleted. * heap/FastMallocAlignedMemoryAllocator.h: * heap/GigacageAlignedMemoryAllocator.cpp: (JSC::GigacageAlignedMemoryAllocator::GigacageAlignedMemoryAllocator): (JSC::GigacageAlignedMemoryAllocator::tryAllocateAlignedMemory): (JSC::GigacageAlignedMemoryAllocator::freeAlignedMemory): (JSC::GigacageAlignedMemoryAllocator::dump const): (JSC::GigacageAlignedMemoryAllocator::instance): Deleted. * heap/GigacageAlignedMemoryAllocator.h: * jsc.cpp: (primitiveGigacageDisabled): (jscmain): (gigacageDisabled): Deleted. * llint/LowLevelInterpreter64.asm: * runtime/ArrayBuffer.cpp: (JSC::ArrayBufferContents::tryAllocate): (JSC::ArrayBuffer::createAdopted): (JSC::ArrayBuffer::createFromBytes): * runtime/AuxiliaryBarrier.h: * runtime/ButterflyInlines.h: (JSC::Butterfly::createUninitialized): (JSC::Butterfly::tryCreate): (JSC::Butterfly::growArrayRight): * runtime/CagedBarrierPtr.h: Added. (JSC::CagedBarrierPtr::CagedBarrierPtr): (JSC::CagedBarrierPtr::clear): (JSC::CagedBarrierPtr::set): (JSC::CagedBarrierPtr::get const): (JSC::CagedBarrierPtr::getMayBeNull const): (JSC::CagedBarrierPtr::operator== const): (JSC::CagedBarrierPtr::operator!= const): (JSC::CagedBarrierPtr::operator bool const): (JSC::CagedBarrierPtr::setWithoutBarrier): (JSC::CagedBarrierPtr::operator* const): (JSC::CagedBarrierPtr::operator-> const): (JSC::CagedBarrierPtr::operator[] const): * runtime/DirectArguments.cpp: (JSC::DirectArguments::overrideThings): (JSC::DirectArguments::unmapArgument): * runtime/DirectArguments.h: (JSC::DirectArguments::isMappedArgument const): * runtime/GenericArguments.h: * runtime/GenericArgumentsInlines.h: (JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor): (JSC::GenericArguments<Type>::setModifiedArgumentDescriptor): (JSC::GenericArguments<Type>::isModifiedArgumentDescriptor): * runtime/HashMapImpl.cpp: (JSC::HashMapImpl<HashMapBucket>::visitChildren): * runtime/HashMapImpl.h: (JSC::HashMapBuffer::create): (JSC::HashMapImpl::buffer const): (JSC::HashMapImpl::rehash): * runtime/JSArray.cpp: (JSC::JSArray::tryCreateUninitializedRestricted): (JSC::JSArray::unshiftCountSlowCase): (JSC::JSArray::setLength): (JSC::JSArray::pop): (JSC::JSArray::push): (JSC::JSArray::fastSlice): (JSC::JSArray::shiftCountWithArrayStorage): (JSC::JSArray::shiftCountWithAnyIndexingType): (JSC::JSArray::unshiftCountWithAnyIndexingType): (JSC::JSArray::fillArgList): (JSC::JSArray::copyToArguments): * runtime/JSArray.h: (JSC::JSArray::tryCreate): * runtime/JSArrayBufferView.cpp: (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext): (JSC::JSArrayBufferView::finalize): * runtime/JSLock.cpp: (JSC::JSLock::didAcquireLock): * runtime/JSObject.cpp: (JSC::JSObject::heapSnapshot): (JSC::JSObject::getOwnPropertySlotByIndex): (JSC::JSObject::putByIndex): (JSC::JSObject::enterDictionaryIndexingMode): (JSC::JSObject::createInitialIndexedStorage): (JSC::JSObject::createArrayStorage): (JSC::JSObject::convertUndecidedToInt32): (JSC::JSObject::convertUndecidedToDouble): (JSC::JSObject::convertUndecidedToContiguous): (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements): (JSC::JSObject::convertUndecidedToArrayStorage): (JSC::JSObject::convertInt32ToDouble): (JSC::JSObject::convertInt32ToContiguous): (JSC::JSObject::convertInt32ToArrayStorage): (JSC::JSObject::convertDoubleToContiguous): (JSC::JSObject::convertDoubleToArrayStorage): (JSC::JSObject::convertContiguousToArrayStorage): (JSC::JSObject::setIndexQuicklyToUndecided): (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode): (JSC::JSObject::deletePropertyByIndex): (JSC::JSObject::getOwnPropertyNames): (JSC::JSObject::putIndexedDescriptor): (JSC::JSObject::defineOwnIndexedProperty): (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes): (JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength): (JSC::JSObject::getNewVectorLength): (JSC::JSObject::ensureLengthSlow): (JSC::JSObject::reallocateAndShrinkButterfly): (JSC::JSObject::allocateMoreOutOfLineStorage): (JSC::JSObject::getEnumerableLength): * runtime/JSObject.h: (JSC::JSObject::getArrayLength const): (JSC::JSObject::getVectorLength): (JSC::JSObject::putDirectIndex): (JSC::JSObject::canGetIndexQuickly): (JSC::JSObject::getIndexQuickly): (JSC::JSObject::tryGetIndexQuickly const): (JSC::JSObject::canSetIndexQuickly): (JSC::JSObject::setIndexQuickly): (JSC::JSObject::initializeIndex): (JSC::JSObject::initializeIndexWithoutBarrier): (JSC::JSObject::hasSparseMap): (JSC::JSObject::inSparseIndexingMode): (JSC::JSObject::butterfly const): (JSC::JSObject::butterfly): (JSC::JSObject::outOfLineStorage const): (JSC::JSObject::outOfLineStorage): (JSC::JSObject::ensureInt32): (JSC::JSObject::ensureDouble): (JSC::JSObject::ensureContiguous): (JSC::JSObject::ensureArrayStorage): (JSC::JSObject::arrayStorage): (JSC::JSObject::arrayStorageOrNull): (JSC::JSObject::ensureLength): * runtime/RegExpMatchesArray.h: (JSC::tryCreateUninitializedRegExpMatchesArray): * runtime/VM.cpp: (JSC::VM::VM): (JSC::VM::~VM): (JSC::VM::primitiveGigacageDisabledCallback): (JSC::VM::primitiveGigacageDisabled): (JSC::VM::gigacageDisabledCallback): Deleted. (JSC::VM::gigacageDisabled): Deleted. * runtime/VM.h: (JSC::VM::gigacageAuxiliarySpace): (JSC::VM::firePrimitiveGigacageEnabledIfNecessary): (JSC::VM::primitiveGigacageEnabled): (JSC::VM::fireGigacageEnabledIfNecessary): Deleted. (JSC::VM::gigacageEnabled): Deleted. * wasm/WasmMemory.cpp: (JSC::Wasm::Memory::create): (JSC::Wasm::Memory::~Memory): (JSC::Wasm::Memory::grow): Source/WebCore: No new tests because no change in behavior. Adapting to API changes - we now specify the AlignedMemoryAllocator differently and we need to be specific about which Gigacage we're using. * bindings/js/WebCoreJSClientData.cpp: (WebCore::JSVMClientData::JSVMClientData): * platform/graphics/cocoa/GPUBufferMetal.mm: (WebCore::GPUBuffer::GPUBuffer): Source/WebKit: The disable callback is all about the primitive gigacage. * WebProcess/WebProcess.cpp: (WebKit::primitiveGigacageDisabled): (WebKit::m_webSQLiteDatabaseTracker): (WebKit::gigacageDisabled): Deleted. Source/WTF: This mirrors the changes from bmalloc/Gigacage.h. Also it teaches CagedPtr how to reason about multiple gigacages. * wtf/CagedPtr.h: (WTF::CagedPtr::get const): (WTF::CagedPtr::operator[] const): * wtf/Gigacage.cpp: (Gigacage::tryMalloc): (Gigacage::tryAllocateVirtualPages): (Gigacage::freeVirtualPages): (Gigacage::tryAlignedMalloc): (Gigacage::alignedFree): (Gigacage::free): * wtf/Gigacage.h: (Gigacage::disablePrimitiveGigacage): (Gigacage::addPrimitiveDisableCallback): (Gigacage::removePrimitiveDisableCallback): (Gigacage::name): (Gigacage::basePtr): (Gigacage::caged): (Gigacage::isCaged): (Gigacage::tryAlignedMalloc): (Gigacage::alignedFree): (Gigacage::free): (Gigacage::disableGigacage): Deleted. (Gigacage::addDisableCallback): Deleted. (Gigacage::removeDisableCallback): Deleted. Canonical link: https://commits.webkit.org/192001@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@220352 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent 1134dde commit 5a2e209

56 files changed

Lines changed: 903 additions & 355 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,192 @@
1+
2017-08-06 Filip Pizlo <fpizlo@apple.com>
2+
3+
Primitive auxiliaries and JSValue auxiliaries should have separate gigacages
4+
https://bugs.webkit.org/show_bug.cgi?id=174919
5+
6+
Reviewed by Keith Miller.
7+
8+
This adapts JSC to there being two gigacages.
9+
10+
To make matters simpler, this turns AlignedMemoryAllocators into per-VM instances rather than
11+
singletons. I don't think we were gaining anything by making them be singletons.
12+
13+
This makes it easy to teach GigacageAlignedMemoryAllocator that there are multiple kinds of
14+
gigacages. We'll have one of those allocators per cage.
15+
16+
From there, this change teaches everyone who previously knew about cages that there are two cages.
17+
This means having to specify either Gigacage::Primitive or Gigacage::JSValue. In most places, this is
18+
easy: typed arrays are Primitive and butterflies are JSValue. But there are a few places where it's
19+
not so obvious, so this change introduces some helpers to make it easy to define what cage you want
20+
to use in one place and refer to it abstractly. We do this in DirectArguments and GenericArguments.h
21+
22+
A lot of the magic of this change is due to CagedBarrierPtr, which combines AuxiliaryBarrier and
23+
CagedPtr. This removes one layer of "get()" calls from a bunch of places.
24+
25+
* JavaScriptCore.xcodeproj/project.pbxproj:
26+
* bytecode/AccessCase.cpp:
27+
(JSC::AccessCase::generateImpl):
28+
* dfg/DFGSpeculativeJIT.cpp:
29+
(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
30+
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
31+
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
32+
(JSC::DFG::SpeculativeJIT::compileNewTypedArray):
33+
(JSC::DFG::SpeculativeJIT::emitAllocateButterfly):
34+
* ftl/FTLLowerDFGToB3.cpp:
35+
(JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly):
36+
(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
37+
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
38+
(JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
39+
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
40+
(JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorageWithSizeImpl):
41+
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
42+
(JSC::FTL::DFG::LowerDFGToB3::caged):
43+
* heap/FastMallocAlignedMemoryAllocator.cpp:
44+
(JSC::FastMallocAlignedMemoryAllocator::instance): Deleted.
45+
* heap/FastMallocAlignedMemoryAllocator.h:
46+
* heap/GigacageAlignedMemoryAllocator.cpp:
47+
(JSC::GigacageAlignedMemoryAllocator::GigacageAlignedMemoryAllocator):
48+
(JSC::GigacageAlignedMemoryAllocator::tryAllocateAlignedMemory):
49+
(JSC::GigacageAlignedMemoryAllocator::freeAlignedMemory):
50+
(JSC::GigacageAlignedMemoryAllocator::dump const):
51+
(JSC::GigacageAlignedMemoryAllocator::instance): Deleted.
52+
* heap/GigacageAlignedMemoryAllocator.h:
53+
* jsc.cpp:
54+
(primitiveGigacageDisabled):
55+
(jscmain):
56+
(gigacageDisabled): Deleted.
57+
* llint/LowLevelInterpreter64.asm:
58+
* runtime/ArrayBuffer.cpp:
59+
(JSC::ArrayBufferContents::tryAllocate):
60+
(JSC::ArrayBuffer::createAdopted):
61+
(JSC::ArrayBuffer::createFromBytes):
62+
* runtime/AuxiliaryBarrier.h:
63+
* runtime/ButterflyInlines.h:
64+
(JSC::Butterfly::createUninitialized):
65+
(JSC::Butterfly::tryCreate):
66+
(JSC::Butterfly::growArrayRight):
67+
* runtime/CagedBarrierPtr.h: Added.
68+
(JSC::CagedBarrierPtr::CagedBarrierPtr):
69+
(JSC::CagedBarrierPtr::clear):
70+
(JSC::CagedBarrierPtr::set):
71+
(JSC::CagedBarrierPtr::get const):
72+
(JSC::CagedBarrierPtr::getMayBeNull const):
73+
(JSC::CagedBarrierPtr::operator== const):
74+
(JSC::CagedBarrierPtr::operator!= const):
75+
(JSC::CagedBarrierPtr::operator bool const):
76+
(JSC::CagedBarrierPtr::setWithoutBarrier):
77+
(JSC::CagedBarrierPtr::operator* const):
78+
(JSC::CagedBarrierPtr::operator-> const):
79+
(JSC::CagedBarrierPtr::operator[] const):
80+
* runtime/DirectArguments.cpp:
81+
(JSC::DirectArguments::overrideThings):
82+
(JSC::DirectArguments::unmapArgument):
83+
* runtime/DirectArguments.h:
84+
(JSC::DirectArguments::isMappedArgument const):
85+
* runtime/GenericArguments.h:
86+
* runtime/GenericArgumentsInlines.h:
87+
(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
88+
(JSC::GenericArguments<Type>::setModifiedArgumentDescriptor):
89+
(JSC::GenericArguments<Type>::isModifiedArgumentDescriptor):
90+
* runtime/HashMapImpl.cpp:
91+
(JSC::HashMapImpl<HashMapBucket>::visitChildren):
92+
* runtime/HashMapImpl.h:
93+
(JSC::HashMapBuffer::create):
94+
(JSC::HashMapImpl::buffer const):
95+
(JSC::HashMapImpl::rehash):
96+
* runtime/JSArray.cpp:
97+
(JSC::JSArray::tryCreateUninitializedRestricted):
98+
(JSC::JSArray::unshiftCountSlowCase):
99+
(JSC::JSArray::setLength):
100+
(JSC::JSArray::pop):
101+
(JSC::JSArray::push):
102+
(JSC::JSArray::fastSlice):
103+
(JSC::JSArray::shiftCountWithArrayStorage):
104+
(JSC::JSArray::shiftCountWithAnyIndexingType):
105+
(JSC::JSArray::unshiftCountWithAnyIndexingType):
106+
(JSC::JSArray::fillArgList):
107+
(JSC::JSArray::copyToArguments):
108+
* runtime/JSArray.h:
109+
(JSC::JSArray::tryCreate):
110+
* runtime/JSArrayBufferView.cpp:
111+
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
112+
(JSC::JSArrayBufferView::finalize):
113+
* runtime/JSLock.cpp:
114+
(JSC::JSLock::didAcquireLock):
115+
* runtime/JSObject.cpp:
116+
(JSC::JSObject::heapSnapshot):
117+
(JSC::JSObject::getOwnPropertySlotByIndex):
118+
(JSC::JSObject::putByIndex):
119+
(JSC::JSObject::enterDictionaryIndexingMode):
120+
(JSC::JSObject::createInitialIndexedStorage):
121+
(JSC::JSObject::createArrayStorage):
122+
(JSC::JSObject::convertUndecidedToInt32):
123+
(JSC::JSObject::convertUndecidedToDouble):
124+
(JSC::JSObject::convertUndecidedToContiguous):
125+
(JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
126+
(JSC::JSObject::convertUndecidedToArrayStorage):
127+
(JSC::JSObject::convertInt32ToDouble):
128+
(JSC::JSObject::convertInt32ToContiguous):
129+
(JSC::JSObject::convertInt32ToArrayStorage):
130+
(JSC::JSObject::convertDoubleToContiguous):
131+
(JSC::JSObject::convertDoubleToArrayStorage):
132+
(JSC::JSObject::convertContiguousToArrayStorage):
133+
(JSC::JSObject::setIndexQuicklyToUndecided):
134+
(JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
135+
(JSC::JSObject::deletePropertyByIndex):
136+
(JSC::JSObject::getOwnPropertyNames):
137+
(JSC::JSObject::putIndexedDescriptor):
138+
(JSC::JSObject::defineOwnIndexedProperty):
139+
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
140+
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
141+
(JSC::JSObject::getNewVectorLength):
142+
(JSC::JSObject::ensureLengthSlow):
143+
(JSC::JSObject::reallocateAndShrinkButterfly):
144+
(JSC::JSObject::allocateMoreOutOfLineStorage):
145+
(JSC::JSObject::getEnumerableLength):
146+
* runtime/JSObject.h:
147+
(JSC::JSObject::getArrayLength const):
148+
(JSC::JSObject::getVectorLength):
149+
(JSC::JSObject::putDirectIndex):
150+
(JSC::JSObject::canGetIndexQuickly):
151+
(JSC::JSObject::getIndexQuickly):
152+
(JSC::JSObject::tryGetIndexQuickly const):
153+
(JSC::JSObject::canSetIndexQuickly):
154+
(JSC::JSObject::setIndexQuickly):
155+
(JSC::JSObject::initializeIndex):
156+
(JSC::JSObject::initializeIndexWithoutBarrier):
157+
(JSC::JSObject::hasSparseMap):
158+
(JSC::JSObject::inSparseIndexingMode):
159+
(JSC::JSObject::butterfly const):
160+
(JSC::JSObject::butterfly):
161+
(JSC::JSObject::outOfLineStorage const):
162+
(JSC::JSObject::outOfLineStorage):
163+
(JSC::JSObject::ensureInt32):
164+
(JSC::JSObject::ensureDouble):
165+
(JSC::JSObject::ensureContiguous):
166+
(JSC::JSObject::ensureArrayStorage):
167+
(JSC::JSObject::arrayStorage):
168+
(JSC::JSObject::arrayStorageOrNull):
169+
(JSC::JSObject::ensureLength):
170+
* runtime/RegExpMatchesArray.h:
171+
(JSC::tryCreateUninitializedRegExpMatchesArray):
172+
* runtime/VM.cpp:
173+
(JSC::VM::VM):
174+
(JSC::VM::~VM):
175+
(JSC::VM::primitiveGigacageDisabledCallback):
176+
(JSC::VM::primitiveGigacageDisabled):
177+
(JSC::VM::gigacageDisabledCallback): Deleted.
178+
(JSC::VM::gigacageDisabled): Deleted.
179+
* runtime/VM.h:
180+
(JSC::VM::gigacageAuxiliarySpace):
181+
(JSC::VM::firePrimitiveGigacageEnabledIfNecessary):
182+
(JSC::VM::primitiveGigacageEnabled):
183+
(JSC::VM::fireGigacageEnabledIfNecessary): Deleted.
184+
(JSC::VM::gigacageEnabled): Deleted.
185+
* wasm/WasmMemory.cpp:
186+
(JSC::Wasm::Memory::create):
187+
(JSC::Wasm::Memory::~Memory):
188+
(JSC::Wasm::Memory::grow):
189+
1190
2017-08-07 Commit Queue <commit-queue@webkit.org>
2191

3192
Unreviewed, rolling out r220144.

‎Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -898,6 +898,7 @@
898898
0FEC3C571F33A45300F59B6C /* FastMallocAlignedMemoryAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC3C551F33A45300F59B6C /* FastMallocAlignedMemoryAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
899899
0FEC3C5A1F33A48900F59B6C /* GigacageAlignedMemoryAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC3C581F33A48900F59B6C /* GigacageAlignedMemoryAllocator.cpp */; };
900900
0FEC3C5B1F33A48900F59B6C /* GigacageAlignedMemoryAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC3C591F33A48900F59B6C /* GigacageAlignedMemoryAllocator.h */; };
901+
0FEC3C601F379F5300F59B6C /* CagedBarrierPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC3C5F1F379F5300F59B6C /* CagedBarrierPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
901902
0FEC84FE1BDACDAC0080FF74 /* B3ArgumentRegValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84B41BDACDAC0080FF74 /* B3ArgumentRegValue.cpp */; };
902903
0FEC84FF1BDACDAC0080FF74 /* B3ArgumentRegValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEC84B51BDACDAC0080FF74 /* B3ArgumentRegValue.h */; };
903904
0FEC85001BDACDAC0080FF74 /* B3BasicBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FEC84B61BDACDAC0080FF74 /* B3BasicBlock.cpp */; };
@@ -3496,6 +3497,7 @@
34963497
0FEC3C551F33A45300F59B6C /* FastMallocAlignedMemoryAllocator.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = FastMallocAlignedMemoryAllocator.h; sourceTree = "<group>"; };
34973498
0FEC3C581F33A48900F59B6C /* GigacageAlignedMemoryAllocator.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = GigacageAlignedMemoryAllocator.cpp; sourceTree = "<group>"; };
34983499
0FEC3C591F33A48900F59B6C /* GigacageAlignedMemoryAllocator.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GigacageAlignedMemoryAllocator.h; sourceTree = "<group>"; };
3500+
0FEC3C5F1F379F5300F59B6C /* CagedBarrierPtr.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = CagedBarrierPtr.h; sourceTree = "<group>"; };
34993501
0FEC84B41BDACDAC0080FF74 /* B3ArgumentRegValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3ArgumentRegValue.cpp; path = b3/B3ArgumentRegValue.cpp; sourceTree = "<group>"; };
35003502
0FEC84B51BDACDAC0080FF74 /* B3ArgumentRegValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3ArgumentRegValue.h; path = b3/B3ArgumentRegValue.h; sourceTree = "<group>"; };
35013503
0FEC84B61BDACDAC0080FF74 /* B3BasicBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3BasicBlock.cpp; path = b3/B3BasicBlock.cpp; sourceTree = "<group>"; };
@@ -6622,6 +6624,7 @@
66226624
9E729409190F0306001A91B5 /* BundlePath.mm */,
66236625
0FB7F38B15ED8E3800F167B2 /* Butterfly.h */,
66246626
0FB7F38C15ED8E3800F167B2 /* ButterflyInlines.h */,
6627+
0FEC3C5F1F379F5300F59B6C /* CagedBarrierPtr.h */,
66256628
BCA62DFE0E2826230004F30D /* CallData.cpp */,
66266629
145C507F0D9DF63B0088F6B9 /* CallData.h */,
66276630
FE80C1981D775FB4008510C0 /* CatchScope.cpp */,
@@ -8639,6 +8642,7 @@
86398642
0FB14E2318130955009B6B4D /* DFGInlineCacheWrapperInlines.h in Headers */,
86408643
A704D90617A0BAA8006BA554 /* DFGInPlaceAbstractState.h in Headers */,
86418644
0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */,
8645+
0FEC3C601F379F5300F59B6C /* CagedBarrierPtr.h in Headers */,
86428646
0F300B7C18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h in Headers */,
86438647
0F898F321B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h in Headers */,
86448648
0FC97F3E18202119002C9B26 /* DFGInvalidationPointInjectionPhase.h in Headers */,

‎Source/JavaScriptCore/bytecode/AccessCase.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -858,7 +858,7 @@ void AccessCase::generateImpl(AccessGenerationState& state)
858858
size_t newSize = newStructure()->outOfLineCapacity() * sizeof(JSValue);
859859

860860
if (allocatingInline) {
861-
MarkedAllocator* allocator = vm.auxiliarySpace.allocatorFor(newSize);
861+
MarkedAllocator* allocator = vm.jsValueGigacageAuxiliarySpace.allocatorFor(newSize);
862862

863863
if (!allocator) {
864864
// Yuck, this case would suck!

‎Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ void SpeculativeJIT::emitAllocateRawObject(GPRReg resultGPR, RegisteredStructure
109109
m_jit.move(TrustedImmPtr(0), storageGPR);
110110

111111
if (size) {
112-
if (MarkedAllocator* allocator = m_jit.vm()->auxiliarySpace.allocatorFor(size)) {
112+
if (MarkedAllocator* allocator = m_jit.vm()->jsValueGigacageAuxiliarySpace.allocatorFor(size)) {
113113
m_jit.move(TrustedImmPtr(allocator), scratchGPR);
114114
m_jit.emitAllocate(storageGPR, allocator, scratchGPR, scratch2GPR, slowCases);
115115

@@ -7868,7 +7868,7 @@ void SpeculativeJIT::compileAllocatePropertyStorage(Node* node)
78687868

78697869
size_t size = initialOutOfLineCapacity * sizeof(JSValue);
78707870

7871-
MarkedAllocator* allocator = m_jit.vm()->auxiliarySpace.allocatorFor(size);
7871+
MarkedAllocator* allocator = m_jit.vm()->jsValueGigacageAuxiliarySpace.allocatorFor(size);
78727872

78737873
if (!allocator || node->transition()->previous->couldHaveIndexingHeader()) {
78747874
SpeculateCellOperand base(this, node->child1());
@@ -7913,7 +7913,7 @@ void SpeculativeJIT::compileReallocatePropertyStorage(Node* node)
79137913
size_t newSize = oldSize * outOfLineGrowthFactor;
79147914
ASSERT(newSize == node->transition()->next->outOfLineCapacity() * sizeof(JSValue));
79157915

7916-
MarkedAllocator* allocator = m_jit.vm()->auxiliarySpace.allocatorFor(newSize);
7916+
MarkedAllocator* allocator = m_jit.vm()->jsValueGigacageAuxiliarySpace.allocatorFor(newSize);
79177917

79187918
if (!allocator || node->transition()->previous->couldHaveIndexingHeader()) {
79197919
SpeculateCellOperand base(this, node->child1());
@@ -8494,7 +8494,7 @@ void SpeculativeJIT::compileNewTypedArray(Node* node)
84948494
m_jit.and32(TrustedImm32(~7), scratchGPR);
84958495
}
84968496
m_jit.emitAllocateVariableSized(
8497-
storageGPR, m_jit.vm()->auxiliarySpace, scratchGPR, scratchGPR,
8497+
storageGPR, m_jit.vm()->primitiveGigacageAuxiliarySpace, scratchGPR, scratchGPR,
84988498
scratchGPR2, slowCases);
84998499

85008500
MacroAssembler::Jump done = m_jit.branchTest32(MacroAssembler::Zero, sizeGPR);
@@ -10112,7 +10112,7 @@ void SpeculativeJIT::emitAllocateButterfly(GPRReg storageResultGPR, GPRReg sizeG
1011210112
m_jit.lshift32(TrustedImm32(3), scratch1);
1011310113
m_jit.add32(TrustedImm32(sizeof(IndexingHeader)), scratch1, scratch2);
1011410114
m_jit.emitAllocateVariableSized(
10115-
storageResultGPR, m_jit.vm()->auxiliarySpace, scratch2, scratch1, scratch3, slowCases);
10115+
storageResultGPR, m_jit.vm()->jsValueGigacageAuxiliarySpace, scratch2, scratch1, scratch3, slowCases);
1011610116
m_jit.addPtr(TrustedImm32(sizeof(IndexingHeader)), storageResultGPR);
1011710117

1011810118
m_jit.store32(sizeGPR, MacroAssembler::Address(storageResultGPR, Butterfly::offsetOfPublicLength()));

0 commit comments

Comments
 (0)