WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
[patch]
it's a start
blah.patch (text/plain), 68.42 KB, created by
Filip Pizlo
on 2015-10-06 10:57:02 PDT
(
hide
)
Description:
it's a start
Filename:
MIME Type:
Creator:
Filip Pizlo
Created:
2015-10-06 10:57:02 PDT
Size:
68.42 KB
patch
obsolete
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj >=================================================================== >--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (revision 190603) >+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (working copy) >@@ -408,6 +408,7 @@ > 0F79085619A290B200F6310C /* DFGStructureRegistrationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F79085419A290B200F6310C /* DFGStructureRegistrationPhase.h */; }; > 0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */; }; > 0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0977E1469EBC400CF2442 /* DFGCommon.h */; settings = {ATTRIBUTES = (Private, ); }; }; >+ 0F7C11AD1BC3862C00C74CDB /* CopyBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7C11AC1BC3862C00C74CDB /* CopyBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8023E91613832300A0BA45 /* ByValInfo.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F8335B71639C1E6001443B5 /* ArrayAllocationProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */; }; > 0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; }; >@@ -931,7 +932,6 @@ > 2A4BB7F318A41179008A0FCD /* JSManagedValueInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A4BB7F218A41179008A0FCD /* JSManagedValueInternal.h */; }; > 2A4EC90B1860D6C20094F782 /* WriteBarrierBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A4EC9091860D6C20094F782 /* WriteBarrierBuffer.cpp */; }; > 2A4EC90C1860D6C20094F782 /* WriteBarrierBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A4EC90A1860D6C20094F782 /* WriteBarrierBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; }; >- 2A68295B1875F80500B6C3E2 /* CopyWriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A68295A1875F80500B6C3E2 /* CopyWriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 2A6F462617E959CE00C45C98 /* HeapOperation.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A6F462517E959CE00C45C98 /* HeapOperation.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 2A7A58EF1808A4C40020BDF7 /* DeferGC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */; }; > 2A83638518D7D0EE0000EBCC /* EdenGCActivityCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */; }; >@@ -2256,6 +2256,7 @@ > 0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = "<group>"; }; > 0F79085319A290B200F6310C /* DFGStructureRegistrationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStructureRegistrationPhase.cpp; path = dfg/DFGStructureRegistrationPhase.cpp; sourceTree = "<group>"; }; > 0F79085419A290B200F6310C /* DFGStructureRegistrationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureRegistrationPhase.h; path = dfg/DFGStructureRegistrationPhase.h; sourceTree = "<group>"; }; >+ 0F7C11AC1BC3862C00C74CDB /* CopyBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyBarrier.h; sourceTree = "<group>"; }; > 0F8023E91613832300A0BA45 /* ByValInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByValInfo.h; sourceTree = "<group>"; }; > 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayAllocationProfile.cpp; sourceTree = "<group>"; }; > 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; }; >@@ -2749,7 +2750,6 @@ > 2A4BB7F218A41179008A0FCD /* JSManagedValueInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSManagedValueInternal.h; sourceTree = "<group>"; }; > 2A4EC9091860D6C20094F782 /* WriteBarrierBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WriteBarrierBuffer.cpp; sourceTree = "<group>"; }; > 2A4EC90A1860D6C20094F782 /* WriteBarrierBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierBuffer.h; sourceTree = "<group>"; }; >- 2A68295A1875F80500B6C3E2 /* CopyWriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyWriteBarrier.h; sourceTree = "<group>"; }; > 2A6F462517E959CE00C45C98 /* HeapOperation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapOperation.h; sourceTree = "<group>"; }; > 2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeferGC.cpp; sourceTree = "<group>"; }; > 2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EdenGCActivityCallback.cpp; sourceTree = "<group>"; }; >@@ -4239,12 +4239,12 @@ > C240305314B404C90079EB64 /* CopiedSpace.cpp */, > C2EAA3F8149A830800FCE112 /* CopiedSpace.h */, > C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlines.h */, >+ 0F7C11AC1BC3862C00C74CDB /* CopyBarrier.h */, > 0F5A52CF17ADD717008ECB2D /* CopyToken.h */, > C2239D1216262BDD005AC5FD /* CopyVisitor.cpp */, > C2239D1316262BDD005AC5FD /* CopyVisitor.h */, > C2239D1416262BDD005AC5FD /* CopyVisitorInlines.h */, > C218D13F1655CFD50062BB81 /* CopyWorkList.h */, >- 2A68295A1875F80500B6C3E2 /* CopyWriteBarrier.h */, > 2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */, > 0F136D4B174AD69B0075B354 /* DeferGC.h */, > 2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */, >@@ -6077,7 +6077,6 @@ > C2239D1816262BDD005AC5FD /* CopyVisitor.h in Headers */, > C2239D1916262BDD005AC5FD /* CopyVisitorInlines.h in Headers */, > C218D1401655CFD50062BB81 /* CopyWorkList.h in Headers */, >- 2A68295B1875F80500B6C3E2 /* CopyWriteBarrier.h in Headers */, > C4F4B6F41A05C944005CAB76 /* cpp_generator.py in Headers */, > C4F4B6F31A05C944005CAB76 /* cpp_generator_templates.py in Headers */, > 5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */, >@@ -6760,6 +6759,7 @@ > 868916B0155F286300CB2B9A /* PrivateName.h in Headers */, > BC18C4500E16F5CD00B34460 /* Profile.h in Headers */, > 95CD45770E1C4FDD0085358E /* ProfileGenerator.h in Headers */, >+ 0F7C11AD1BC3862C00C74CDB /* CopyBarrier.h in Headers */, > BC18C4510E16F5CD00B34460 /* ProfileNode.h in Headers */, > 0FF729A5166AD351000F5BA3 /* ProfilerBytecode.h in Headers */, > 0FF729B9166AD360000F5BA3 /* ProfilerBytecodes.h in Headers */, >Index: Source/JavaScriptCore/heap/CopyBarrier.h >=================================================================== >--- Source/JavaScriptCore/heap/CopyBarrier.h (revision 190603) (from Source/JavaScriptCore/heap/CopyWriteBarrier.h:190603) >+++ Source/JavaScriptCore/heap/CopyBarrier.h (working copy) >@@ -0,0 +1,89 @@ >+/* >+ * Copyright (C) 2014 Apple Inc. All rights reserved. >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' >+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, >+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS >+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR >+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF >+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS >+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN >+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) >+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF >+ * THE POSSIBILITY OF SUCH DAMAGE. >+ */ >+ >+#ifndef CopyWriteBarrier_h >+#define CopyWriteBarrier_h >+ >+#include "Heap.h" >+ >+namespace JSC { >+ >+template <typename T> >+class CopyWriteBarrier { >+public: >+ CopyWriteBarrier() >+ : m_value(0) >+ { >+ } >+ >+ CopyWriteBarrier(VM& vm, const JSCell* owner, T& value) >+ { >+ this->set(vm, owner, &value); >+ } >+ >+ CopyWriteBarrier(VM& vm, const JSCell* owner, T* value) >+ { >+ this->set(vm, owner, value); >+ } >+ >+ bool operator!() const { return !m_value; } >+ >+ explicit operator bool() const { return m_value; } >+ >+ T* get() const >+ { >+ return m_value; >+ } >+ >+ T* operator*() const >+ { >+ return get(); >+ } >+ >+ T* operator->() const >+ { >+ return get(); >+ } >+ >+ void set(VM& vm, const JSCell* owner, T* value) >+ { >+ this->m_value = value; >+ vm.heap.writeBarrier(owner); >+ } >+ >+ void setWithoutWriteBarrier(T* value) >+ { >+ this->m_value = value; >+ } >+ >+ void clear() { m_value = 0; } >+ >+private: >+ T* m_value; >+}; >+ >+} // namespace JSC >+ >+#endif // CopyWriteBarrier_h >Index: Source/JavaScriptCore/heap/CopyBarrier.h >=================================================================== >--- Source/JavaScriptCore/heap/CopyBarrier.h (working copy) >+++ Source/JavaScriptCore/heap/CopyBarrier.h (working copy) >@@ -23,67 +23,88 @@ > * THE POSSIBILITY OF SUCH DAMAGE. > */ > >-#ifndef CopyWriteBarrier_h >-#define CopyWriteBarrier_h >+#ifndef CopyBarrier_h >+#define CopyBarrier_h > > #include "Heap.h" > > namespace JSC { > >-template <typename T> >-class CopyWriteBarrier { >+class CopyBarrierBase { > public: >- CopyWriteBarrier() >- : m_value(0) >+ CopyBarrierBase() >+ : m_value(nullptr) > { > } > >- CopyWriteBarrier(VM& vm, const JSCell* owner, T& value) >+ bool operator!() const { return !m_value; } >+ >+ explicit operator bool() const { return m_value; } >+ >+ // When we are in the concurrent copying phase, this method may lock the barrier object (i.e. the field >+ // pointing to copied space) and call directly into the owning object's copyBackingStore() method. >+ void* get(JSCell* owner) const > { >- this->set(vm, owner, &value); >+ vm.heap.copyBarrier(owner, m_value); >+ return m_value; > } > >- CopyWriteBarrier(VM& vm, const JSCell* owner, T* value) >+ void clear() { m_value = nullptr; } >+ >+protected: >+ CopyBarrierBase(VM& vm, const JSCell* owner, void* value) > { > this->set(vm, owner, value); > } > >- bool operator!() const { return !m_value; } >+ void set(VM& vm, const JSCell* owner, void* value) >+ { >+ this->m_value = value; >+ vm.heap.writeBarrier(owner); >+ } > >- explicit operator bool() const { return m_value; } >+ void setWithoutBarrier(void* value) >+ { >+ this->m_value = value; >+ } >+ >+private: >+ mutable void* m_value; >+}; >+ >+template <typename T> >+class CopyBarrier : public CopyBarrierBase { >+public: >+ CopyBarrier() >+ { >+ } > >- T* get() const >+ CopyBarrier(VM& vm, const JSCell* owner, T& value) >+ : CopyBarrierBase(vm, owner, &value) > { >- return m_value; > } > >- T* operator*() const >+ CopyBarrier(VM& vm, const JSCell* owner, T* value) >+ : CopyBarrierBase(vm, owner, value) > { >- return get(); > } > >- T* operator->() const >+ T* get(JSCell* owner) const > { >- return get(); >+ return bitwise_cast<T*>(CopyBarrierBase::get(owner)); > } > > void set(VM& vm, const JSCell* owner, T* value) > { >- this->m_value = value; >- vm.heap.writeBarrier(owner); >+ CopyBarrierBase::set(vm, owner, value); > } > >- void setWithoutWriteBarrier(T* value) >+ void setWithoutBarrier(T* value) > { >- this->m_value = value; >+ CopyBarrierBase::setWithoutBarrier(value); > } >- >- void clear() { m_value = 0; } >- >-private: >- T* m_value; > }; > > } // namespace JSC > >-#endif // CopyWriteBarrier_h >+#endif // CopyBarrier_h >Index: Source/JavaScriptCore/heap/CopyVisitorInlines.h >=================================================================== >--- Source/JavaScriptCore/heap/CopyVisitorInlines.h (revision 190603) >+++ Source/JavaScriptCore/heap/CopyVisitorInlines.h (working copy) >@@ -34,8 +34,11 @@ > > namespace JSC { > >-inline bool CopyVisitor::checkIfShouldCopy(void* oldPtr) >+inline bool CopyVisitor::checkIfShouldCopy(CopyBarrier& barrier) > { >+ void* oldPtr = barrier.get(); >+ if (!oldPtr) >+ return false; > CopiedBlock* block = CopiedSpace::blockFor(oldPtr); > if (block->isOversize() || block->isPinned()) > return false; >Index: Source/JavaScriptCore/heap/CopyWriteBarrier.h >=================================================================== >--- Source/JavaScriptCore/heap/CopyWriteBarrier.h (revision 190603) >+++ Source/JavaScriptCore/heap/CopyWriteBarrier.h (working copy) >@@ -1,89 +0,0 @@ >-/* >- * Copyright (C) 2014 Apple Inc. All rights reserved. >- * >- * Redistribution and use in source and binary forms, with or without >- * modification, are permitted provided that the following conditions >- * are met: >- * 1. Redistributions of source code must retain the above copyright >- * notice, this list of conditions and the following disclaimer. >- * 2. Redistributions in binary form must reproduce the above copyright >- * notice, this list of conditions and the following disclaimer in the >- * documentation and/or other materials provided with the distribution. >- * >- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' >- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, >- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS >- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR >- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF >- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS >- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN >- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) >- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF >- * THE POSSIBILITY OF SUCH DAMAGE. >- */ >- >-#ifndef CopyWriteBarrier_h >-#define CopyWriteBarrier_h >- >-#include "Heap.h" >- >-namespace JSC { >- >-template <typename T> >-class CopyWriteBarrier { >-public: >- CopyWriteBarrier() >- : m_value(0) >- { >- } >- >- CopyWriteBarrier(VM& vm, const JSCell* owner, T& value) >- { >- this->set(vm, owner, &value); >- } >- >- CopyWriteBarrier(VM& vm, const JSCell* owner, T* value) >- { >- this->set(vm, owner, value); >- } >- >- bool operator!() const { return !m_value; } >- >- explicit operator bool() const { return m_value; } >- >- T* get() const >- { >- return m_value; >- } >- >- T* operator*() const >- { >- return get(); >- } >- >- T* operator->() const >- { >- return get(); >- } >- >- void set(VM& vm, const JSCell* owner, T* value) >- { >- this->m_value = value; >- vm.heap.writeBarrier(owner); >- } >- >- void setWithoutWriteBarrier(T* value) >- { >- this->m_value = value; >- } >- >- void clear() { m_value = 0; } >- >-private: >- T* m_value; >-}; >- >-} // namespace JSC >- >-#endif // CopyWriteBarrier_h >Index: Source/JavaScriptCore/heap/Heap.cpp >=================================================================== >--- Source/JavaScriptCore/heap/Heap.cpp (revision 190603) >+++ Source/JavaScriptCore/heap/Heap.cpp (working copy) >@@ -1003,6 +1003,11 @@ void Heap::addToRememberedSet(const JSCe > m_slotVisitor.appendToMarkStack(const_cast<JSCell*>(cell)); > } > >+void copyBarrierSlow(JSCell*, void*&) >+{ >+ // Do nothing for now. >+} >+ > void Heap::collectAndSweep(HeapOperation collectionType) > { > if (!m_isSafeToCollect) >Index: Source/JavaScriptCore/heap/Heap.h >=================================================================== >--- Source/JavaScriptCore/heap/Heap.h (revision 190603) >+++ Source/JavaScriptCore/heap/Heap.h (working copy) >@@ -107,6 +107,8 @@ public: > void writeBarrier(const JSCell*, JSValue); > void writeBarrier(const JSCell*, JSCell*); > >+ static void copyBarrier(JSCell* owner, void*& copiedSpacePointer); >+ > WriteBarrierBuffer& writeBarrierBuffer() { return m_writeBarrierBuffer; } > void flushWriteBarrierBuffer(JSCell*); > >@@ -321,6 +323,7 @@ private: > void clearUnmarkedExecutables(); > void deleteUnmarkedCompiledCode(); > JS_EXPORT_PRIVATE void addToRememberedSet(const JSCell*); >+ JS_EXPORT_PRIVATE static void copyBarrierSlow(JSCell* owner, void*& copiedSpacePointer); > void updateAllocationLimits(); > void didFinishCollection(double gcStartTime); > void resumeCompilerThreads(); >Index: Source/JavaScriptCore/heap/HeapInlines.h >=================================================================== >--- Source/JavaScriptCore/heap/HeapInlines.h (revision 190603) >+++ Source/JavaScriptCore/heap/HeapInlines.h (working copy) >@@ -120,6 +120,12 @@ inline void Heap::writeBarrier(const JSC > addToRememberedSet(from); > } > >+inline void Heap::copyBarrier(JSCell* owner, void*& copiedSpacePointer) >+{ >+ if (UNLIKELY(bitwise_cast<uintptr_t>(copiedSpacePointer) & 3)) >+ copyBarrierSlow(owner, copiedSpacePointer); >+} >+ > inline void Heap::reportExtraMemoryAllocated(size_t size) > { > if (size > minExtraMemory) >Index: Source/JavaScriptCore/runtime/DirectArguments.cpp >=================================================================== >--- Source/JavaScriptCore/runtime/DirectArguments.cpp (revision 190603) >+++ Source/JavaScriptCore/runtime/DirectArguments.cpp (working copy) >@@ -108,10 +108,7 @@ void DirectArguments::copyBackingStore(J > > RELEASE_ASSERT(token == DirectArgumentsOverridesCopyToken); > >- bool* oldOverrides = thisObject->m_overrides.get(); >- if (!oldOverrides) >- return; >- >+ void* oldOverrides = thisObject->m_overrides.get(); > if (visitor.checkIfShouldCopy(oldOverrides)) { > bool* newOverrides = static_cast<bool*>(visitor.allocateNewSpace(thisObject->overridesSize())); > memcpy(newOverrides, oldOverrides, thisObject->m_length); >@@ -137,7 +134,7 @@ void DirectArguments::overrideThings(VM& > RELEASE_ASSERT(vm.heap.tryAllocateStorage(this, overridesSize(), &backingStore)); > m_overrides.set(vm, this, static_cast<bool*>(backingStore)); > for (unsigned i = m_length; i--;) >- m_overrides.get()[i] = false; >+ m_overrides[i] = false; > } > > void DirectArguments::overrideThingsIfNecessary(VM& vm) >@@ -149,7 +146,7 @@ void DirectArguments::overrideThingsIfNe > void DirectArguments::overrideArgument(VM& vm, unsigned index) > { > overrideThingsIfNecessary(vm); >- m_overrides.get()[index] = true; >+ m_overrides[index] = true; > } > > void DirectArguments::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length) >Index: Source/JavaScriptCore/runtime/DirectArguments.h >=================================================================== >--- Source/JavaScriptCore/runtime/DirectArguments.h (revision 190603) >+++ Source/JavaScriptCore/runtime/DirectArguments.h (working copy) >@@ -73,7 +73,7 @@ public: > > bool canAccessIndexQuickly(uint32_t i) const > { >- return i < m_length && (!m_overrides || !m_overrides.get()[i]); >+ return i < m_length && (!m_overrides || !m_overrides[i]); > } > > bool canAccessArgumentIndexQuicklyInDFG(uint32_t i) const >@@ -148,7 +148,7 @@ private: > WriteBarrier<JSFunction> m_callee; > uint32_t m_length; // Always the actual length of captured arguments and never what was stored into the length property. > uint32_t m_minCapacity; // The max of this and length determines the capacity of this object. It may be the actual capacity, or maybe something smaller. We arrange it this way to be kind to the JITs. >- CopyWriteBarrier<bool> m_overrides; // If non-null, it means that length, callee, and caller are fully materialized properties. >+ CopyBarrier<bool> m_overrides; // If non-null, it means that length, callee, and caller are fully materialized properties. > }; > > } // namespace JSC >Index: Source/JavaScriptCore/runtime/JSArrayBufferView.cpp >=================================================================== >--- Source/JavaScriptCore/runtime/JSArrayBufferView.cpp (revision 190603) >+++ Source/JavaScriptCore/runtime/JSArrayBufferView.cpp (working copy) >@@ -88,10 +88,10 @@ JSArrayBufferView::ConstructionContext:: > VM& vm, Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer, > unsigned byteOffset, unsigned length) > : m_structure(structure) >- , m_vector(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset) > , m_length(length) > , m_mode(WastefulTypedArray) > { >+ m_vector.setWithoutBarrier(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset); > IndexingHeader indexingHeader; > indexingHeader.setArrayBuffer(arrayBuffer.get()); > m_butterfly = Butterfly::create(vm, 0, 0, 0, true, indexingHeader, 0); >@@ -101,19 +101,19 @@ JSArrayBufferView::ConstructionContext:: > Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer, > unsigned byteOffset, unsigned length, DataViewTag) > : m_structure(structure) >- , m_vector(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset) > , m_length(length) > , m_mode(DataViewMode) > , m_butterfly(0) > { >+ m_vector.setWithoutBarrier(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset); > } > > JSArrayBufferView::JSArrayBufferView(VM& vm, ConstructionContext& context) > : Base(vm, context.structure(), context.butterfly()) >- , m_vector(context.vector()) > , m_length(context.length()) > , m_mode(context.mode()) > { >+ m_vector.setWithoutBarrier(context.vector()); > } > > void JSArrayBufferView::finishCreation(VM& vm) >@@ -215,7 +215,7 @@ void JSArrayBufferView::finalize(JSCell* > JSArrayBufferView* thisObject = static_cast<JSArrayBufferView*>(cell); > ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray); > if (thisObject->m_mode == OversizeTypedArray) >- fastFree(thisObject->m_vector); >+ fastFree(thisObject->m_vector.get()); > } > > } // namespace JSC >Index: Source/JavaScriptCore/runtime/JSArrayBufferView.h >=================================================================== >--- Source/JavaScriptCore/runtime/JSArrayBufferView.h (revision 190603) >+++ Source/JavaScriptCore/runtime/JSArrayBufferView.h (working copy) >@@ -161,7 +161,7 @@ public: > PassRefPtr<ArrayBufferView> impl(); > void neuter(); > >- void* vector() { return m_vector; } >+ void* vector() { return m_vector.get(); } > unsigned byteOffset(); > unsigned length() const { return m_length; } > >@@ -177,7 +177,7 @@ private: > protected: > ArrayBuffer* existingBufferInButterfly(); > >- void* m_vector; >+ CopyBarrier<void> m_vector; > uint32_t m_length; > TypedArrayMode m_mode; > }; >Index: Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h >=================================================================== >--- Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h (revision 190603) >+++ Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h (working copy) >@@ -59,7 +59,7 @@ inline void JSArrayBufferView::neuter() > { > ASSERT(hasArrayBuffer()); > m_length = 0; >- m_vector = 0; >+ m_vector.clear(); > } > > inline unsigned JSArrayBufferView::byteOffset() >@@ -68,7 +68,7 @@ inline unsigned JSArrayBufferView::byteO > return 0; > > ptrdiff_t delta = >- static_cast<uint8_t*>(m_vector) - static_cast<uint8_t*>(buffer()->data()); >+ static_cast<uint8_t*>(m_vector.get()) - static_cast<uint8_t*>(buffer()->data()); > > unsigned result = static_cast<unsigned>(delta); > ASSERT(static_cast<ptrdiff_t>(result) == delta); >Index: Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h >=================================================================== >--- Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (revision 190603) >+++ Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (working copy) >@@ -108,11 +108,11 @@ public: > > const typename Adaptor::Type* typedVector() const > { >- return static_cast<const typename Adaptor::Type*>(m_vector); >+ return static_cast<const typename Adaptor::Type*>(m_vector.get()); > } > typename Adaptor::Type* typedVector() > { >- return static_cast<typename Adaptor::Type*>(m_vector); >+ return static_cast<typename Adaptor::Type*>(m_vector.get()); > } > > // These methods are meant to match indexed access methods that JSObject >Index: Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h >=================================================================== >--- Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (revision 190603) >+++ Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (working copy) >@@ -441,7 +441,7 @@ void JSGenericTypedArrayView<Adaptor>::v > switch (thisObject->m_mode) { > case FastTypedArray: { > if (thisObject->m_vector) >- visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector, thisObject->byteSize()); >+ visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector.get(), thisObject->byteSize()); > break; > } > >@@ -468,12 +468,12 @@ void JSGenericTypedArrayView<Adaptor>::c > JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell); > > if (token == TypedArrayVectorCopyToken >- && visitor.checkIfShouldCopy(thisObject->m_vector)) { >+ && visitor.checkIfShouldCopy(thisObject->m_vector.get())) { > ASSERT(thisObject->m_vector); >- void* oldVector = thisObject->m_vector; >+ void* oldVector = thisObject->m_vector.get(); > void* newVector = visitor.allocateNewSpace(thisObject->byteSize()); > memcpy(newVector, oldVector, thisObject->byteSize()); >- thisObject->m_vector = newVector; >+ thisObject->m_vector.setWithoutBarrier(newVector); > visitor.didCopy(oldVector, thisObject->byteSize()); > } > >@@ -509,7 +509,7 @@ ArrayBuffer* JSGenericTypedArrayView<Ada > ASSERT(thisObject->m_vector); > // Reuse already allocated memory if at all possible. > thisObject->m_butterfly.setWithoutWriteBarrier( >- static_cast<IndexingHeader*>(thisObject->m_vector)->butterfly()); >+ static_cast<IndexingHeader*>(thisObject->m_vector.get())->butterfly()); > } else { > VM& vm = *heap->vm(); > thisObject->m_butterfly.set(vm, thisObject, Butterfly::createOrGrowArrayRight( >@@ -521,14 +521,14 @@ ArrayBuffer* JSGenericTypedArrayView<Ada > > switch (thisObject->m_mode) { > case FastTypedArray: >- buffer = ArrayBuffer::create(thisObject->m_vector, thisObject->byteLength()); >+ buffer = ArrayBuffer::create(thisObject->m_vector.get(), thisObject->byteLength()); > break; > > case OversizeTypedArray: > // FIXME: consider doing something like "subtracting" from extra memory > // cost, since right now this case will cause the GC to think that we reallocated > // the whole buffer. >- buffer = ArrayBuffer::createAdopted(thisObject->m_vector, thisObject->byteLength()); >+ buffer = ArrayBuffer::createAdopted(thisObject->m_vector.get(), thisObject->byteLength()); > break; > > default: >@@ -537,7 +537,7 @@ ArrayBuffer* JSGenericTypedArrayView<Ada > } > > thisObject->butterfly()->indexingHeader()->setArrayBuffer(buffer.get()); >- thisObject->m_vector = buffer->data(); >+ thisObject->m_vector.setWithoutBarrier(buffer->data()); > thisObject->m_mode = WastefulTypedArray; > heap->addReference(thisObject, buffer.get()); > >Index: Source/JavaScriptCore/runtime/JSObject.cpp >=================================================================== >--- Source/JavaScriptCore/runtime/JSObject.cpp (revision 190603) >+++ Source/JavaScriptCore/runtime/JSObject.cpp (working copy) >@@ -341,7 +341,7 @@ bool JSObject::getOwnPropertySlotByIndex > } > > case ALL_ARRAY_STORAGE_INDEXING_TYPES: { >- ArrayStorage* storage = thisObject->m_butterfly->arrayStorage(); >+ ArrayStorage* storage = thisObject->m_butterfly.get(this)->arrayStorage(); > if (i >= storage->length()) > return false; > >@@ -514,7 +514,7 @@ void JSObject::putByIndex(JSCell* cell, > > case NonArrayWithArrayStorage: > case ArrayWithArrayStorage: { >- ArrayStorage* storage = thisObject->m_butterfly->arrayStorage(); >+ ArrayStorage* storage = thisObject->m_butterfly.get(this)->arrayStorage(); > > if (propertyName >= storage->vectorLength()) > break; >@@ -536,7 +536,7 @@ void JSObject::putByIndex(JSCell* cell, > > case NonArrayWithSlowPutArrayStorage: > case ArrayWithSlowPutArrayStorage: { >- ArrayStorage* storage = thisObject->m_butterfly->arrayStorage(); >+ ArrayStorage* storage = thisObject->m_butterfly.get(this)->arrayStorage(); > > if (propertyName >= storage->vectorLength()) > break; >@@ -613,7 +613,7 @@ void JSObject::enterDictionaryIndexingMo > enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, ensureArrayStorageSlow(vm)); > break; > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly->arrayStorage()); >+ enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage()); > break; > > default: >@@ -643,7 +643,7 @@ Butterfly* JSObject::createInitialIndexe > ASSERT(!indexingShouldBeSparse()); > unsigned vectorLength = std::max(length, BASE_VECTOR_LEN); > Butterfly* newButterfly = Butterfly::createOrGrowArrayRight( >- m_butterfly.get(), vm, this, structure(), structure()->outOfLineCapacity(), false, 0, >+ m_butterfly.get(this), vm, this, structure(), structure()->outOfLineCapacity(), false, 0, > elementSize * vectorLength); > newButterfly->setPublicLength(length); > newButterfly->setVectorLength(vectorLength); >@@ -695,7 +695,7 @@ ArrayStorage* JSObject::createArrayStora > IndexingType oldType = indexingType(); > ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType)); > Butterfly* newButterfly = Butterfly::createOrGrowArrayRight( >- m_butterfly.get(), vm, this, structure, structure->outOfLineCapacity(), false, 0, >+ m_butterfly.get(this), vm, this, structure, structure->outOfLineCapacity(), false, 0, > ArrayStorage::sizeFor(vectorLength)); > RELEASE_ASSERT(newButterfly); > >@@ -719,31 +719,32 @@ ContiguousJSValues JSObject::convertUnde > { > ASSERT(hasUndecided(indexingType())); > setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateInt32)); >- return m_butterfly->contiguousInt32(); >+ return m_butterfly.get(this)->contiguousInt32(); > } > > ContiguousDoubles JSObject::convertUndecidedToDouble(VM& vm) > { > ASSERT(hasUndecided(indexingType())); >- >- for (unsigned i = m_butterfly->vectorLength(); i--;) >- m_butterfly->contiguousDouble()[i] = PNaN; >+ >+ Butterfly* butterfly = m_butterfly.get(this); >+ for (unsigned i = butterfly->vectorLength(); i--;) >+ butterfly->contiguousDouble()[i] = PNaN; > > setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble)); >- return m_butterfly->contiguousDouble(); >+ return m_butterfly.get(this)->contiguousDouble(); > } > > ContiguousJSValues JSObject::convertUndecidedToContiguous(VM& vm) > { > ASSERT(hasUndecided(indexingType())); > setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous)); >- return m_butterfly->contiguous(); >+ return m_butterfly.get(this)->contiguous(); > } > > ArrayStorage* JSObject::constructConvertedArrayStorageWithoutCopyingElements(VM& vm, unsigned neededLength) > { > Structure* structure = this->structure(vm); >- unsigned publicLength = m_butterfly->publicLength(); >+ unsigned publicLength = m_butterfly.get(this)->publicLength(); > unsigned propertyCapacity = structure->outOfLineCapacity(); > unsigned propertySize = structure->outOfLineSize(); > >@@ -752,7 +753,7 @@ ArrayStorage* JSObject::constructConvert > > memcpy( > newButterfly->propertyStorage() - propertySize, >- m_butterfly->propertyStorage() - propertySize, >+ m_butterfly.get(this)->propertyStorage() - propertySize, > propertySize * sizeof(EncodedJSValue)); > > ArrayStorage* newStorage = newButterfly->arrayStorage(); >@@ -770,7 +771,7 @@ ArrayStorage* JSObject::convertUndecided > DeferGC deferGC(vm.heap); > ASSERT(hasUndecided(indexingType())); > >- unsigned vectorLength = m_butterfly->vectorLength(); >+ unsigned vectorLength = m_butterfly.get(this)->vectorLength(); > ArrayStorage* storage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength); > // No need to copy elements. > >@@ -787,9 +788,10 @@ ArrayStorage* JSObject::convertUndecided > ContiguousDoubles JSObject::convertInt32ToDouble(VM& vm) > { > ASSERT(hasInt32(indexingType())); >- >- for (unsigned i = m_butterfly->vectorLength(); i--;) { >- WriteBarrier<Unknown>* current = &m_butterfly->contiguousInt32()[i]; >+ >+ Butterfly* butterfly = m_butterfly.get(this); >+ for (unsigned i = butterfly->vectorLength(); i--;) { >+ WriteBarrier<Unknown>* current = &butterfly->contiguousInt32()[i]; > double* currentAsDouble = bitwise_cast<double*>(current); > JSValue v = current->get(); > if (!v) { >@@ -801,7 +803,7 @@ ContiguousDoubles JSObject::convertInt32 > } > > setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble)); >- return m_butterfly->contiguousDouble(); >+ return m_butterfly.get(this)->contiguousDouble(); > } > > ContiguousJSValues JSObject::convertInt32ToContiguous(VM& vm) >@@ -809,7 +811,7 @@ ContiguousJSValues JSObject::convertInt3 > ASSERT(hasInt32(indexingType())); > > setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous)); >- return m_butterfly->contiguous(); >+ return m_butterfly.get(this)->contiguous(); > } > > ArrayStorage* JSObject::convertInt32ToArrayStorage(VM& vm, NonPropertyTransition transition) >@@ -817,10 +819,11 @@ ArrayStorage* JSObject::convertInt32ToAr > DeferGC deferGC(vm.heap); > ASSERT(hasInt32(indexingType())); > >- unsigned vectorLength = m_butterfly->vectorLength(); >+ unsigned vectorLength = m_butterfly.get(this)->vectorLength(); > ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength); >- for (unsigned i = 0; i < m_butterfly->publicLength(); i++) { >- JSValue v = m_butterfly->contiguous()[i].get(); >+ Butterfly* butterfly = m_butterfly.get(this); >+ for (unsigned i = 0; i < butterfly->publicLength(); i++) { >+ JSValue v = butterfly->contiguous()[i].get(); > if (v) { > newStorage->m_vector[i].setWithoutWriteBarrier(v); > newStorage->m_numValuesInVector++; >@@ -841,9 +844,10 @@ ArrayStorage* JSObject::convertInt32ToAr > ContiguousJSValues JSObject::convertDoubleToContiguous(VM& vm) > { > ASSERT(hasDouble(indexingType())); >- >- for (unsigned i = m_butterfly->vectorLength(); i--;) { >- double* current = &m_butterfly->contiguousDouble()[i]; >+ >+ Butterfly* butterfly = m_butterfly.get(this); >+ for (unsigned i = butterfly->vectorLength(); i--;) { >+ double* current = &butterfly->contiguousDouble()[i]; > WriteBarrier<Unknown>* currentAsValue = bitwise_cast<WriteBarrier<Unknown>*>(current); > double value = *current; > if (value != value) { >@@ -855,7 +859,7 @@ ContiguousJSValues JSObject::convertDoub > } > > setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous)); >- return m_butterfly->contiguous(); >+ return m_butterfly.get(this)->contiguous(); > } > > ArrayStorage* JSObject::convertDoubleToArrayStorage(VM& vm, NonPropertyTransition transition) >@@ -863,10 +867,11 @@ ArrayStorage* JSObject::convertDoubleToA > DeferGC deferGC(vm.heap); > ASSERT(hasDouble(indexingType())); > >- unsigned vectorLength = m_butterfly->vectorLength(); >+ unsigned vectorLength = m_butterfly.get(this)->vectorLength(); > ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength); >- for (unsigned i = 0; i < m_butterfly->publicLength(); i++) { >- double value = m_butterfly->contiguousDouble()[i]; >+ Butterfly* butterfly = m_butterfly.get(this); >+ for (unsigned i = 0; i < butterfly->publicLength(); i++) { >+ double value = butterfly->contiguousDouble()[i]; > if (value == value) { > newStorage->m_vector[i].setWithoutWriteBarrier(JSValue(JSValue::EncodeAsDouble, value)); > newStorage->m_numValuesInVector++; >@@ -889,10 +894,11 @@ ArrayStorage* JSObject::convertContiguou > DeferGC deferGC(vm.heap); > ASSERT(hasContiguous(indexingType())); > >- unsigned vectorLength = m_butterfly->vectorLength(); >+ unsigned vectorLength = m_butterfly.get(this)->vectorLength(); > ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength); >- for (unsigned i = 0; i < m_butterfly->publicLength(); i++) { >- JSValue v = m_butterfly->contiguous()[i].get(); >+ Butterfly* butterfly = m_butterfly.get(this); >+ for (unsigned i = 0; i < butterfly->publicLength(); i++) { >+ JSValue v = butterfly->contiguous()[i].get(); > if (v) { > newStorage->m_vector[i].setWithoutWriteBarrier(v); > newStorage->m_numValuesInVector++; >@@ -957,8 +963,8 @@ void JSObject::convertInt32ForValue(VM& > > void JSObject::setIndexQuicklyToUndecided(VM& vm, unsigned index, JSValue value) > { >- ASSERT(index < m_butterfly->publicLength()); >- ASSERT(index < m_butterfly->vectorLength()); >+ ASSERT(index < m_butterfly.get(this)->publicLength()); >+ ASSERT(index < m_butterfly.get(this)->vectorLength()); > convertUndecidedForValue(vm, value); > setIndexQuickly(vm, index, value); > } >@@ -1114,7 +1120,7 @@ ArrayStorage* JSObject::ensureArrayStora > return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertContiguousToArrayStorage(vm)); > > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly->arrayStorage()); >+ return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage()); > > default: > CRASH(); >@@ -1356,7 +1362,7 @@ bool JSObject::deletePropertyByIndex(JSC > } > > case ALL_ARRAY_STORAGE_INDEXING_TYPES: { >- ArrayStorage* storage = thisObject->m_butterfly->arrayStorage(); >+ ArrayStorage* storage = thisObject->m_butterfly.get(this)->arrayStorage(); > > if (i < storage->vectorLength()) { > WriteBarrier<Unknown>& valueSlot = storage->m_vector[i]; >@@ -1546,7 +1552,7 @@ void JSObject::getOwnPropertyNames(JSObj > } > > case ALL_ARRAY_STORAGE_INDEXING_TYPES: { >- ArrayStorage* storage = object->m_butterfly->arrayStorage(); >+ ArrayStorage* storage = object->m_butterfly.get(this)->arrayStorage(); > > unsigned usedVectorLength = std::min(storage->length(), storage->vectorLength()); > for (unsigned i = 0; i < usedVectorLength; ++i) { >@@ -1699,7 +1705,7 @@ NEVER_INLINE void JSObject::fillGetterPr > void JSObject::putIndexedDescriptor(ExecState* exec, SparseArrayEntry* entryInMap, const PropertyDescriptor& descriptor, PropertyDescriptor& oldDescriptor) > { > VM& vm = exec->vm(); >- auto map = m_butterfly->arrayStorage()->m_sparseMap.get(); >+ auto map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get(); > > if (descriptor.isDataDescriptor()) { > if (descriptor.value()) >@@ -1758,7 +1764,7 @@ bool JSObject::defineOwnIndexedProperty( > if (descriptor.attributes() & (ReadOnly | Accessor)) > notifyPresenceOfIndexedAccessors(exec->vm()); > >- SparseArrayValueMap* map = m_butterfly->arrayStorage()->m_sparseMap.get(); >+ SparseArrayValueMap* map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get(); > RELEASE_ASSERT(map); > > // 1. Let current be the result of calling the [[GetOwnProperty]] internal method of O with property name P. >@@ -1790,8 +1796,9 @@ bool JSObject::defineOwnIndexedProperty( > entryInMap->get(defaults); > > putIndexedDescriptor(exec, entryInMap, descriptor, defaults); >- if (index >= m_butterfly->arrayStorage()->length()) >- m_butterfly->arrayStorage()->setLength(index + 1); >+ Butterfly* butterfly = m_butterfly.get(this); >+ if (index >= butterfly->arrayStorage()->length()) >+ butterfly->arrayStorage()->setLength(index + 1); > return true; > } > >@@ -1911,17 +1918,19 @@ void JSObject::putByIndexBeyondVectorLen > { > ASSERT((indexingType() & IndexingShapeMask) == indexingShape); > ASSERT(!indexingShouldBeSparse()); >+ >+ Butterfly* butterfly = m_butterfly.get(this); > > // For us to get here, the index is either greater than the public length, or greater than > // or equal to the vector length. >- ASSERT(i >= m_butterfly->vectorLength()); >+ ASSERT(i >= butterfly->vectorLength()); > > VM& vm = exec->vm(); > > if (i >= MAX_ARRAY_INDEX - 1 > || (i >= MIN_SPARSE_ARRAY_INDEX >- && !isDenseEnoughForVector(i, countElements<indexingShape>(butterfly()))) >- || indexIsSufficientlyBeyondLengthForSparseMap(i, m_butterfly->vectorLength())) { >+ && !isDenseEnoughForVector(i, countElements<indexingShape>(butterfly))) >+ || indexIsSufficientlyBeyondLengthForSparseMap(i, butterfly->vectorLength())) { > ASSERT(i <= MAX_ARRAY_INDEX); > ensureArrayStorageSlow(vm); > SparseArrayValueMap* map = allocateSparseIndexMap(vm); >@@ -1932,24 +1941,25 @@ void JSObject::putByIndexBeyondVectorLen > } > > ensureLength(vm, i + 1); >+ butterfly = m_butterfly.get(this); > >- RELEASE_ASSERT(i < m_butterfly->vectorLength()); >+ RELEASE_ASSERT(i < butterfly->vectorLength()); > switch (indexingShape) { > case Int32Shape: > ASSERT(value.isInt32()); >- m_butterfly->contiguousInt32()[i].setWithoutWriteBarrier(value); >+ butterfly->contiguousInt32()[i].setWithoutWriteBarrier(value); > break; > > case DoubleShape: { > ASSERT(value.isNumber()); > double valueAsDouble = value.asNumber(); > ASSERT(valueAsDouble == valueAsDouble); >- m_butterfly->contiguousDouble()[i] = valueAsDouble; >+ butterfly->contiguousDouble()[i] = valueAsDouble; > break; > } > > case ContiguousShape: >- m_butterfly->contiguous()[i].set(vm, this, value); >+ butterfly->contiguous()[i].set(vm, this, value); > break; > > default: >@@ -2223,7 +2233,7 @@ bool JSObject::putDirectIndexBeyondVecto > > case ALL_INT32_INDEXING_TYPES: { > if (attributes) { >- if (i < m_butterfly->vectorLength()) >+ if (i < m_butterfly.get(this)->vectorLength()) > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm)); > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertInt32ToArrayStorage(vm)); > } >@@ -2237,7 +2247,7 @@ bool JSObject::putDirectIndexBeyondVecto > > case ALL_DOUBLE_INDEXING_TYPES: { > if (attributes) { >- if (i < m_butterfly->vectorLength()) >+ if (i < m_butterfly.get(this)->vectorLength()) > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm)); > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertDoubleToArrayStorage(vm)); > } >@@ -2256,7 +2266,7 @@ bool JSObject::putDirectIndexBeyondVecto > > case ALL_CONTIGUOUS_INDEXING_TYPES: { > if (attributes) { >- if (i < m_butterfly->vectorLength()) >+ if (i < m_butterfly.get(this)->vectorLength()) > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm)); > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertContiguousToArrayStorage(vm)); > } >@@ -2266,7 +2276,7 @@ bool JSObject::putDirectIndexBeyondVecto > > case ALL_ARRAY_STORAGE_INDEXING_TYPES: > if (attributes) { >- if (i < m_butterfly->vectorLength()) >+ if (i < m_butterfly.get(this)->vectorLength()) > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm)); > } > return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, arrayStorage()); >@@ -2347,8 +2357,8 @@ ALWAYS_INLINE unsigned JSObject::getNewV > unsigned length; > > if (hasIndexedProperties(indexingType())) { >- vectorLength = m_butterfly->vectorLength(); >- length = m_butterfly->publicLength(); >+ vectorLength = m_butterfly.get(this)->vectorLength(); >+ length = m_butterfly.get(this)->publicLength(); > } else { > vectorLength = 0; > length = 0; >@@ -2454,25 +2464,28 @@ bool JSObject::increaseVectorLength(VM& > > void JSObject::ensureLengthSlow(VM& vm, unsigned length) > { >+ Butterfly* butterfly = m_butterfly.get(this); >+ > ASSERT(length < MAX_ARRAY_INDEX); > ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType())); >- ASSERT(length > m_butterfly->vectorLength()); >+ ASSERT(length > butterfly->vectorLength()); > > unsigned newVectorLength = std::min( > length << 1, > MAX_STORAGE_VECTOR_LENGTH); >- unsigned oldVectorLength = m_butterfly->vectorLength(); >+ unsigned oldVectorLength = butterfly->vectorLength(); > DeferGC deferGC(vm.heap); >- m_butterfly.set(vm, this, m_butterfly->growArrayRight( >+ butterfly = butterfly->growArrayRight( > vm, this, structure(), structure()->outOfLineCapacity(), true, > oldVectorLength * sizeof(EncodedJSValue), >- newVectorLength * sizeof(EncodedJSValue))); >+ newVectorLength * sizeof(EncodedJSValue)); >+ m_butterfly.set(vm, this, butterfly); > >- m_butterfly->setVectorLength(newVectorLength); >+ butterfly->setVectorLength(newVectorLength); > > if (hasDouble(indexingType())) { > for (unsigned i = oldVectorLength; i < newVectorLength; ++i) >- m_butterfly->contiguousDouble().data()[i] = PNaN; >+ butterfly->contiguousDouble().data()[i] = PNaN; > } > } > >@@ -2485,10 +2498,10 @@ void JSObject::reallocateAndShrinkButter > ASSERT(!m_butterfly->indexingHeader()->preCapacity(structure())); > > DeferGC deferGC(vm.heap); >- Butterfly* newButterfly = m_butterfly->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length)); >+ Butterfly* newButterfly = m_butterfly.get(this)->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length)); > m_butterfly.set(vm, this, newButterfly); >- m_butterfly->setVectorLength(length); >- m_butterfly->setPublicLength(length); >+ newButterfly->setVectorLength(length); >+ newButterfly->setPublicLength(length); > } > > Butterfly* JSObject::growOutOfLineStorage(VM& vm, size_t oldSize, size_t newSize) >@@ -2498,7 +2511,7 @@ Butterfly* JSObject::growOutOfLineStorag > // It's important that this function not rely on structure(), for the property > // capacity, since we might have already mutated the structure in-place. > >- return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(), vm, this, structure(vm), oldSize, newSize); >+ return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(this), vm, this, structure(vm), oldSize, newSize); > } > > bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor) >@@ -2785,7 +2798,7 @@ uint32_t JSObject::getEnumerableLength(E > } > > case ALL_ARRAY_STORAGE_INDEXING_TYPES: { >- ArrayStorage* storage = object->m_butterfly->arrayStorage(); >+ ArrayStorage* storage = object->m_butterfly.get(this)->arrayStorage(); > if (storage->m_sparseMap.get()) > return 0; > >Index: Source/JavaScriptCore/runtime/JSObject.h >=================================================================== >--- Source/JavaScriptCore/runtime/JSObject.h (revision 190603) >+++ Source/JavaScriptCore/runtime/JSObject.h (working copy) >@@ -30,7 +30,7 @@ > #include "CallFrame.h" > #include "ClassInfo.h" > #include "CommonIdentifiers.h" >-#include "CopyWriteBarrier.h" >+#include "CopyBarrier.h" > #include "CustomGetterSetter.h" > #include "DeferGC.h" > #include "Heap.h" >@@ -131,14 +131,14 @@ public: > { > if (!hasIndexedProperties(indexingType())) > return 0; >- return m_butterfly->publicLength(); >+ return m_butterfly.get(this)->publicLength(); > } > > unsigned getVectorLength() > { > if (!hasIndexedProperties(indexingType())) > return 0; >- return m_butterfly->vectorLength(); >+ return m_butterfly.get(this)->vectorLength(); > } > > JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&); >@@ -181,23 +181,24 @@ public: > > bool canGetIndexQuickly(unsigned i) > { >+ Butterfly* butterfly = m_butterfly.get(this); > switch (indexingType()) { > case ALL_BLANK_INDEXING_TYPES: > case ALL_UNDECIDED_INDEXING_TYPES: > return false; > case ALL_INT32_INDEXING_TYPES: > case ALL_CONTIGUOUS_INDEXING_TYPES: >- return i < m_butterfly->vectorLength() && m_butterfly->contiguous()[i]; >+ return i < butterfly->vectorLength() && butterfly->contiguous()[i]; > case ALL_DOUBLE_INDEXING_TYPES: { >- if (i >= m_butterfly->vectorLength()) >+ if (i >= butterfly->vectorLength()) > return false; >- double value = m_butterfly->contiguousDouble()[i]; >+ double value = butterfly->contiguousDouble()[i]; > if (value != value) > return false; > return true; > } > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- return i < m_butterfly->arrayStorage()->vectorLength() && m_butterfly->arrayStorage()->m_vector[i]; >+ return i < butterfly->arrayStorage()->vectorLength() && butterfly->arrayStorage()->m_vector[i]; > default: > RELEASE_ASSERT_NOT_REACHED(); > return false; >@@ -206,15 +207,16 @@ public: > > JSValue getIndexQuickly(unsigned i) > { >+ Butterfly* butterfly = m_butterfly.get(this); > switch (indexingType()) { > case ALL_INT32_INDEXING_TYPES: >- return jsNumber(m_butterfly->contiguous()[i].get().asInt32()); >+ return jsNumber(butterfly->contiguous()[i].get().asInt32()); > case ALL_CONTIGUOUS_INDEXING_TYPES: >- return m_butterfly->contiguous()[i].get(); >+ return butterfly->contiguous()[i].get(); > case ALL_DOUBLE_INDEXING_TYPES: >- return JSValue(JSValue::EncodeAsDouble, m_butterfly->contiguousDouble()[i]); >+ return JSValue(JSValue::EncodeAsDouble, butterfly->contiguousDouble()[i]); > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- return m_butterfly->arrayStorage()->m_vector[i].get(); >+ return butterfly->arrayStorage()->m_vector[i].get(); > default: > RELEASE_ASSERT_NOT_REACHED(); > return JSValue(); >@@ -223,32 +225,33 @@ public: > > JSValue tryGetIndexQuickly(unsigned i) const > { >+ Butterfly* butterfly = m_butterfly.get(this); > switch (indexingType()) { > case ALL_BLANK_INDEXING_TYPES: > case ALL_UNDECIDED_INDEXING_TYPES: > break; > case ALL_INT32_INDEXING_TYPES: >- if (i < m_butterfly->publicLength()) { >- JSValue result = m_butterfly->contiguous()[i].get(); >+ if (i < butterfly->publicLength()) { >+ JSValue result = butterfly->contiguous()[i].get(); > ASSERT(result.isInt32() || !result); > return result; > } > break; > case ALL_CONTIGUOUS_INDEXING_TYPES: >- if (i < m_butterfly->publicLength()) >- return m_butterfly->contiguous()[i].get(); >+ if (i < butterfly->publicLength()) >+ return butterfly->contiguous()[i].get(); > break; > case ALL_DOUBLE_INDEXING_TYPES: { >- if (i >= m_butterfly->publicLength()) >+ if (i >= butterfly->publicLength()) > break; >- double result = m_butterfly->contiguousDouble()[i]; >+ double result = butterfly->contiguousDouble()[i]; > if (result != result) > break; > return JSValue(JSValue::EncodeAsDouble, result); > } > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- if (i < m_butterfly->arrayStorage()->vectorLength()) >- return m_butterfly->arrayStorage()->m_vector[i].get(); >+ if (i < butterfly->arrayStorage()->vectorLength()) >+ return butterfly->arrayStorage()->m_vector[i].get(); > break; > default: > RELEASE_ASSERT_NOT_REACHED(); >@@ -276,6 +279,7 @@ public: > > bool canSetIndexQuickly(unsigned i) > { >+ Butterfly* butterfly = m_butterfly.get(this); > switch (indexingType()) { > case ALL_BLANK_INDEXING_TYPES: > case ALL_UNDECIDED_INDEXING_TYPES: >@@ -285,11 +289,11 @@ public: > case ALL_CONTIGUOUS_INDEXING_TYPES: > case NonArrayWithArrayStorage: > case ArrayWithArrayStorage: >- return i < m_butterfly->vectorLength(); >+ return i < butterfly->vectorLength(); > case NonArrayWithSlowPutArrayStorage: > case ArrayWithSlowPutArrayStorage: >- return i < m_butterfly->arrayStorage()->vectorLength() >- && !!m_butterfly->arrayStorage()->m_vector[i]; >+ return i < butterfly->arrayStorage()->vectorLength() >+ && !!butterfly->arrayStorage()->m_vector[i]; > default: > RELEASE_ASSERT_NOT_REACHED(); > return false; >@@ -306,7 +310,7 @@ public: > case ALL_DOUBLE_INDEXING_TYPES: > case ALL_CONTIGUOUS_INDEXING_TYPES: > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- return i < m_butterfly->vectorLength(); >+ return i < m_butterfly.get(this)->vectorLength(); > default: > RELEASE_ASSERT_NOT_REACHED(); > return false; >@@ -315,9 +319,10 @@ public: > > void setIndexQuickly(VM& vm, unsigned i, JSValue v) > { >+ Butterfly* butterfly = m_butterfly.get(this); > switch (indexingType()) { > case ALL_INT32_INDEXING_TYPES: { >- ASSERT(i < m_butterfly->vectorLength()); >+ ASSERT(i < butterfly->vectorLength()); > if (!v.isInt32()) { > convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v); > return; >@@ -325,14 +330,14 @@ public: > FALLTHROUGH; > } > case ALL_CONTIGUOUS_INDEXING_TYPES: { >- ASSERT(i < m_butterfly->vectorLength()); >- m_butterfly->contiguous()[i].set(vm, this, v); >- if (i >= m_butterfly->publicLength()) >- m_butterfly->setPublicLength(i + 1); >+ ASSERT(i < butterfly->vectorLength()); >+ butterfly->contiguous()[i].set(vm, this, v); >+ if (i >= butterfly->publicLength()) >+ butterfly->setPublicLength(i + 1); > break; > } > case ALL_DOUBLE_INDEXING_TYPES: { >- ASSERT(i < m_butterfly->vectorLength()); >+ ASSERT(i < butterfly->vectorLength()); > if (!v.isNumber()) { > convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v); > return; >@@ -342,13 +347,13 @@ public: > convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v); > return; > } >- m_butterfly->contiguousDouble()[i] = value; >- if (i >= m_butterfly->publicLength()) >- m_butterfly->setPublicLength(i + 1); >+ butterfly->contiguousDouble()[i] = value; >+ if (i >= butterfly->publicLength()) >+ butterfly->setPublicLength(i + 1); > break; > } > case ALL_ARRAY_STORAGE_INDEXING_TYPES: { >- ArrayStorage* storage = m_butterfly->arrayStorage(); >+ ArrayStorage* storage = butterfly->arrayStorage(); > WriteBarrier<Unknown>& x = storage->m_vector[i]; > JSValue old = x.get(); > x.set(vm, this, v); >@@ -371,14 +376,15 @@ public: > > void initializeIndex(VM& vm, unsigned i, JSValue v, IndexingType indexingType) > { >+ Butterfly* butterfly = m_butterfly.get(this); > switch (indexingType) { > case ALL_UNDECIDED_INDEXING_TYPES: { > setIndexQuicklyToUndecided(vm, i, v); > break; > } > case ALL_INT32_INDEXING_TYPES: { >- ASSERT(i < m_butterfly->publicLength()); >- ASSERT(i < m_butterfly->vectorLength()); >+ ASSERT(i < butterfly->publicLength()); >+ ASSERT(i < butterfly->vectorLength()); > if (!v.isInt32()) { > convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v); > break; >@@ -386,14 +392,14 @@ public: > FALLTHROUGH; > } > case ALL_CONTIGUOUS_INDEXING_TYPES: { >- ASSERT(i < m_butterfly->publicLength()); >- ASSERT(i < m_butterfly->vectorLength()); >- m_butterfly->contiguous()[i].set(vm, this, v); >+ ASSERT(i < butterfly->publicLength()); >+ ASSERT(i < butterfly->vectorLength()); >+ butterfly->contiguous()[i].set(vm, this, v); > break; > } > case ALL_DOUBLE_INDEXING_TYPES: { >- ASSERT(i < m_butterfly->publicLength()); >- ASSERT(i < m_butterfly->vectorLength()); >+ ASSERT(i < butterfly->publicLength()); >+ ASSERT(i < butterfly->vectorLength()); > if (!v.isNumber()) { > convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v); > return; >@@ -403,11 +409,11 @@ public: > convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v); > return; > } >- m_butterfly->contiguousDouble()[i] = value; >+ butterfly->contiguousDouble()[i] = value; > break; > } > case ALL_ARRAY_STORAGE_INDEXING_TYPES: { >- ArrayStorage* storage = m_butterfly->arrayStorage(); >+ ArrayStorage* storage = butterfly->arrayStorage(); > ASSERT(i < storage->length()); > ASSERT(i < storage->m_numValuesInVector); > storage->m_vector[i].set(vm, this, v); >@@ -428,7 +434,7 @@ public: > case ALL_CONTIGUOUS_INDEXING_TYPES: > return false; > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- return !!m_butterfly->arrayStorage()->m_sparseMap; >+ return !!m_butterfly.get(this)->arrayStorage()->m_sparseMap; > default: > RELEASE_ASSERT_NOT_REACHED(); > return false; >@@ -445,7 +451,7 @@ public: > case ALL_CONTIGUOUS_INDEXING_TYPES: > return false; > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- return m_butterfly->arrayStorage()->inSparseMode(); >+ return m_butterfly.get(this)->arrayStorage()->inSparseMode(); > default: > RELEASE_ASSERT_NOT_REACHED(); > return false; >@@ -550,11 +556,11 @@ public: > return inlineStorageUnsafe(); > } > >- const Butterfly* butterfly() const { return m_butterfly.get(); } >- Butterfly* butterfly() { return m_butterfly.get(); } >+ const Butterfly* butterfly() const { return m_butterfly.get(this); } >+ Butterfly* butterfly() { return m_butterfly.get(this); } > >- ConstPropertyStorage outOfLineStorage() const { return m_butterfly->propertyStorage(); } >- PropertyStorage outOfLineStorage() { return m_butterfly->propertyStorage(); } >+ ConstPropertyStorage outOfLineStorage() const { return m_butterfly.get(this)->propertyStorage(); } >+ PropertyStorage outOfLineStorage() { return m_butterfly.get(this)->propertyStorage(); } > > const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const > { >@@ -656,7 +662,7 @@ public: > ContiguousJSValues ensureInt32(VM& vm) > { > if (LIKELY(hasInt32(indexingType()))) >- return m_butterfly->contiguousInt32(); >+ return m_butterfly.get(this)->contiguousInt32(); > > return ensureInt32Slow(vm); > } >@@ -668,7 +674,7 @@ public: > ContiguousDoubles ensureDouble(VM& vm) > { > if (LIKELY(hasDouble(indexingType()))) >- return m_butterfly->contiguousDouble(); >+ return m_butterfly.get(this)->contiguousDouble(); > > return ensureDoubleSlow(vm); > } >@@ -678,7 +684,7 @@ public: > ContiguousJSValues ensureContiguous(VM& vm) > { > if (LIKELY(hasContiguous(indexingType()))) >- return m_butterfly->contiguous(); >+ return m_butterfly.get(this)->contiguous(); > > return ensureContiguousSlow(vm); > } >@@ -690,7 +696,7 @@ public: > ArrayStorage* ensureArrayStorage(VM& vm) > { > if (LIKELY(hasAnyArrayStorage(indexingType()))) >- return m_butterfly->arrayStorage(); >+ return m_butterfly.get(this)->arrayStorage(); > > return ensureArrayStorageSlow(vm); > } >@@ -736,7 +742,7 @@ protected: > ArrayStorage* arrayStorage() > { > ASSERT(hasAnyArrayStorage(indexingType())); >- return m_butterfly->arrayStorage(); >+ return m_butterfly.get(this)->arrayStorage(); > } > > // Call this if you want to predicate some actions on whether or not the >@@ -745,7 +751,7 @@ protected: > { > switch (indexingType()) { > case ALL_ARRAY_STORAGE_INDEXING_TYPES: >- return m_butterfly->arrayStorage(); >+ return m_butterfly.get(this)->arrayStorage(); > > default: > return 0; >@@ -809,12 +815,12 @@ protected: > { > ASSERT(length < MAX_ARRAY_INDEX); > ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType())); >- >- if (m_butterfly->vectorLength() < length) >+ >+ if (m_butterfly.get(this)->vectorLength() < length) > ensureLengthSlow(vm, length); > >- if (m_butterfly->publicLength() < length) >- m_butterfly->setPublicLength(length); >+ if (m_butterfly.get(this)->publicLength() < length) >+ m_butterfly.get(this)->setPublicLength(length); > } > > // Call this if you want to shrink the butterfly backing store, and you're >@@ -874,7 +880,7 @@ private: > JS_EXPORT_PRIVATE ArrayStorage* ensureArrayStorageSlow(VM&); > > protected: >- CopyWriteBarrier<Butterfly> m_butterfly; >+ CopyBarrier<Butterfly> m_butterfly; > #if USE(JSVALUE32_64) > private: > uint32_t m_padding; >@@ -1348,7 +1354,7 @@ inline void JSObject::putDirectWithoutTr > DeferGC deferGC(vm.heap); > ASSERT(!value.isGetterSetter() && !(attributes & Accessor)); > ASSERT(!value.isCustomGetterSetter()); >- Butterfly* newButterfly = m_butterfly.get(); >+ Butterfly* newButterfly = m_butterfly.get(this); > if (structure()->putWillGrowOutOfLineStorage()) > newButterfly = growOutOfLineStorage(vm, structure()->outOfLineCapacity(), structure()->suggestedNewOutOfLineStorageCapacity()); > Structure* structure = this->structure(); >Index: Source/JavaScriptCore/runtime/MapData.h >=================================================================== >--- Source/JavaScriptCore/runtime/MapData.h (revision 190603) >+++ Source/JavaScriptCore/runtime/MapData.h (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2013 Apple Inc. All rights reserved. >+ * Copyright (C) 2013, 2015 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -26,6 +26,7 @@ > #ifndef MapData_h > #define MapData_h > >+#include "CopyBarrier.h" > #include "JSCell.h" > #include "WeakGCMapInlines.h" > #include <wtf/HashFunctions.h> >@@ -136,7 +137,7 @@ private: > int32_t m_capacity; > int32_t m_size; > int32_t m_deletedCount; >- Entry* m_entries; >+ CopyBarrier<Entry> m_entries; > WeakGCMap<JSIterator*, JSIterator> m_iterators; > }; > >@@ -145,7 +146,6 @@ ALWAYS_INLINE MapDataImpl<Entry, JSItera > : m_capacity(0) > , m_size(0) > , m_deletedCount(0) >- , m_entries(nullptr) > , m_iterators(vm) > { > } >@@ -204,7 +204,7 @@ ALWAYS_INLINE int32_t MapDataImpl<Entry, > if (isFinished()) > return m_index; > >- Entry* entries = m_mapData->m_entries; >+ Entry* entries = m_mapData->m_entries.get(); > size_t end = m_mapData->m_size; > while (static_cast<size_t>(m_index) < end && !entries[m_index].key()) > m_index++; >Index: Source/JavaScriptCore/runtime/MapDataInlines.h >=================================================================== >--- Source/JavaScriptCore/runtime/MapDataInlines.h (revision 190603) >+++ Source/JavaScriptCore/runtime/MapDataInlines.h (working copy) >@@ -47,7 +47,7 @@ inline void MapDataImpl<Entry, JSIterato > m_capacity = 0; > m_size = 0; > m_deletedCount = 0; >- m_entries = nullptr; >+ m_entries.clear(); > m_iterators.forEach([](JSIterator* iterator, JSIterator*) { > iterator->iteratorData()->didRemoveAllEntries(); > }); >@@ -208,7 +208,7 @@ inline void MapDataImpl<Entry, JSIterato > > m_capacity = newCapacity; > m_size = newEnd; >- m_entries = destination; >+ m_entries.setWithoutBarrier(destination); > } > > template<typename Entry, typename JSIterator> >@@ -217,9 +217,9 @@ inline void MapDataImpl<Entry, JSIterato > ASSERT(!shouldPack()); > RELEASE_ASSERT(newCapacity > 0); > ASSERT(newCapacity >= m_capacity); >- memcpy(destination, m_entries, sizeof(Entry) * m_size); >+ memcpy(destination, m_entries.get(), sizeof(Entry) * m_size); > m_capacity = newCapacity; >- m_entries = destination; >+ m_entries.setWithoutBarrier(destination); > } > > template<typename Entry, typename JSIterator> >@@ -247,7 +247,7 @@ inline CheckedBoolean MapDataImpl<Entry, > template<typename Entry, typename JSIterator> > inline void MapDataImpl<Entry, JSIterator>::visitChildren(JSCell* owner, SlotVisitor& visitor) > { >- Entry* entries = m_entries; >+ Entry* entries = m_entries.get(); > if (!entries) > return; > if (m_deletedCount) { >@@ -261,14 +261,14 @@ inline void MapDataImpl<Entry, JSIterato > visitor.appendValues(reinterpret_cast<WriteBarrier<Unknown>*>(&entries[0]), m_size * (sizeof(Entry) / sizeof(WriteBarrier<Unknown>))); > } > >- visitor.copyLater(owner, MapBackingStoreCopyToken, entries, capacityInBytes()); >+ visitor.copyLater(owner, MapBackingStoreCopyToken, m_entries.get(), capacityInBytes()); > } > > template<typename Entry, typename JSIterator> > inline void MapDataImpl<Entry, JSIterator>::copyBackingStore(CopyVisitor& visitor, CopyToken token) > { >- if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries)) { >- Entry* oldEntries = m_entries; >+ if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries.get())) { >+ Entry* oldEntries = m_entries.get(); > Entry* newEntries = static_cast<Entry*>(visitor.allocateNewSpace(capacityInBytes())); > if (shouldPack()) > replaceAndPackBackingStore(newEntries, m_capacity);
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=262527">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 149852
:
262527
|
262536
|
262572
|
262575
|
262621
|
262633
|
262708
|
262709