Attachment 360518 Details for Bug 193993 – Patch

[patch] Patch

bug-193993-20190129155857.patch (text/plain), 60.46 KB, created by Yusuke Suzuki on 2019-01-29 15:58:58 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2019-01-29 15:58:58 PST

Size: 60.46 KB

patch

obsolete

>Subversion Revision: 240680
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index a9f4332315cbb3821e7cf263e482738bd974a22d..e04378f77bbfcb009bc2c0ed31d5c690dbd87cc3 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,125 @@
>+2019-01-29  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Shrink size of VM by lazily allocating IsoSubspaces for non-common types
>+        https://bugs.webkit.org/show_bug.cgi?id=193993
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        JSC::VM has a lot of IsoSubspaces, and each takes 504B. This unnecessarily makes VM so large.
>+        And some of them are rarely used. We should allocate it lazily.
>+
>+        In this patch, we make some `IsoSubspaces` `std::unique_ptr<IsoSubspace>`. And we add ensureXXXSpace
>+        functions which allocate IsoSubspaces lazily. This function is used by subspaceFor<> in each class.
>+        And we also add subspaceForConcurrently<> function, which is called from concurrent JIT tiers. This
>+        returns nullptr if the subspace is not allocated yet. We ensure the space's initialization by using
>+        WTF::storeStoreFence when lazily allocating it.
>+
>+        In GC's constraint solving, we may touch these lazily allocated spaces. At that time, we check the
>+        existence of the space before touching this. This is not racy because the main thread is stopped when
>+        the constraint solving is working.
>+
>+        This changes sizeof(VM) from 72664 to 61840, which is nice since VM now fits in 64KB.
>+
>+        * API/JSCallbackFunction.h:
>+        * API/ObjCCallbackFunction.h:
>+        (JSC::ObjCCallbackFunction::subspaceFor):
>+        (JSC::ObjCCallbackFunction::subspaceForConcurrently):
>+        * bytecode/CodeBlock.h:
>+        (JSC::CodeBlock::subspaceForConcurrently):
>+        * bytecode/EvalCodeBlock.h:
>+        * bytecode/ModuleProgramCodeBlock.h:
>+        * dfg/DFGSpeculativeJIT.cpp:
>+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
>+        (JSC::DFG::SpeculativeJIT::compileMakeRope):
>+        (JSC::DFG::SpeculativeJIT::compileNewObject):
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::compileMakeRope):
>+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
>+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
>+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
>+        (JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedCell):
>+        * heap/Heap.cpp:
>+        (JSC::Heap::finalizeUnconditionalFinalizers):
>+        (JSC::Heap::deleteAllCodeBlocks):
>+        (JSC::Heap::addCoreConstraints):
>+        * jit/AssemblyHelpers.h:
>+        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
>+        (JSC::AssemblyHelpers::emitAllocateVariableSizedCell):
>+        * jit/JITOpcodes.cpp:
>+        (JSC::JIT::emit_op_new_object):
>+        * jit/JITOpcodes32_64.cpp:
>+        (JSC::JIT::emit_op_new_object):
>+        * runtime/DirectEvalExecutable.h:
>+        * runtime/ErrorInstance.h:
>+        (JSC::ErrorInstance::subspaceFor):
>+        (JSC::ErrorInstance::subspaceForConcurrently):
>+        * runtime/ExecutableBase.h:
>+        (JSC::ExecutableBase::subspaceForConcurrently):
>+        * runtime/IndirectEvalExecutable.h:
>+        * runtime/JSAsyncFunction.h:
>+        * runtime/JSAsyncGeneratorFunction.h:
>+        * runtime/JSBoundFunction.h:
>+        * runtime/JSCell.h:
>+        (JSC::subspaceForConcurrently):
>+        * runtime/JSCellInlines.h:
>+        (JSC::JSCell::subspaceForConcurrently):
>+        * runtime/JSCustomGetterSetterFunction.h:
>+        * runtime/JSGeneratorFunction.h:
>+        * runtime/JSNativeStdFunction.h:
>+        * runtime/ModuleProgramExecutable.h:
>+        * runtime/ProxyRevoke.h:
>+        * runtime/VM.cpp:
>+        (JSC::VM::VM):
>+        (JSC::VM::ensureAsyncFunctionSpaceSlow):
>+        (JSC::VM::ensureAsyncGeneratorFunctionSpaceSlow):
>+        (JSC::VM::ensureBoundFunctionSpaceSlow):
>+        (JSC::VM::ensureCallbackFunctionSpaceSlow):
>+        (JSC::VM::ensureCustomGetterSetterFunctionSpaceSlow):
>+        (JSC::VM::ensureErrorInstanceSpaceSlow):
>+        (JSC::VM::ensureGeneratorFunctionSpaceSlow):
>+        (JSC::VM::ensureNativeStdFunctionSpaceSlow):
>+        (JSC::VM::ensureProxyRevokeSpaceSlow):
>+        (JSC::VM::ensureWeakMapSpaceSlow):
>+        (JSC::VM::ensureWeakSetSpaceSlow):
>+        (JSC::VM::ensureObjCCallbackFunctionSpaceSlow):
>+        (JSC::VM::ensureWebAssemblyCodeBlockSpaceSlow):
>+        (JSC::VM::ensureWebAssemblyFunctionSpaceSlow):
>+        (JSC::VM::ensureWebAssemblyWrapperFunctionSpaceSlow):
>+        (JSC::VM::ensureEvalCodeBlockSpaceSlow):
>+        (JSC::VM::ensureModuleProgramCodeBlockSpaceSlow):
>+        (JSC::VM::ensureDirectEvalExecutableSpaceSlow):
>+        (JSC::VM::ensureIndirectEvalExecutableSpaceSlow):
>+        (JSC::VM::ensureModuleProgramExecutableSpaceSlow):
>+        * runtime/VM.h:
>+        (JSC::VM::ensureEvalCodeBlockSpace):
>+        (JSC::VM::ensureModuleProgramCodeBlockSpace):
>+        (JSC::VM::forEachCodeBlockSpace):
>+        (JSC::VM::ensureDirectEvalExecutableSpace):
>+        (JSC::VM::ensureIndirectEvalExecutableSpace):
>+        (JSC::VM::ensureModuleProgramExecutableSpace):
>+        (JSC::VM::forEachScriptExecutableSpace):
>+        (JSC::VM::ensureAsyncFunctionSpace):
>+        (JSC::VM::ensureAsyncGeneratorFunctionSpace):
>+        (JSC::VM::ensureBoundFunctionSpace):
>+        (JSC::VM::ensureCallbackFunctionSpace):
>+        (JSC::VM::ensureCustomGetterSetterFunctionSpace):
>+        (JSC::VM::ensureErrorInstanceSpace):
>+        (JSC::VM::ensureGeneratorFunctionSpace):
>+        (JSC::VM::ensureNativeStdFunctionSpace):
>+        (JSC::VM::ensureProxyRevokeSpace):
>+        (JSC::VM::ensureWeakMapSpace):
>+        (JSC::VM::ensureWeakSetSpace):
>+        (JSC::VM::ensureObjCCallbackFunctionSpace):
>+        (JSC::VM::ensureWebAssemblyCodeBlockSpace):
>+        (JSC::VM::ensureWebAssemblyFunctionSpace):
>+        (JSC::VM::ensureWebAssemblyWrapperFunctionSpace):
>+        * runtime/WeakMapImpl.h:
>+        (JSC::WeakMapImpl::subspaceFor):
>+        (JSC::WeakMapImpl::subspaceForConcurrently):
>+        * wasm/js/JSWebAssemblyCodeBlock.h:
>+        * wasm/js/WebAssemblyFunction.h:
>+        * wasm/js/WebAssemblyWrapperFunction.h:
>+
> 2019-01-29  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         [JSC] FTL should handle LocalAllocator*
>diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.h b/Source/JavaScriptCore/API/JSCallbackFunction.h
>index 6cf9cfc2e4fab7c01ddc6e02b663850b0a7f1642..4abf338f84366dc9188fb6157d55c0fd748fdb86 100644
>--- a/Source/JavaScriptCore/API/JSCallbackFunction.h
>+++ b/Source/JavaScriptCore/API/JSCallbackFunction.h
>@@ -40,7 +40,13 @@ class JSCallbackFunction final : public InternalFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.callbackFunctionSpace;
>+        return &vm.ensureCallbackFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.callbackFunctionSpace.get();
>     }
> 
>     static JSCallbackFunction* create(VM&, JSGlobalObject*, JSObjectCallAsFunctionCallback, const String& name);
>diff --git a/Source/JavaScriptCore/API/ObjCCallbackFunction.h b/Source/JavaScriptCore/API/ObjCCallbackFunction.h
>index c90ff0c68a3bd3a6b104b51a2204623030188da4..e5e1c3ba1d0afc3b2d60d5f767fbcacef6d80d01 100644
>--- a/Source/JavaScriptCore/API/ObjCCallbackFunction.h
>+++ b/Source/JavaScriptCore/API/ObjCCallbackFunction.h
>@@ -51,7 +51,13 @@ class ObjCCallbackFunction : public InternalFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.objCCallbackFunctionSpace;
>+        return &vm.ensureObjCCallbackFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.objCCallbackFunctionSpace.get();
>     }
> 
>     static ObjCCallbackFunction* create(VM&, JSGlobalObject*, const String& name, std::unique_ptr<ObjCCallbackFunctionImpl>);
>diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
>index c747426b38e566ebb9e842ce23ed59384eb0ae20..da4266f8f18439f9fe1fc20871bb9eca57f2bd2d 100644
>--- a/Source/JavaScriptCore/bytecode/CodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/CodeBlock.h
>@@ -117,6 +117,8 @@ class CodeBlock : public JSCell {
> 
>     template<typename>
>     static void subspaceFor(VM&) { }
>+    template<typename>
>+    static void subspaceForConcurrently(VM&) { }
> 
>     DECLARE_INFO;
> 
>diff --git a/Source/JavaScriptCore/bytecode/EvalCodeBlock.h b/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
>index 6775c362b5d805149dd51ac3210e01d764fc93c5..58338b0bc1993addf8465a468747b3c15794eb82 100644
>--- a/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
>@@ -41,7 +41,15 @@ class EvalCodeBlock final : public GlobalCodeBlock {
>     template<typename>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.evalCodeBlockSpace.space;
>+        return &vm.ensureEvalCodeBlockSpace().space;
>+    }
>+
>+    template<typename>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        if (auto* space = vm.evalCodeBlockSpace.get())
>+            return &space->space;
>+        return nullptr;
>     }
> 
>     static EvalCodeBlock* create(VM* vm, CopyParsedBlockTag, EvalCodeBlock& other)
>diff --git a/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h b/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
>index ae99f77d5b43682003ce4b057d948c43ae156350..6482772c04b756c244438b98c80b00dc6622def7 100644
>--- a/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
>@@ -42,7 +42,15 @@ class ModuleProgramCodeBlock final : public GlobalCodeBlock {
>     template<typename>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.moduleProgramCodeBlockSpace.space;
>+        return &vm.ensureModuleProgramCodeBlockSpace().space;
>+    }
>+
>+    template<typename>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        if (auto* space = vm.moduleProgramCodeBlockSpace.get())
>+            return &space->space;
>+        return nullptr;
>     }
> 
>     static ModuleProgramCodeBlock* create(VM* vm, CopyParsedBlockTag, ModuleProgramCodeBlock& other)
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index 16e431c4a79b9cb5bad88135c6ad05fce4793d30..a453611c635a9044d061f643c7b4662c1d21e726 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -130,7 +130,9 @@ void SpeculativeJIT::emitAllocateRawObject(GPRReg resultGPR, RegisteredStructure
>     }
> 
>     size_t allocationSize = JSFinalObject::allocationSize(inlineCapacity);
>-    Allocator allocator = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>+    Allocator allocator;
>+    if (auto* subspace = subspaceForConcurrently<JSFinalObject>(*m_jit.vm()))
>+        allocator = subspace->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>     if (allocator) {
>         emitAllocateJSObject(resultGPR, JITAllocator::constant(allocator), scratchGPR, TrustedImmPtr(structure), storageGPR, scratch2GPR, slowCases);
>         m_jit.emitInitializeInlineStorage(resultGPR, structure->inlineCapacity());
>@@ -4361,7 +4363,9 @@ void SpeculativeJIT::compileMakeRope(Node* node)
>     GPRReg scratchGPR = scratch.gpr();
>     
>     JITCompiler::JumpList slowPath;
>-    Allocator allocatorValue = subspaceFor<JSRopeString>(*m_jit.vm())->allocatorForNonVirtual(sizeof(JSRopeString), AllocatorForMode::AllocatorIfExists);
>+    Allocator allocatorValue;
>+    if (auto* subspace = subspaceForConcurrently<JSRopeString>(*m_jit.vm()))
>+        allocatorValue = subspace->allocatorForNonVirtual(sizeof(JSRopeString), AllocatorForMode::AllocatorIfExists);
>     emitAllocateJSCell(resultGPR, JITAllocator::constant(allocatorValue), allocatorGPR, TrustedImmPtr(m_jit.graph().registerStructure(m_jit.vm()->stringStructure.get())), scratchGPR, slowPath);
>         
>     m_jit.storePtr(TrustedImmPtr(nullptr), JITCompiler::Address(resultGPR, JSString::offsetOfValue()));
>@@ -12542,7 +12546,9 @@ void SpeculativeJIT::compileNewObject(Node* node)
> 
>     RegisteredStructure structure = node->structure();
>     size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
>-    Allocator allocatorValue = subspaceFor<JSFinalObject>(*m_jit.vm())->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>+    Allocator allocatorValue;
>+    if (auto* subspace = subspaceForConcurrently<JSFinalObject>(*m_jit.vm()))
>+        allocatorValue = subspace->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
> 
>     if (!allocatorValue)
>         slowPath.append(m_jit.jump());
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 4f3a5a054b58b145c70c8a4a6a4af6cc0f5a0807..008d1fec1420ee2743d8883be9bfe1965207fe4b 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -6471,7 +6471,9 @@ class LowerDFGToB3 {
>         
>         LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
>         
>-        Allocator allocator = subspaceFor<JSRopeString>(vm())->allocatorForNonVirtual(sizeof(JSRopeString), AllocatorForMode::AllocatorIfExists);
>+        Allocator allocator;
>+        if (auto* subspace = subspaceForConcurrently<JSRopeString>(vm()))
>+            allocator = subspace->allocatorForNonVirtual(sizeof(JSRopeString), AllocatorForMode::AllocatorIfExists);
>         
>         LValue result = allocateCell(
>             m_out.constIntPtr(allocator.localAllocator()), vm().stringStructure.get(), slowPath);
>@@ -10722,7 +10724,9 @@ class LowerDFGToB3 {
>             
>             if (structure->outOfLineCapacity() || hasIndexedProperties(structure->indexingType())) {
>                 size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
>-                Allocator cellAllocator = subspaceFor<JSFinalObject>(vm())->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>+                Allocator cellAllocator;
>+                if (auto* subspace = subspaceForConcurrently<JSFinalObject>(vm()))
>+                    cellAllocator = subspace->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
> 
>                 bool hasIndexingHeader = hasIndexedProperties(structure->indexingType());
>                 unsigned indexingHeaderSize = 0;
>@@ -13189,7 +13193,9 @@ class LowerDFGToB3 {
>     LValue allocateObject(
>         size_t size, StructureType structure, LValue butterfly, LBasicBlock slowPath)
>     {
>-        Allocator allocator = subspaceFor<ClassType>(vm())->allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
>+        Allocator allocator;
>+        if (auto* subspace = subspaceForConcurrently<ClassType>(vm()))
>+            allocator = subspace->allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
>         return allocateObject(
>             m_out.constIntPtr(allocator.localAllocator()), structure, butterfly, slowPath);
>     }
>@@ -13253,7 +13259,9 @@ class LowerDFGToB3 {
>     LValue allocateVariableSizedObject(
>         LValue size, RegisteredStructure structure, LValue butterfly, LBasicBlock slowPath)
>     {
>-        LValue allocator = allocatorForSize(*subspaceFor<ClassType>(vm()), size, slowPath);
>+        CompleteSubspace* subspace = subspaceForConcurrently<ClassType>(vm());
>+        RELEASE_ASSERT_WITH_MESSAGE(subspace, "CompleteSubspace is always allocated");
>+        LValue allocator = allocatorForSize(*subspace, size, slowPath);
>         return allocateObject(allocator, structure, butterfly, slowPath);
>     }
> 
>@@ -13261,14 +13269,18 @@ class LowerDFGToB3 {
>     LValue allocateVariableSizedCell(
>         LValue size, Structure* structure, LBasicBlock slowPath)
>     {
>-        LValue allocator = allocatorForSize(*subspaceFor<ClassType>(vm()), size, slowPath);
>+        CompleteSubspace* subspace = subspaceForConcurrently<ClassType>(vm());
>+        RELEASE_ASSERT_WITH_MESSAGE(subspace, "CompleteSubspace is always allocated");
>+        LValue allocator = allocatorForSize(*subspace, size, slowPath);
>         return allocateCell(allocator, structure, slowPath);
>     }
>     
>     LValue allocateObject(RegisteredStructure structure)
>     {
>         size_t allocationSize = JSFinalObject::allocationSize(structure.get()->inlineCapacity());
>-        Allocator allocator = subspaceFor<JSFinalObject>(vm())->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>+        Allocator allocator;
>+        if (auto* subspace = subspaceForConcurrently<JSFinalObject>(vm()))
>+            allocator = subspace->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>         
>         // FIXME: If the allocator is null, we could simply emit a normal C call to the allocator
>         // instead of putting it on the slow path.
>diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
>index 06ea3b62e6436440323b3a9dd3c2debe8b002e7b..2a44e620d259d9dfd646ca62e6e3addcb4e358f4 100644
>--- a/Source/JavaScriptCore/heap/Heap.cpp
>+++ b/Source/JavaScriptCore/heap/Heap.cpp
>@@ -573,12 +573,16 @@ void Heap::finalizeUnconditionalFinalizers()
>             this->finalizeMarkedUnconditionalFinalizers<CodeBlock>(space.finalizerSet);
>         });
>     finalizeMarkedUnconditionalFinalizers<ExecutableToCodeBlockEdge>(vm()->executableToCodeBlockEdgesWithFinalizers);
>-    finalizeMarkedUnconditionalFinalizers<JSWeakSet>(vm()->weakSetSpace);
>-    finalizeMarkedUnconditionalFinalizers<JSWeakMap>(vm()->weakMapSpace);
>-    finalizeMarkedUnconditionalFinalizers<ErrorInstance>(vm()->errorInstanceSpace);
>+    if (vm()->weakSetSpace)
>+        finalizeMarkedUnconditionalFinalizers<JSWeakSet>(*vm()->weakSetSpace);
>+    if (vm()->weakMapSpace)
>+        finalizeMarkedUnconditionalFinalizers<JSWeakMap>(*vm()->weakMapSpace);
>+    if (vm()->errorInstanceSpace)
>+        finalizeMarkedUnconditionalFinalizers<ErrorInstance>(*vm()->errorInstanceSpace);
> 
> #if ENABLE(WEBASSEMBLY)
>-    finalizeMarkedUnconditionalFinalizers<JSWebAssemblyCodeBlock>(vm()->webAssemblyCodeBlockSpace);
>+    if (vm()->webAssemblyCodeBlockSpace)
>+        finalizeMarkedUnconditionalFinalizers<JSWebAssemblyCodeBlock>(*vm()->webAssemblyCodeBlockSpace);
> #endif
> }
> 
>@@ -896,11 +900,13 @@ void Heap::deleteAllCodeBlocks(DeleteAllCodeEffort effort)
>         // points into a CodeBlock that could be dead. The IC will still succeed because
>         // it uses a callee check, but then it will call into dead code.
>         HeapIterationScope heapIterationScope(*this);
>-        vm.webAssemblyCodeBlockSpace.forEachLiveCell([&] (HeapCell* cell, HeapCell::Kind kind) {
>-            ASSERT_UNUSED(kind, kind == HeapCell::JSCell);
>-            JSWebAssemblyCodeBlock* codeBlock = static_cast<JSWebAssemblyCodeBlock*>(cell);
>-            codeBlock->clearJSCallICs(vm);
>-        });
>+        if (vm.webAssemblyCodeBlockSpace) {
>+            vm.webAssemblyCodeBlockSpace->forEachLiveCell([&] (HeapCell* cell, HeapCell::Kind kind) {
>+                ASSERT_UNUSED(kind, kind == HeapCell::JSCell);
>+                JSWebAssemblyCodeBlock* codeBlock = static_cast<JSWebAssemblyCodeBlock*>(cell);
>+                codeBlock->clearJSCallICs(vm);
>+            });
>+        }
>     }
> #endif
> }
>@@ -2730,7 +2736,8 @@ void Heap::addCoreConstraints()
>             };
>             
>             add(vm.executableToCodeBlockEdgesWithConstraints);
>-            add(vm.weakMapSpace);
>+            if (vm.weakMapSpace)
>+                add(*vm.weakMapSpace);
>         },
>         ConstraintVolatility::GreyedByMarking,
>         ConstraintParallelism::Parallel);
>diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>index 283bb03033bc583703ecd6fc0bc8bf87f93e7528..8abd20067ae2aade2ff94d6c7a7a37984272a24b 100644
>--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h
>+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>@@ -1752,7 +1752,9 @@ class AssemblyHelpers : public MacroAssembler {
>         VM& vm, GPRReg resultGPR, StructureType structure, StorageType storage, GPRReg scratchGPR1,
>         GPRReg scratchGPR2, JumpList& slowPath, size_t size)
>     {
>-        Allocator allocator = subspaceFor<ClassType>(vm)->allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
>+        Allocator allocator;
>+        if (auto* subspace = subspaceForConcurrently<ClassType>(vm))
>+            allocator = subspace->allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
>         emitAllocateJSObject(resultGPR, JITAllocator::constant(allocator), scratchGPR1, structure, storage, scratchGPR2, slowPath);
>     }
>     
>@@ -1769,8 +1771,9 @@ class AssemblyHelpers : public MacroAssembler {
>     template<typename ClassType, typename StructureType>
>     void emitAllocateVariableSizedCell(VM& vm, GPRReg resultGPR, StructureType structure, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
>     {
>-        CompleteSubspace& subspace = *subspaceFor<ClassType>(vm);
>-        emitAllocateVariableSized(resultGPR, subspace, allocationSize, scratchGPR1, scratchGPR2, slowPath);
>+        CompleteSubspace* subspace = subspaceForConcurrently<ClassType>(vm);
>+        RELEASE_ASSERT_WITH_MESSAGE(subspace, "CompleteSubspace is always allocated");
>+        emitAllocateVariableSized(resultGPR, *subspace, allocationSize, scratchGPR1, scratchGPR2, slowPath);
>         emitStoreStructureWithTypeInfo(structure, resultGPR, scratchGPR2);
>     }
> 
>diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
>index 378dc505f7007b5207a2115a856002d54cf11cb7..6ad0cd818fd009975d1c1f9322fdadc9ba75dd5a 100644
>--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
>+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
>@@ -96,7 +96,9 @@ void JIT::emit_op_new_object(const Instruction* currentInstruction)
>     auto& metadata = bytecode.metadata(m_codeBlock);
>     Structure* structure = metadata.m_objectAllocationProfile.structure();
>     size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
>-    Allocator allocator = subspaceFor<JSFinalObject>(*m_vm)->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>+    Allocator allocator;
>+    if (auto* subspace = subspaceForConcurrently<JSFinalObject>(*m_vm))
>+        allocator = subspace->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
> 
>     RegisterID resultReg = regT0;
>     RegisterID allocatorReg = regT1;
>diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>index f36cd4339dee03f75ed10df196948e2317570f69..784fd5ca32f9301cc051c674353262fcd3bd36af 100644
>--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
>@@ -84,7 +84,9 @@ void JIT::emit_op_new_object(const Instruction* currentInstruction)
>     auto& metadata = bytecode.metadata(m_codeBlock);
>     Structure* structure = metadata.m_objectAllocationProfile.structure();
>     size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
>-    Allocator allocator = subspaceFor<JSFinalObject>(*m_vm)->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>+    Allocator allocator;
>+    if (auto* subspace = subspaceForConcurrently<JSFinalObject>(*m_vm))
>+        allocator = subspace->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
> 
>     RegisterID resultReg = returnValueGPR;
>     RegisterID allocatorReg = regT1;
>diff --git a/Source/JavaScriptCore/runtime/DirectEvalExecutable.h b/Source/JavaScriptCore/runtime/DirectEvalExecutable.h
>index 32067080e78f797345851fd79d4f0ba6fc18feae..5cf252975c6a8e5796aaad45884c88fce9ef97a2 100644
>--- a/Source/JavaScriptCore/runtime/DirectEvalExecutable.h
>+++ b/Source/JavaScriptCore/runtime/DirectEvalExecutable.h
>@@ -34,7 +34,15 @@ class DirectEvalExecutable final : public EvalExecutable {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.directEvalExecutableSpace.space;
>+        return &vm.ensureDirectEvalExecutableSpace().space;
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        if (auto* space = vm.directEvalExecutableSpace.get())
>+            return &space->space;
>+        return nullptr;
>     }
> 
>     static DirectEvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, DerivedContextType, bool isArrowFunctionContext, EvalContextType, const VariableEnvironment*);
>diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h
>index d95cbf81b40169581a5e2a144959bf72e49e2534..8cc17d294ac5986493929248a486ea0fc70e5201 100644
>--- a/Source/JavaScriptCore/runtime/ErrorInstance.h
>+++ b/Source/JavaScriptCore/runtime/ErrorInstance.h
>@@ -75,7 +75,13 @@ class ErrorInstance : public JSDestructibleObject {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.errorInstanceSpace;
>+        return &vm.ensureErrorInstanceSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.errorInstanceSpace.get();
>     }
> 
>     void finalizeUnconditionally(VM&);
>diff --git a/Source/JavaScriptCore/runtime/ExecutableBase.h b/Source/JavaScriptCore/runtime/ExecutableBase.h
>index c719ffba5f893a6ff5b82d67a42820dfd0bc8e43..da867e03199c2b016f9c60fe4aac57749fe1f832 100644
>--- a/Source/JavaScriptCore/runtime/ExecutableBase.h
>+++ b/Source/JavaScriptCore/runtime/ExecutableBase.h
>@@ -86,6 +86,8 @@ class ExecutableBase : public JSCell {
>     // Force subclasses to override this.
>     template<typename>
>     static void subspaceFor(VM&) { }
>+    template<typename>
>+    static void subspaceForConcurrently(VM&) { }
>         
>     CodeBlockHash hashFor(CodeSpecializationKind) const;
> 
>diff --git a/Source/JavaScriptCore/runtime/IndirectEvalExecutable.h b/Source/JavaScriptCore/runtime/IndirectEvalExecutable.h
>index d868d93efc342cca017720de22646c1af2632e76..f3ddeeca765b97e5e78f5cc20bd530e411dd7cb4 100644
>--- a/Source/JavaScriptCore/runtime/IndirectEvalExecutable.h
>+++ b/Source/JavaScriptCore/runtime/IndirectEvalExecutable.h
>@@ -34,7 +34,15 @@ class IndirectEvalExecutable final : public EvalExecutable {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.indirectEvalExecutableSpace.space;
>+        return &vm.ensureIndirectEvalExecutableSpace().space;
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        if (auto* space = vm.indirectEvalExecutableSpace.get())
>+            return &space->space;
>+        return nullptr;
>     }
> 
>     static IndirectEvalExecutable* create(ExecState*, const SourceCode&, bool isInStrictContext, DerivedContextType, bool isArrowFunctionContext, EvalContextType);
>diff --git a/Source/JavaScriptCore/runtime/JSAsyncFunction.h b/Source/JavaScriptCore/runtime/JSAsyncFunction.h
>index 459d5a9f77a6f261f8cdb8ac968b13c37c22a2a0..45b7f57431acf5443ac4ffef28b66f703ce6de38 100644
>--- a/Source/JavaScriptCore/runtime/JSAsyncFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSAsyncFunction.h
>@@ -41,9 +41,16 @@ class JSAsyncFunction final : public JSFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.asyncFunctionSpace;
>+        return &vm.ensureAsyncFunctionSpace();
>     }
> 
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.asyncFunctionSpace.get();
>+    }
>+
>+
>     DECLARE_EXPORT_INFO;
> 
>     static JSAsyncFunction* create(VM&, FunctionExecutable*, JSScope*);
>diff --git a/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h b/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h
>index a38c6225ba816a5e379587e4c2b6d141251f7aee..8808334e21bcbc043cea8338374738d616e33472 100644
>--- a/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h
>@@ -41,7 +41,13 @@ class JSAsyncGeneratorFunction final : public JSFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.asyncGeneratorFunctionSpace;
>+        return &vm.ensureAsyncGeneratorFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.asyncGeneratorFunctionSpace.get();
>     }
> 
>     DECLARE_EXPORT_INFO;
>diff --git a/Source/JavaScriptCore/runtime/JSBoundFunction.h b/Source/JavaScriptCore/runtime/JSBoundFunction.h
>index 928ddc58a219f12a39d97d4d1008485d99688491..64ee2c0eb4397431f9b296425151673e48acb05f 100644
>--- a/Source/JavaScriptCore/runtime/JSBoundFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSBoundFunction.h
>@@ -45,7 +45,13 @@ class JSBoundFunction final : public JSFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.boundFunctionSpace;
>+        return &vm.ensureBoundFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.boundFunctionSpace.get();
>     }
> 
>     static JSBoundFunction* create(VM&, ExecState*, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSArray* boundArgs, int, const String& name);
>diff --git a/Source/JavaScriptCore/runtime/JSCell.h b/Source/JavaScriptCore/runtime/JSCell.h
>index 9e8ba60d9f621e49881fe22026cafdaa8ea7eda8..29c7714939c6d82f406484c863be26a7718327db 100644
>--- a/Source/JavaScriptCore/runtime/JSCell.h
>+++ b/Source/JavaScriptCore/runtime/JSCell.h
>@@ -90,6 +90,8 @@ class JSCell : public HeapCell {
>     // https://bugs.webkit.org/show_bug.cgi?id=166988
>     template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM&);
>+    template<typename CellType>
>+    static CompleteSubspace* subspaceForConcurrently(VM&);
> 
>     static JSCell* seenMultipleCalleeObjects() { return bitwise_cast<JSCell*>(static_cast<uintptr_t>(1)); }
> 
>@@ -297,4 +299,10 @@ inline auto subspaceFor(VM& vm)
>     return Type::template subspaceFor<Type>(vm);
> }
> 
>+template<typename Type>
>+inline auto subspaceForConcurrently(VM& vm)
>+{
>+    return Type::template subspaceForConcurrently<Type>(vm);
>+}
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/runtime/JSCellInlines.h b/Source/JavaScriptCore/runtime/JSCellInlines.h
>index 3c5ad64857c65356d06c4cfd3a38dc436fcbc3fa..d1a90c4a390caa712e6c62edfbbe4002242f79d6 100644
>--- a/Source/JavaScriptCore/runtime/JSCellInlines.h
>+++ b/Source/JavaScriptCore/runtime/JSCellInlines.h
>@@ -153,6 +153,12 @@ CompleteSubspace* JSCell::subspaceFor(VM& vm)
>     return &vm.cellDangerousBitsSpace;
> }
> 
>+template<typename CellType>
>+CompleteSubspace* JSCell::subspaceForConcurrently(VM& vm)
>+{
>+    return subspaceFor<CellType>(vm);
>+}
>+
> template<typename T>
> ALWAYS_INLINE void* tryAllocateCellHelper(Heap& heap, size_t size, GCDeferralContext* deferralContext, AllocationFailureMode failureMode)
> {
>diff --git a/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h b/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h
>index 17c7f18be8db35a85d216906312f1a1e8d5439cc..73b82f0b00af7238da8f30d0710f7565d893a437 100644
>--- a/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h
>@@ -43,7 +43,13 @@ class JSCustomGetterSetterFunction final : public JSFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.customGetterSetterFunctionSpace;
>+        return &vm.ensureCustomGetterSetterFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.customGetterSetterFunctionSpace.get();
>     }
> 
>     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>diff --git a/Source/JavaScriptCore/runtime/JSGeneratorFunction.h b/Source/JavaScriptCore/runtime/JSGeneratorFunction.h
>index 0e88fc735cb92a72b1c0b495b7fa630c25fe9490..d0aca15d70168ef44f1a4d167991b1e254953b1b 100644
>--- a/Source/JavaScriptCore/runtime/JSGeneratorFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSGeneratorFunction.h
>@@ -69,7 +69,13 @@ class JSGeneratorFunction final : public JSFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.generatorFunctionSpace;
>+        return &vm.ensureGeneratorFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.generatorFunctionSpace.get();
>     }
> 
>     DECLARE_EXPORT_INFO;
>diff --git a/Source/JavaScriptCore/runtime/JSNativeStdFunction.h b/Source/JavaScriptCore/runtime/JSNativeStdFunction.h
>index e2041496f8e7aa208c0fc66a034980d98d0ff0ac..3134284f7511c866a8f33d2e82c0055e58ccd4ec 100644
>--- a/Source/JavaScriptCore/runtime/JSNativeStdFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSNativeStdFunction.h
>@@ -43,7 +43,13 @@ class JSNativeStdFunction final : public JSFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.nativeStdFunctionSpace;
>+        return &vm.ensureNativeStdFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.nativeStdFunctionSpace.get();
>     }
> 
>     DECLARE_EXPORT_INFO;
>diff --git a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
>index f5171d4c34ad27d9b92167d64471964156b0d524..f859578880aac21e320a8e6c9d8f4852293c06e7 100644
>--- a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
>+++ b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
>@@ -39,7 +39,15 @@ class ModuleProgramExecutable final : public ScriptExecutable {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.moduleProgramExecutableSpace.space;
>+        return &vm.ensureModuleProgramExecutableSpace().space;
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        if (auto* space = vm.moduleProgramExecutableSpace.get())
>+            return &space->space;
>+        return nullptr;
>     }
> 
>     static ModuleProgramExecutable* create(ExecState*, const SourceCode&);
>diff --git a/Source/JavaScriptCore/runtime/ProxyRevoke.h b/Source/JavaScriptCore/runtime/ProxyRevoke.h
>index 322096564e9870cc392e383c9005f770ba8e7e80..ecdc944a07841134ce651f459f1646ac48f3dfa3 100644
>--- a/Source/JavaScriptCore/runtime/ProxyRevoke.h
>+++ b/Source/JavaScriptCore/runtime/ProxyRevoke.h
>@@ -39,7 +39,13 @@ class ProxyRevoke final : public InternalFunction {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.proxyRevokeSpace;
>+        return &vm.ensureProxyRevokeSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.proxyRevokeSpace.get();
>     }
> 
>     static ProxyRevoke* create(VM&, Structure*, ProxyObject*);
>diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
>index 9b954c229bc0712dbf28c6cfd729f8c700d91617..a592de8175a1af63c74f265d804046f157c92e9c 100644
>--- a/Source/JavaScriptCore/runtime/VM.cpp
>+++ b/Source/JavaScriptCore/runtime/VM.cpp
>@@ -289,44 +289,20 @@ VM::VM(VMType vmType, HeapType heapType)
>     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
>     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
>     , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap, segmentedVariableObjectHeapCellType.get(), fastMallocAllocator.get())
>-    , asyncFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncFunction)
>-    , asyncGeneratorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncGeneratorFunction)
>-    , boundFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSBoundFunction)
>-    , callbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSCallbackFunction)
>-    , customGetterSetterFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSCustomGetterSetterFunction)
>     , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, cellDangerousBitsHeapCellType.get(), ExecutableToCodeBlockEdge)
>     , functionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSFunction)
>-    , generatorFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSGeneratorFunction)
>     , inferredValueSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), InferredValue)
>     , internalFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), InternalFunction)
>     , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), NativeExecutable)
>-    , nativeStdFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSNativeStdFunction)
>-#if JSC_OBJC_API_ENABLED
>-    , objCCallbackFunctionSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
>-#endif
>     , propertyTableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), PropertyTable)
>-    , proxyRevokeSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ProxyRevoke)
>     , structureRareDataSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), StructureRareData)
>     , structureSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), Structure)
>-    , weakSetSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakSet)
>-    , weakMapSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakMap)
>-    , errorInstanceSpace ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorInstance)
>-#if ENABLE(WEBASSEMBLY)
>-    , webAssemblyCodeBlockSpace ISO_SUBSPACE_INIT(heap, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock)
>-    , webAssemblyFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyFunction)
>-    , webAssemblyWrapperFunctionSpace ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyWrapperFunction)
>-#endif
>     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
>     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
>     , inferredValuesWithFinalizers(inferredValueSpace)
>-    , evalCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock)
>     , functionCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionCodeBlock)
>-    , moduleProgramCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramCodeBlock)
>     , programCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramCodeBlock)
>-    , directEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), DirectEvalExecutable)
>     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
>-    , indirectEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), IndirectEvalExecutable)
>-    , moduleProgramExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramExecutable)
>     , programExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramExecutable)
>     , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), UnlinkedFunctionExecutable)
>     , vmType(vmType)
>@@ -1246,6 +1222,190 @@ void VM::ensureShadowChicken()
>     m_shadowChicken = std::make_unique<ShadowChicken>();
> }
> 
>+IsoSubspace& VM::ensureAsyncFunctionSpaceSlow()
>+{
>+    ASSERT(!asyncFunctionspace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncFunction);
>+    WTF::storeStoreFence();
>+    asyncFunctionSpace = WTFMove(space);
>+    return *asyncFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureAsyncGeneratorFunctionSpaceSlow()
>+{
>+    ASSERT(!asyncGeneratorFunctionspace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSAsyncGeneratorFunction);
>+    WTF::storeStoreFence();
>+    asyncGeneratorFunctionSpace = WTFMove(space);
>+    return *asyncGeneratorFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureBoundFunctionSpaceSlow()
>+{
>+    ASSERT(!boundFunctionspace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSBoundFunction);
>+    WTF::storeStoreFence();
>+    boundFunctionSpace = WTFMove(space);
>+    return *boundFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureCallbackFunctionSpaceSlow()
>+{
>+    ASSERT(!callbackFunctionspace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSCallbackFunction);
>+    WTF::storeStoreFence();
>+    callbackFunctionSpace = WTFMove(space);
>+    return *callbackFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureCustomGetterSetterFunctionSpaceSlow()
>+{
>+    ASSERT(!customGetterSetterFunctionspace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSCustomGetterSetterFunction);
>+    WTF::storeStoreFence();
>+    customGetterSetterFunctionSpace = WTFMove(space);
>+    return *customGetterSetterFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureErrorInstanceSpaceSlow()
>+{
>+    ASSERT(!errorInstanceSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ErrorInstance);
>+    WTF::storeStoreFence();
>+    errorInstanceSpace = WTFMove(space);
>+    return *errorInstanceSpace;
>+}
>+
>+IsoSubspace& VM::ensureGeneratorFunctionSpaceSlow()
>+{
>+    ASSERT(!generatorFunctionSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSGeneratorFunction);
>+    WTF::storeStoreFence();
>+    generatorFunctionSpace = WTFMove(space);
>+    return *generatorFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureNativeStdFunctionSpaceSlow()
>+{
>+    ASSERT(!nativeStdFunctionspace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), JSNativeStdFunction);
>+    WTF::storeStoreFence();
>+    nativeStdFunctionSpace = WTFMove(space);
>+    return *nativeStdFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureProxyRevokeSpaceSlow()
>+{
>+    ASSERT(!proxyRevokeSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ProxyRevoke);
>+    WTF::storeStoreFence();
>+    proxyRevokeSpace = WTFMove(space);
>+    return *proxyRevokeSpace;
>+}
>+
>+IsoSubspace& VM::ensureWeakMapSpaceSlow()
>+{
>+    ASSERT(!weakMapSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakMap);
>+    WTF::storeStoreFence();
>+    weakMapSpace = WTFMove(space);
>+    return *weakMapSpace;
>+}
>+
>+IsoSubspace& VM::ensureWeakSetSpaceSlow()
>+{
>+    ASSERT(!weakSetSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), JSWeakSet);
>+    WTF::storeStoreFence();
>+    weakSetSpace = WTFMove(space);
>+    return *weakSetSpace;
>+}
>+
>+#if JSC_OBJC_API_ENABLED
>+IsoSubspace& VM::ensureObjCCallbackFunctionSpaceSlow()
>+{
>+    ASSERT(!objCCallbackFunctionSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, destructibleObjectHeapCellType.get(), ObjCCallbackFunction);
>+    WTF::storeStoreFence();
>+    objCCallbackFunctionSpace = WTFMove(space);
>+    return *objCCallbackFunctionSpace;
>+}
>+#endif
>+
>+#if ENABLE(WEBASSEMBLY)
>+IsoSubspace& VM::ensureWebAssemblyCodeBlockSpaceSlow()
>+{
>+    ASSERT(!webAssemblyCodeBlockSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, webAssemblyCodeBlockHeapCellType.get(), JSWebAssemblyCodeBlock);
>+    WTF::storeStoreFence();
>+    webAssemblyCodeBlockSpace = WTFMove(space);
>+    return *webAssemblyCodeBlockSpace;
>+}
>+
>+IsoSubspace& VM::ensureWebAssemblyFunctionSpaceSlow()
>+{
>+    ASSERT(!webAssemblyFunctionSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyFunction);
>+    WTF::storeStoreFence();
>+    webAssemblyFunctionSpace = WTFMove(space);
>+    return *webAssemblyFunctionSpace;
>+}
>+
>+IsoSubspace& VM::ensureWebAssemblyWrapperFunctionSpaceSlow()
>+{
>+    ASSERT(!webAssemblyWrapperFunctionSpace);
>+    auto space = std::make_unique<IsoSubspace> ISO_SUBSPACE_INIT(heap, cellJSValueOOBHeapCellType.get(), WebAssemblyWrapperFunction);
>+    WTF::storeStoreFence();
>+    webAssemblyWrapperFunctionSpace = WTFMove(space);
>+    return *webAssemblyWrapperFunctionSpace;
>+}
>+#endif
>+
>+VM::SpaceAndFinalizerSet& VM::ensureEvalCodeBlockSpaceSlow()
>+{
>+    ASSERT(!evalCodeBlockSpace);
>+    auto space = std::make_unique<SpaceAndFinalizerSet> ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock);
>+    WTF::storeStoreFence();
>+    evalCodeBlockSpace = WTFMove(space);
>+    return *evalCodeBlockSpace;
>+}
>+
>+VM::SpaceAndFinalizerSet& VM::ensureModuleProgramCodeBlockSpaceSlow()
>+{
>+    ASSERT(!moduleProgramCodeBlockSpace);
>+    auto space = std::make_unique<SpaceAndFinalizerSet> ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramCodeBlock);
>+    WTF::storeStoreFence();
>+    moduleProgramCodeBlockSpace = WTFMove(space);
>+    return *moduleProgramCodeBlockSpace;
>+}
>+
>+VM::ScriptExecutableSpaceAndSet& VM::ensureDirectEvalExecutableSpaceSlow()
>+{
>+    ASSERT(!directEvalExecutableSpace);
>+    auto space = std::make_unique<ScriptExecutableSpaceAndSet> ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), DirectEvalExecutable);
>+    WTF::storeStoreFence();
>+    directEvalExecutableSpace = WTFMove(space);
>+    return *directEvalExecutableSpace;
>+}
>+
>+VM::ScriptExecutableSpaceAndSet& VM::ensureIndirectEvalExecutableSpaceSlow()
>+{
>+    ASSERT(!indirectEvalExecutableSpace);
>+    auto space = std::make_unique<ScriptExecutableSpaceAndSet> ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), IndirectEvalExecutable);
>+    WTF::storeStoreFence();
>+    indirectEvalExecutableSpace = WTFMove(space);
>+    return *indirectEvalExecutableSpace;
>+}
>+
>+VM::ScriptExecutableSpaceAndSet& VM::ensureModuleProgramExecutableSpaceSlow()
>+{
>+    ASSERT(!moduleProgramExecutableSpace);
>+    auto space = std::make_unique<ScriptExecutableSpaceAndSet> ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramExecutable);
>+    WTF::storeStoreFence();
>+    moduleProgramExecutableSpace = WTFMove(space);
>+    return *moduleProgramExecutableSpace;
>+}
>+
> JSGlobalObject* VM::vmEntryGlobalObject(const CallFrame* callFrame) const
> {
>     if (callFrame && callFrame->isGlobalExec()) {
>diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
>index 5839e207fe375d24d9c526090dc3bd6ba2055c93..fa76003ecd0b2eefb6b37dbb44f5a86e25f0e6c2 100644
>--- a/Source/JavaScriptCore/runtime/VM.h
>+++ b/Source/JavaScriptCore/runtime/VM.h
>@@ -368,32 +368,32 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
>     CompleteSubspace eagerlySweptDestructibleObjectSpace;
>     CompleteSubspace segmentedVariableObjectSpace;
>     
>-    IsoSubspace asyncFunctionSpace;
>-    IsoSubspace asyncGeneratorFunctionSpace;
>-    IsoSubspace boundFunctionSpace;
>-    IsoSubspace callbackFunctionSpace;
>-    IsoSubspace customGetterSetterFunctionSpace;
>     IsoSubspace executableToCodeBlockEdgeSpace;
>     IsoSubspace functionSpace;
>-    IsoSubspace generatorFunctionSpace;
>     IsoSubspace inferredValueSpace;
>     IsoSubspace internalFunctionSpace;
>     IsoSubspace nativeExecutableSpace;
>-    IsoSubspace nativeStdFunctionSpace;
>-#if JSC_OBJC_API_ENABLED
>-    IsoSubspace objCCallbackFunctionSpace;
>-#endif
>     IsoSubspace propertyTableSpace;
>-    IsoSubspace proxyRevokeSpace;
>     IsoSubspace structureRareDataSpace;
>     IsoSubspace structureSpace;
>-    IsoSubspace weakSetSpace;
>-    IsoSubspace weakMapSpace;
>-    IsoSubspace errorInstanceSpace;
>+    std::unique_ptr<IsoSubspace> asyncFunctionSpace;
>+    std::unique_ptr<IsoSubspace> asyncGeneratorFunctionSpace;
>+    std::unique_ptr<IsoSubspace> boundFunctionSpace;
>+    std::unique_ptr<IsoSubspace> callbackFunctionSpace;
>+    std::unique_ptr<IsoSubspace> customGetterSetterFunctionSpace;
>+    std::unique_ptr<IsoSubspace> errorInstanceSpace;
>+    std::unique_ptr<IsoSubspace> generatorFunctionSpace;
>+    std::unique_ptr<IsoSubspace> nativeStdFunctionSpace;
>+    std::unique_ptr<IsoSubspace> proxyRevokeSpace;
>+    std::unique_ptr<IsoSubspace> weakSetSpace;
>+    std::unique_ptr<IsoSubspace> weakMapSpace;
>+#if JSC_OBJC_API_ENABLED
>+    std::unique_ptr<IsoSubspace> objCCallbackFunctionSpace;
>+#endif
> #if ENABLE(WEBASSEMBLY)
>-    IsoSubspace webAssemblyCodeBlockSpace;
>-    IsoSubspace webAssemblyFunctionSpace;
>-    IsoSubspace webAssemblyWrapperFunctionSpace;
>+    std::unique_ptr<IsoSubspace> webAssemblyCodeBlockSpace;
>+    std::unique_ptr<IsoSubspace> webAssemblyFunctionSpace;
>+    std::unique_ptr<IsoSubspace> webAssemblyWrapperFunctionSpace;
> #endif
>     
>     IsoCellSet executableToCodeBlockEdgesWithConstraints;
>@@ -401,6 +401,8 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
>     IsoCellSet inferredValuesWithFinalizers;
>     
>     struct SpaceAndFinalizerSet {
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED;
>+
>         IsoSubspace space;
>         IsoCellSet finalizerSet;
>         
>@@ -420,23 +422,43 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
>         }
>     };
>     
>-    SpaceAndFinalizerSet evalCodeBlockSpace;
>+    std::unique_ptr<SpaceAndFinalizerSet> evalCodeBlockSpace;
>+    std::unique_ptr<SpaceAndFinalizerSet> moduleProgramCodeBlockSpace;
>     SpaceAndFinalizerSet functionCodeBlockSpace;
>-    SpaceAndFinalizerSet moduleProgramCodeBlockSpace;
>     SpaceAndFinalizerSet programCodeBlockSpace;
> 
>+    SpaceAndFinalizerSet& ensureEvalCodeBlockSpace()
>+    {
>+        if (evalCodeBlockSpace)
>+            return *evalCodeBlockSpace;
>+        return ensureEvalCodeBlockSpaceSlow();
>+    }
>+    SpaceAndFinalizerSet& ensureEvalCodeBlockSpaceSlow();
>+
>+    SpaceAndFinalizerSet& ensureModuleProgramCodeBlockSpace()
>+    {
>+        if (moduleProgramCodeBlockSpace)
>+            return *moduleProgramCodeBlockSpace;
>+        return ensureModuleProgramCodeBlockSpaceSlow();
>+    }
>+    SpaceAndFinalizerSet& ensureModuleProgramCodeBlockSpaceSlow();
>+
>     template<typename Func>
>     void forEachCodeBlockSpace(const Func& func)
>     {
>         // This should not include webAssemblyCodeBlockSpace because this is about subsclasses of
>         // JSC::CodeBlock.
>-        func(evalCodeBlockSpace);
>+        if (evalCodeBlockSpace)
>+            func(*evalCodeBlockSpace);
>         func(functionCodeBlockSpace);
>-        func(moduleProgramCodeBlockSpace);
>+        if (moduleProgramCodeBlockSpace)
>+            func(*moduleProgramCodeBlockSpace);
>         func(programCodeBlockSpace);
>     }
> 
>     struct ScriptExecutableSpaceAndSet {
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED;
>+
>         IsoSubspace space;
>         IsoCellSet clearableCodeSet;
> 
>@@ -455,19 +477,46 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
>         }
>     };
> 
>-    ScriptExecutableSpaceAndSet directEvalExecutableSpace;
>+    std::unique_ptr<ScriptExecutableSpaceAndSet> directEvalExecutableSpace;
>+    std::unique_ptr<ScriptExecutableSpaceAndSet> indirectEvalExecutableSpace;
>+    std::unique_ptr<ScriptExecutableSpaceAndSet> moduleProgramExecutableSpace;
>     ScriptExecutableSpaceAndSet functionExecutableSpace;
>-    ScriptExecutableSpaceAndSet indirectEvalExecutableSpace;
>-    ScriptExecutableSpaceAndSet moduleProgramExecutableSpace;
>     ScriptExecutableSpaceAndSet programExecutableSpace;
> 
>+    ScriptExecutableSpaceAndSet& ensureDirectEvalExecutableSpace()
>+    {
>+        if (directEvalExecutableSpace)
>+            return *directEvalExecutableSpace;
>+        return ensureDirectEvalExecutableSpaceSlow();
>+    }
>+    ScriptExecutableSpaceAndSet& ensureDirectEvalExecutableSpaceSlow();
>+
>+    ScriptExecutableSpaceAndSet& ensureIndirectEvalExecutableSpace()
>+    {
>+        if (indirectEvalExecutableSpace)
>+            return *indirectEvalExecutableSpace;
>+        return ensureIndirectEvalExecutableSpaceSlow();
>+    }
>+    ScriptExecutableSpaceAndSet& ensureIndirectEvalExecutableSpaceSlow();
>+
>+    ScriptExecutableSpaceAndSet& ensureModuleProgramExecutableSpace()
>+    {
>+        if (moduleProgramExecutableSpace)
>+            return *moduleProgramExecutableSpace;
>+        return ensureModuleProgramExecutableSpaceSlow();
>+    }
>+    ScriptExecutableSpaceAndSet& ensureModuleProgramExecutableSpaceSlow();
>+
>     template<typename Func>
>     void forEachScriptExecutableSpace(const Func& func)
>     {
>-        func(directEvalExecutableSpace);
>+        if (directEvalExecutableSpace)
>+            func(*directEvalExecutableSpace);
>         func(functionExecutableSpace);
>-        func(indirectEvalExecutableSpace);
>-        func(moduleProgramExecutableSpace);
>+        if (indirectEvalExecutableSpace)
>+            func(*indirectEvalExecutableSpace);
>+        if (moduleProgramExecutableSpace)
>+            func(*moduleProgramExecutableSpace);
>         func(programExecutableSpace);
>     }
> 
>@@ -582,6 +631,130 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
> 
>     WeakGCMap<SymbolImpl*, Symbol, PtrHash<SymbolImpl*>> symbolImplToSymbolMap;
> 
>+    IsoSubspace& ensureAsyncFunctionSpace()
>+    {
>+        if (asyncFunctionSpace)
>+            return *asyncFunctionSpace;
>+        return ensureAsyncFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureAsyncFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureAsyncGeneratorFunctionSpace()
>+    {
>+        if (asyncGeneratorFunctionSpace)
>+            return *asyncGeneratorFunctionSpace;
>+        return ensureAsyncGeneratorFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureAsyncGeneratorFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureBoundFunctionSpace()
>+    {
>+        if (boundFunctionSpace)
>+            return *boundFunctionSpace;
>+        return ensureBoundFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureBoundFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureCallbackFunctionSpace()
>+    {
>+        if (callbackFunctionSpace)
>+            return *callbackFunctionSpace;
>+        return ensureCallbackFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureCallbackFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureCustomGetterSetterFunctionSpace()
>+    {
>+        if (customGetterSetterFunctionSpace)
>+            return *customGetterSetterFunctionSpace;
>+        return ensureCustomGetterSetterFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureCustomGetterSetterFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureErrorInstanceSpace()
>+    {
>+        if (errorInstanceSpace)
>+            return *errorInstanceSpace;
>+        return ensureErrorInstanceSpaceSlow();
>+    }
>+    IsoSubspace& ensureErrorInstanceSpaceSlow();
>+
>+    IsoSubspace& ensureGeneratorFunctionSpace()
>+    {
>+        if (generatorFunctionSpace)
>+            return *generatorFunctionSpace;
>+        return ensureGeneratorFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureGeneratorFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureNativeStdFunctionSpace()
>+    {
>+        if (nativeStdFunctionSpace)
>+            return *nativeStdFunctionSpace;
>+        return ensureNativeStdFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureNativeStdFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureProxyRevokeSpace()
>+    {
>+        if (proxyRevokeSpace)
>+            return *proxyRevokeSpace;
>+        return ensureProxyRevokeSpaceSlow();
>+    }
>+    IsoSubspace& ensureProxyRevokeSpaceSlow();
>+
>+    IsoSubspace& ensureWeakMapSpace()
>+    {
>+        if (weakMapSpace)
>+            return *weakMapSpace;
>+        return ensureWeakMapSpaceSlow();
>+    }
>+    IsoSubspace& ensureWeakMapSpaceSlow();
>+
>+    IsoSubspace& ensureWeakSetSpace()
>+    {
>+        if (weakSetSpace)
>+            return *weakSetSpace;
>+        return ensureWeakSetSpaceSlow();
>+    }
>+    IsoSubspace& ensureWeakSetSpaceSlow();
>+
>+#if JSC_OBJC_API_ENABLED
>+    IsoSubspace& ensureObjCCallbackFunctionSpace()
>+    {
>+        if (objCCallbackFunctionSpace)
>+            return *objCCallbackFunctionSpace;
>+        return ensureObjCCallbackFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureObjCCallbackFunctionSpaceSlow();
>+#endif
>+
>+#if ENABLE(WEBASSEMBLY)
>+    IsoSubspace& ensureWebAssemblyCodeBlockSpace()
>+    {
>+        if (webAssemblyCodeBlockSpace)
>+            return *webAssemblyCodeBlockSpace;
>+        return ensureWebAssemblyCodeBlockSpaceSlow();
>+    }
>+    IsoSubspace& ensureWebAssemblyCodeBlockSpaceSlow();
>+
>+    IsoSubspace& ensureWebAssemblyFunctionSpace()
>+    {
>+        if (webAssemblyFunctionSpace)
>+            return *webAssemblyFunctionSpace;
>+        return ensureWebAssemblyFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureWebAssemblyFunctionSpaceSlow();
>+
>+    IsoSubspace& ensureWebAssemblyWrapperFunctionSpace()
>+    {
>+        if (webAssemblyWrapperFunctionSpace)
>+            return *webAssemblyWrapperFunctionSpace;
>+        return ensureWebAssemblyWrapperFunctionSpaceSlow();
>+    }
>+    IsoSubspace& ensureWebAssemblyWrapperFunctionSpaceSlow();
>+#endif
>+
>     enum class DeletePropertyMode {
>         // Default behaviour of deleteProperty, matching the spec.
>         Default,
>diff --git a/Source/JavaScriptCore/runtime/WeakMapImpl.h b/Source/JavaScriptCore/runtime/WeakMapImpl.h
>index 5258cbc2d3e107b6f118132bc68f6d20d5e5100a..7ad32b4f09c6c30baa55fc56ad77ac54bce15aba 100644
>--- a/Source/JavaScriptCore/runtime/WeakMapImpl.h
>+++ b/Source/JavaScriptCore/runtime/WeakMapImpl.h
>@@ -306,8 +306,16 @@ class WeakMapImpl : public JSDestructibleObject {
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>         if (isWeakMap())
>-            return &vm.weakMapSpace;
>-        return &vm.weakSetSpace;
>+            return &vm.ensureWeakMapSpace();
>+        return &vm.ensureWeakSetSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        if (isWeakMap())
>+            return vm.weakMapSpace.get();
>+        return vm.weakSetSpace.get();
>     }
> 
>     static void visitOutputConstraints(JSCell*, SlotVisitor&);
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.h
>index 0eb4aa16a2630b50900d3dfd6fd8c814a2c1b0bf..f0ca2e0da2b5f2e1b6c9f939cbdb6c0a2c8ceddb 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.h
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.h
>@@ -62,7 +62,13 @@ class JSWebAssemblyCodeBlock final : public JSCell {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.webAssemblyCodeBlockSpace;
>+        return &vm.ensureWebAssemblyCodeBlockSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.webAssemblyCodeBlockSpace.get();
>     }
> 
>     Wasm::CodeBlock& codeBlock() { return m_codeBlock.get(); }
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
>index 344390099ea133ac9d3f60530fddad359cc6c64f..3c214426d0de62b02980e714e994027071c8842e 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
>@@ -52,7 +52,13 @@ class WebAssemblyFunction final : public WebAssemblyFunctionBase {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.webAssemblyFunctionSpace;
>+        return &vm.ensureWebAssemblyFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.webAssemblyFunctionSpace.get();
>     }
> 
>     DECLARE_EXPORT_INFO;
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h b/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h
>index 015fef2cda7fcf5502a618cce5a706b2547d1a8c..78be773bcb245b4dc8f915470a541760dd8c3a99 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h
>@@ -43,7 +43,13 @@ class WebAssemblyWrapperFunction final : public WebAssemblyFunctionBase {
>     template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.webAssemblyWrapperFunctionSpace;
>+        return &vm.ensureWebAssemblyWrapperFunctionSpace();
>+    }
>+
>+    template<typename CellType>
>+    static IsoSubspace* subspaceForConcurrently(VM& vm)
>+    {
>+        return vm.webAssemblyWrapperFunctionSpace.get();
>     }
> 
>     DECLARE_INFO;

Actions: View | Formatted Diff | Diff

Attachments on bug 193993: 360518 | 360522 | 360523 | 360534 | 360535 | 360537 | 360544 | 360547 | 360550 | 360554 | 360555 | 360556 | 360557 | 360558 | 361042 | 361096