Attachment 360819 Details for Bug 194136 – Patch

[patch] Patch

bug-194136-20190131191931.patch (text/plain), 59.83 KB, created by Yusuke Suzuki on 2019-01-31 19:19:32 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2019-01-31 19:19:32 PST

Size: 59.83 KB

patch

obsolete

>Subversion Revision: 240822
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 1868a78c61785272507b853abd2434479819b6c2..84a645fd4e9a288333da556c9e04952587381662 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,96 @@
>+2019-01-31  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Unify Heap under Mini VM Mode
>+        https://bugs.webkit.org/show_bug.cgi?id=194136
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        VM's heap becomes significantly large if we introduce IsoSubspaces & CompleteSubspaces for various types.
>+        Some of types rarely instantiate actual objects. And this makes the rest of MarkedBlock wasted. In this patch,
>+        we attempt to unify them into 2 heaps under the Mini VM Mode, one for destructible cells and another for
>+        non-destructible cells. We put cells into this heaps as much as possible to remove wasting MarkedBlock.
>+        We also unify IsoSubspaces for CodeBlock subclasses in Mini VM mode since they have the same size. While they
>+        need IsoSubspace since they require IsoCellSet, wasting MarkedBlock like a block for ProgramExecutable is gone.
>+
>+        * API/JSCallbackFunction.h:
>+        * API/ObjCCallbackFunction.h:
>+        (JSC::ObjCCallbackFunction::subspaceFor):
>+        * API/glib/JSCCallbackFunction.h:
>+        (JSC::JSCCallbackFunction::subspaceFor):
>+        * CMakeLists.txt:
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * Sources.txt:
>+        * bytecode/EvalCodeBlock.h:
>+        * bytecode/FunctionCodeBlock.h:
>+        * bytecode/GlobalCodeBlock.h:
>+        * bytecode/ModuleProgramCodeBlock.h:
>+        * bytecode/ProgramCodeBlock.h:
>+        * ftl/FTLLowerDFGToB3.cpp:
>+        (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
>+        * heap/CompleteSubspace.h:
>+        (JSC::CompleteSubspace::offsetOfAllocatorForSizeStep): Deleted.
>+        (JSC::CompleteSubspace::allocatorForSizeStep): Deleted.
>+        * heap/MarkedSpace.cpp:
>+        * jit/AssemblyHelpers.h:
>+        (JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
>+        * jit/JITOpcodes.cpp:
>+        (JSC::JIT::emit_op_new_object):
>+        * runtime/DirectArguments.h:
>+        * runtime/ErrorInstance.h:
>+        (JSC::ErrorInstance::subspaceFor):
>+        * runtime/InternalFunction.h:
>+        (JSC::InternalFunction::subspaceFor):
>+        * runtime/JSAsyncFunction.h:
>+        * runtime/JSAsyncGeneratorFunction.h:
>+        * runtime/JSBoundFunction.h:
>+        * runtime/JSCellInlines.h:
>+        (JSC::SubspaceAllocationTraits::allocate):
>+        (JSC::tryAllocateCellHelper):
>+        * runtime/JSCustomGetterSetterFunction.h:
>+        * runtime/JSDestructibleObject.h:
>+        (JSC::JSDestructibleObject::subspaceFor):
>+        * runtime/JSDestructibleObjectHeapCellType.h:
>+        * runtime/JSFunction.h:
>+        (JSC::JSFunction::subspaceFor):
>+        * runtime/JSGeneratorFunction.h:
>+        * runtime/JSLexicalEnvironment.h:
>+        (JSC::JSLexicalEnvironment::subspaceFor):
>+        * runtime/JSNativeStdFunction.h:
>+        * runtime/JSObject.h:
>+        (JSC::JSObject::subspaceFor):
>+        * runtime/JSSegmentedVariableObject.cpp:
>+        (JSC::JSSegmentedVariableObject::finishCreation):
>+        * runtime/JSSegmentedVariableObject.h:
>+        (JSC::JSSegmentedVariableObject::subspaceFor):
>+        * runtime/JSSegmentedVariableObjectHeapCellType.h:
>+        * runtime/JSString.h:
>+        (JSC::JSString::subspaceFor):
>+        * runtime/JSStringHeapCellType.h:
>+        * runtime/MiniVMModeHeapCellType.cpp: Added.
>+        (JSC::UnifiedDestroyFunc::operator() const):
>+        (JSC::MiniVMModeHeapCellType::MiniVMModeHeapCellType):
>+        (JSC::MiniVMModeHeapCellType::~MiniVMModeHeapCellType):
>+        (JSC::MiniVMModeHeapCellType::finishSweep):
>+        (JSC::MiniVMModeHeapCellType::destroy):
>+        * runtime/MiniVMModeHeapCellType.h: Copied from Source/JavaScriptCore/runtime/JSStringHeapCellType.h.
>+        * runtime/ModuleProgramExecutable.h:
>+        * runtime/NativeExecutable.h:
>+        * runtime/PropertyMapHashTable.h:
>+        * runtime/ProxyRevoke.h:
>+        * runtime/ScopedArguments.h:
>+        * runtime/Structure.h:
>+        * runtime/StructureRareData.h:
>+        * runtime/VM.cpp:
>+        (JSC::VM::VM):
>+        * runtime/VM.h:
>+        (JSC::VM::subspaceInMiniMode):
>+        (JSC::VM::codeBlockSubspace):
>+        (JSC::VM::forEachCodeBlockSpace):
>+        * wasm/js/JSWebAssemblyCodeBlockHeapCellType.h:
>+        * wasm/js/JSWebAssemblyMemory.h:
>+        * wasm/js/WebAssemblyFunction.h:
>+        * wasm/js/WebAssemblyWrapperFunction.h:
>+
> 2019-01-31  Tadeu Zagallo  <tzagallo@apple.com>
> 
>         Fix `runJITThreadLimitTests` in testapi
>diff --git a/Source/JavaScriptCore/API/JSCallbackFunction.h b/Source/JavaScriptCore/API/JSCallbackFunction.h
>index 6cf9cfc2e4fab7c01ddc6e02b663850b0a7f1642..c272fa838ee0c0a73afc9a879c5203d860b8abd4 100644
>--- a/Source/JavaScriptCore/API/JSCallbackFunction.h
>+++ b/Source/JavaScriptCore/API/JSCallbackFunction.h
>@@ -38,8 +38,10 @@ class JSCallbackFunction final : public InternalFunction {
>     typedef InternalFunction Base;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.callbackFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/API/ObjCCallbackFunction.h b/Source/JavaScriptCore/API/ObjCCallbackFunction.h
>index c90ff0c68a3bd3a6b104b51a2204623030188da4..b8c145b67d9c0797718b194967f53fa7c2c69df6 100644
>--- a/Source/JavaScriptCore/API/ObjCCallbackFunction.h
>+++ b/Source/JavaScriptCore/API/ObjCCallbackFunction.h
>@@ -49,8 +49,10 @@ class ObjCCallbackFunction : public InternalFunction {
>     typedef InternalFunction Base;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.objCCallbackFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/API/glib/JSCCallbackFunction.h b/Source/JavaScriptCore/API/glib/JSCCallbackFunction.h
>index 04663fade495fc428379ad2300432c33bf1f870e..445e2e82ad4ecda64e68586c3cb75e6c5e41631c 100644
>--- a/Source/JavaScriptCore/API/glib/JSCCallbackFunction.h
>+++ b/Source/JavaScriptCore/API/glib/JSCCallbackFunction.h
>@@ -41,8 +41,10 @@ class JSCCallbackFunction : public InternalFunction {
>     typedef InternalFunction Base;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return subspaceForImpl(vm);
>     }
> 
>diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
>index fb6ed4077c0112f8ce21c121c37f437897194034..bb1d3fd1945ac1eecf169a84921846e04fba8289 100644
>--- a/Source/JavaScriptCore/CMakeLists.txt
>+++ b/Source/JavaScriptCore/CMakeLists.txt
>@@ -878,6 +878,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
>     runtime/MatchResult.h
>     runtime/MathCommon.h
>     runtime/MemoryStatistics.h
>+    runtime/MiniVMModeHeapCellType.h
>     runtime/Microtask.h
>     runtime/ModuleProgramExecutable.h
>     runtime/NativeExecutable.h
>diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>index c396585da56554d6c1e00adf671d7a8c62fc190c..041334857d09951bd9f6c2ecfe1a760986f419a0 100644
>--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>@@ -1728,6 +1728,7 @@
> 		DE26E9031CB5DD0500D2BE82 /* BuiltinExecutableCreator.h in Headers */ = {isa = PBXBuildFile; fileRef = DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */; };
> 		DEA7E2451BBC677F00D78440 /* JSTypedArrayViewPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		E124A8F70E555775003091F1 /* OpaqueJSString.h in Headers */ = {isa = PBXBuildFile; fileRef = E124A8F50E555775003091F1 /* OpaqueJSString.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		E30392AF2203D03600A182DA /* MiniVMModeHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = E30392AD2203D03600A182DA /* MiniVMModeHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		E31618131EC5FE170006A218 /* DOMAnnotation.h in Headers */ = {isa = PBXBuildFile; fileRef = E31618101EC5FE080006A218 /* DOMAnnotation.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		E31618151EC5FE270006A218 /* DOMAttributeGetterSetter.h in Headers */ = {isa = PBXBuildFile; fileRef = E31618121EC5FE080006A218 /* DOMAttributeGetterSetter.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		E318CBC11B8AEF5100A2929D /* JSModuleNamespaceObject.h in Headers */ = {isa = PBXBuildFile; fileRef = E318CBBF1B8AEF5100A2929D /* JSModuleNamespaceObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -4647,6 +4648,8 @@
> 		E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InitializeThreading.cpp; sourceTree = "<group>"; };
> 		E18E3A560DF9278C00D90B34 /* VM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; path = VM.h; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
> 		E18E3A570DF9278C00D90B34 /* VM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = VM.cpp; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
>+		E30392AC2203D03600A182DA /* MiniVMModeHeapCellType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MiniVMModeHeapCellType.cpp; sourceTree = "<group>"; };
>+		E30392AD2203D03600A182DA /* MiniVMModeHeapCellType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MiniVMModeHeapCellType.h; sourceTree = "<group>"; };
> 		E30677971B8BC6F5003F87F0 /* ModuleLoader.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = ModuleLoader.js; sourceTree = "<group>"; };
> 		E31618101EC5FE080006A218 /* DOMAnnotation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMAnnotation.h; sourceTree = "<group>"; };
> 		E31618111EC5FE080006A218 /* DOMAttributeGetterSetter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMAttributeGetterSetter.cpp; sourceTree = "<group>"; };
>@@ -6436,10 +6439,10 @@
> 			isa = PBXGroup;
> 			children = (
> 				AD2FCB8A1DB5840000B3E736 /* js */,
>-				53F40E8E1D5902820099A1B6 /* WasmB3IRGenerator.cpp */,
>-				53F40E921D5A4AB30099A1B6 /* WasmB3IRGenerator.h */,
> 				52847AD921FFB8630061A9DB /* WasmAirIRGenerator.cpp */,
> 				52847ADA21FFB8630061A9DB /* WasmAirIRGenerator.h */,
>+				53F40E8E1D5902820099A1B6 /* WasmB3IRGenerator.cpp */,
>+				53F40E921D5A4AB30099A1B6 /* WasmB3IRGenerator.h */,
> 				53CA73071EA533D80076049D /* WasmBBQPlan.cpp */,
> 				53CA73081EA533D80076049D /* WasmBBQPlan.h */,
> 				53F8D1FF1E8387D400D21116 /* WasmBBQPlanInlines.h */,
>@@ -7019,6 +7022,8 @@
> 				90213E3C123A40C200D422F3 /* MemoryStatistics.h */,
> 				7C008CE5187631B600955C24 /* Microtask.h */,
> 				FE2A875F1F02381600EB31B2 /* MinimumReservedZoneSize.h */,
>+				E30392AC2203D03600A182DA /* MiniVMModeHeapCellType.cpp */,
>+				E30392AD2203D03600A182DA /* MiniVMModeHeapCellType.h */,
> 				147341DD1DC2CE9600AA29BA /* ModuleProgramExecutable.cpp */,
> 				147341D51DC02EB900AA29BA /* ModuleProgramExecutable.h */,
> 				BC02E9080E1839DB000F9297 /* NativeErrorConstructor.cpp */,
>@@ -8535,7 +8540,6 @@
> 				436E54531C468E7400B5AF73 /* B3LegalizeMemoryOffsets.h in Headers */,
> 				0F338E1E1BF286EA0013C88F /* B3LowerMacros.h in Headers */,
> 				4319DA041C1BE40D001D260B /* B3LowerMacrosAfterOptimizations.h in Headers */,
>-				52847ADC21FFB8690061A9DB /* WasmAirIRGenerator.h in Headers */,
> 				0FEC851E1BDACDAC0080FF74 /* B3LowerToAir.h in Headers */,
> 				43AB26C61C1A535900D82AE6 /* B3MathExtras.h in Headers */,
> 				0FEC85201BDACDAC0080FF74 /* B3MemoryValue.h in Headers */,
>@@ -9467,6 +9471,7 @@
> 				0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,
> 				7C008CE7187631B600955C24 /* Microtask.h in Headers */,
> 				FE2A87601F02381600EB31B2 /* MinimumReservedZoneSize.h in Headers */,
>+				E30392AF2203D03600A182DA /* MiniVMModeHeapCellType.h in Headers */,
> 				86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */,
> 				C4703CD7192844CC0013FBEA /* models.py in Headers */,
> 				E3794E761B77EB97005543AE /* ModuleAnalyzer.h in Headers */,
>@@ -9763,6 +9768,7 @@
> 				0F5AE2C41DF4F2800066EFE1 /* VMInlines.h in Headers */,
> 				FE3022D71E42857300BAC493 /* VMInspector.h in Headers */,
> 				FE6F56DE1E64EAD600D17801 /* VMTraps.h in Headers */,
>+				52847ADC21FFB8690061A9DB /* WasmAirIRGenerator.h in Headers */,
> 				53F40E931D5A4AB30099A1B6 /* WasmB3IRGenerator.h in Headers */,
> 				53CA730A1EA533D80076049D /* WasmBBQPlan.h in Headers */,
> 				53F8D2001E8387D400D21116 /* WasmBBQPlanInlines.h in Headers */,
>@@ -10547,7 +10553,6 @@
> 				536B319A1F735E780037FC33 /* UnifiedSource1-mm.mm in Sources */,
> 				536B315F1F71C5990037FC33 /* UnifiedSource1.cpp in Sources */,
> 				536B319B1F735E780037FC33 /* UnifiedSource2-mm.mm in Sources */,
>-				525C9CDF220285830082DBFD /* WasmAirIRGenerator.cpp in Sources */,
> 				536B31571F71C5990037FC33 /* UnifiedSource2.cpp in Sources */,
> 				530A66B91FA3E78B0026A545 /* UnifiedSource3-mm.mm in Sources */,
> 				536B31581F71C5990037FC33 /* UnifiedSource3.cpp in Sources */,
>@@ -10695,6 +10700,7 @@
> 				530A66C21FA3E78B0026A545 /* UnifiedSource143.cpp in Sources */,
> 				530A66C31FA3E78B0026A545 /* UnifiedSource144.cpp in Sources */,
> 				530A66C41FA3E78B0026A545 /* UnifiedSource145.cpp in Sources */,
>+				525C9CDF220285830082DBFD /* WasmAirIRGenerator.cpp in Sources */,
> 			);
> 			runOnlyForDeploymentPostprocessing = 0;
> 		};
>diff --git a/Source/JavaScriptCore/Sources.txt b/Source/JavaScriptCore/Sources.txt
>index b0e065253321f27020893f76e481b833d9d606b2..85a807d765b6d6c8c8d3f0d4f4f40358841628e6 100644
>--- a/Source/JavaScriptCore/Sources.txt
>+++ b/Source/JavaScriptCore/Sources.txt
>@@ -874,6 +874,7 @@ runtime/MatchResult.cpp
> runtime/MathCommon.cpp
> runtime/MathObject.cpp
> runtime/MemoryStatistics.cpp
>+runtime/MiniVMModeHeapCellType.cpp
> runtime/ModuleProgramExecutable.cpp
> runtime/NativeErrorConstructor.cpp
> runtime/NativeErrorPrototype.cpp
>diff --git a/Source/JavaScriptCore/bytecode/EvalCodeBlock.h b/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
>index 6775c362b5d805149dd51ac3210e01d764fc93c5..b6d57110af8ae351a2146f74fe790a4b0c13a415 100644
>--- a/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/EvalCodeBlock.h
>@@ -38,10 +38,10 @@ class EvalCodeBlock final : public GlobalCodeBlock {
>     typedef GlobalCodeBlock Base;
>     DECLARE_INFO;
> 
>-    template<typename>
>+    template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.evalCodeBlockSpace.space;
>+        return VM::codeBlockSubspace<CellType>(vm);
>     }
> 
>     static EvalCodeBlock* create(VM* vm, CopyParsedBlockTag, EvalCodeBlock& other)
>@@ -90,4 +90,6 @@ class EvalCodeBlock final : public GlobalCodeBlock {
>     UnlinkedEvalCodeBlock* unlinkedEvalCodeBlock() const { return jsCast<UnlinkedEvalCodeBlock*>(unlinkedCodeBlock()); }
> };
> 
>+static_assert(sizeof(EvalCodeBlock) == sizeof(GlobalCodeBlock), "");
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h b/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h
>index 6f50422882ffaf55360bd12f325a2d23bfda4827..504154036bd63e8b9773ba1a8c664158c6667263 100644
>--- a/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h
>@@ -39,10 +39,10 @@ class FunctionCodeBlock final : public CodeBlock {
>     typedef CodeBlock Base;
>     DECLARE_INFO;
> 
>-    template<typename>
>+    template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.functionCodeBlockSpace.space;
>+        return VM::codeBlockSubspace<CellType>(vm);
>     }
> 
>     static FunctionCodeBlock* create(VM* vm, CopyParsedBlockTag, FunctionCodeBlock& other)
>@@ -83,4 +83,6 @@ class FunctionCodeBlock final : public CodeBlock {
>     static void destroy(JSCell*);
> };
> 
>+static_assert(sizeof(FunctionCodeBlock) == sizeof(CodeBlock), "");
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h b/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h
>index aa29cca33243573c2700e287866e19b9584a2bbd..d73fe5fe8f38c2b15de83134d0cc27cceaf087c2 100644
>--- a/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/GlobalCodeBlock.h
>@@ -51,4 +51,6 @@ class GlobalCodeBlock : public CodeBlock {
>     }
> };
> 
>+static_assert(sizeof(GlobalCodeBlock) == sizeof(CodeBlock), "");
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h b/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
>index ae99f77d5b43682003ce4b057d948c43ae156350..6835f99023a35340a1aa7513e611ba6e1f3a8e8e 100644
>--- a/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h
>@@ -39,10 +39,10 @@ class ModuleProgramCodeBlock final : public GlobalCodeBlock {
>     typedef GlobalCodeBlock Base;
>     DECLARE_INFO;
> 
>-    template<typename>
>+    template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.moduleProgramCodeBlockSpace.space;
>+        return VM::codeBlockSubspace<CellType>(vm);
>     }
> 
>     static ModuleProgramCodeBlock* create(VM* vm, CopyParsedBlockTag, ModuleProgramCodeBlock& other)
>@@ -83,4 +83,6 @@ class ModuleProgramCodeBlock final : public GlobalCodeBlock {
>     static void destroy(JSCell*);
> };
> 
>+static_assert(sizeof(ModuleProgramCodeBlock) == sizeof(GlobalCodeBlock), "");
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h b/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h
>index 8ea9b4caa04439831ec17b1acdbf8c8d1f84e8ae..ad9f75bde023669232cf45ce61e851f6bf3ae808 100644
>--- a/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h
>+++ b/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h
>@@ -39,10 +39,10 @@ class ProgramCodeBlock final : public GlobalCodeBlock {
>     typedef GlobalCodeBlock Base;
>     DECLARE_INFO;
> 
>-    template<typename>
>+    template<typename CellType>
>     static IsoSubspace* subspaceFor(VM& vm)
>     {
>-        return &vm.programCodeBlockSpace.space;
>+        return VM::codeBlockSubspace<CellType>(vm);
>     }
> 
>     static ProgramCodeBlock* create(VM* vm, CopyParsedBlockTag, ProgramCodeBlock& other)
>@@ -83,4 +83,6 @@ class ProgramCodeBlock final : public GlobalCodeBlock {
>     static void destroy(JSCell*);
> };
> 
>+static_assert(sizeof(ProgramCodeBlock) == sizeof(GlobalCodeBlock), "");
>+
> } // namespace JSC
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 4f3a5a054b58b145c70c8a4a6a4af6cc0f5a0807..81dccf0b50b0a2c6dd7af34c2beee992e5853c80 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -13189,7 +13189,7 @@ class LowerDFGToB3 {
>     LValue allocateObject(
>         size_t size, StructureType structure, LValue butterfly, LBasicBlock slowPath)
>     {
>-        Allocator allocator = subspaceFor<ClassType>(vm())->allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
>+        Allocator allocator = subspaceFor<ClassType>(vm())->allocatorFor(size, AllocatorForMode::AllocatorIfExists);
>         return allocateObject(
>             m_out.constIntPtr(allocator.localAllocator()), structure, butterfly, slowPath);
>     }
>diff --git a/Source/JavaScriptCore/heap/CompleteSubspace.h b/Source/JavaScriptCore/heap/CompleteSubspace.h
>index 28ae34db6974958ead695726f6194fc776385ba2..01e65b10dadc8b51feac3b2360a4401f1c858847 100644
>--- a/Source/JavaScriptCore/heap/CompleteSubspace.h
>+++ b/Source/JavaScriptCore/heap/CompleteSubspace.h
>@@ -29,7 +29,7 @@
> 
> namespace JSC {
> 
>-class CompleteSubspace : public Subspace {
>+class CompleteSubspace final : public Subspace {
> public:
>     JS_EXPORT_PRIVATE CompleteSubspace(CString name, Heap&, HeapCellType*, AlignedMemoryAllocator*);
>     JS_EXPORT_PRIVATE ~CompleteSubspace();
>diff --git a/Source/JavaScriptCore/heap/MarkedSpace.cpp b/Source/JavaScriptCore/heap/MarkedSpace.cpp
>index ec89a025370ff8ab7bb88e3d006b48de6179a2bd..2602081ebc1126115cefc51a2b1038a7f4bec743 100644
>--- a/Source/JavaScriptCore/heap/MarkedSpace.cpp
>+++ b/Source/JavaScriptCore/heap/MarkedSpace.cpp
>@@ -141,6 +141,12 @@ const Vector<size_t>& sizeClasses()
>             // https://bugs.webkit.org/show_bug.cgi?id=179876
>             add(sizeof(UnlinkedFunctionCodeBlock));
>             add(sizeof(JSString));
>+            if (VM::isInMiniMode()) {
>+                add(sizeof(JSRopeString));
>+                add(sizeof(JSFunction));
>+                add(sizeof(Structure));
>+                add(sizeof(PropertyTable));
>+            }
> 
>             {
>                 // Sort and deduplicate.
>diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>index 283bb03033bc583703ecd6fc0bc8bf87f93e7528..f53327c66da6845b43b9354606f71cc305aa310a 100644
>--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h
>+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h
>@@ -1752,7 +1752,7 @@ class AssemblyHelpers : public MacroAssembler {
>         VM& vm, GPRReg resultGPR, StructureType structure, StorageType storage, GPRReg scratchGPR1,
>         GPRReg scratchGPR2, JumpList& slowPath, size_t size)
>     {
>-        Allocator allocator = subspaceFor<ClassType>(vm)->allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
>+        Allocator allocator = subspaceFor<ClassType>(vm)->allocatorFor(size, AllocatorForMode::AllocatorIfExists);
>         emitAllocateJSObject(resultGPR, JITAllocator::constant(allocator), scratchGPR1, structure, storage, scratchGPR2, slowPath);
>     }
>     
>diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
>index 378dc505f7007b5207a2115a856002d54cf11cb7..fc42cc648c2d4f8e7810bf092431175d959953fe 100644
>--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
>+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
>@@ -96,7 +96,7 @@ void JIT::emit_op_new_object(const Instruction* currentInstruction)
>     auto& metadata = bytecode.metadata(m_codeBlock);
>     Structure* structure = metadata.m_objectAllocationProfile.structure();
>     size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
>-    Allocator allocator = subspaceFor<JSFinalObject>(*m_vm)->allocatorForNonVirtual(allocationSize, AllocatorForMode::AllocatorIfExists);
>+    Allocator allocator = subspaceFor<JSFinalObject>(*m_vm)->allocatorFor(allocationSize, AllocatorForMode::AllocatorIfExists);
> 
>     RegisterID resultReg = regT0;
>     RegisterID allocatorReg = regT1;
>diff --git a/Source/JavaScriptCore/runtime/DirectArguments.h b/Source/JavaScriptCore/runtime/DirectArguments.h
>index 2a78fd0fea3e83af1404005d6ac3be5be13a0cae..e0e1d5bb19df01ee65564c506c2b5fc2f7d323ea 100644
>--- a/Source/JavaScriptCore/runtime/DirectArguments.h
>+++ b/Source/JavaScriptCore/runtime/DirectArguments.h
>@@ -49,7 +49,9 @@ class DirectArguments final : public GenericArguments<DirectArguments> {
>     template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>-        RELEASE_ASSERT(!CellType::needsDestruction);
>+        static_assert(!CellType::needsDestruction, "");
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.jsValueGigacageCellSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/ErrorInstance.h b/Source/JavaScriptCore/runtime/ErrorInstance.h
>index d95cbf81b40169581a5e2a144959bf72e49e2534..c8a6f946e79475c809f368abb0ba35e90238ed34 100644
>--- a/Source/JavaScriptCore/runtime/ErrorInstance.h
>+++ b/Source/JavaScriptCore/runtime/ErrorInstance.h
>@@ -73,8 +73,10 @@ class ErrorInstance : public JSDestructibleObject {
>     bool materializeErrorInfoIfNeeded(VM&, PropertyName);
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.errorInstanceSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/InternalFunction.h b/Source/JavaScriptCore/runtime/InternalFunction.h
>index 244c4f72a8f6783cadb04c2f5d4187f8d9a1d98a..547f7b549f32c98117970637f77da5a8e2e6ee7f 100644
>--- a/Source/JavaScriptCore/runtime/InternalFunction.h
>+++ b/Source/JavaScriptCore/runtime/InternalFunction.h
>@@ -39,9 +39,10 @@ class InternalFunction : public JSDestructibleObject {
>     static const unsigned StructureFlags = Base::StructureFlags | ImplementsHasInstance | ImplementsDefaultHasInstance | OverridesGetCallData;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>-        static_assert(sizeof(CellType) == sizeof(InternalFunction), "InternalFunction subclasses that add fields need to override subspaceFor<>()");
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.internalFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSAsyncFunction.h b/Source/JavaScriptCore/runtime/JSAsyncFunction.h
>index 459d5a9f77a6f261f8cdb8ac968b13c37c22a2a0..1c39aa6ad0cfc267b32ae90309c19f6154568627 100644
>--- a/Source/JavaScriptCore/runtime/JSAsyncFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSAsyncFunction.h
>@@ -39,8 +39,10 @@ class JSAsyncFunction final : public JSFunction {
>     const static unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.asyncFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h b/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h
>index a38c6225ba816a5e379587e4c2b6d141251f7aee..9a80152fabc9b6ccdfcf698445c832030cffce4d 100644
>--- a/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h
>@@ -39,8 +39,10 @@ class JSAsyncGeneratorFunction final : public JSFunction {
>     const static unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.asyncGeneratorFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSBoundFunction.h b/Source/JavaScriptCore/runtime/JSBoundFunction.h
>index 928ddc58a219f12a39d97d4d1008485d99688491..ce507d46e6e59f8699f2fcd4487065b710184ae6 100644
>--- a/Source/JavaScriptCore/runtime/JSBoundFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSBoundFunction.h
>@@ -43,8 +43,10 @@ class JSBoundFunction final : public JSFunction {
>     static_assert(StructureFlags & ImplementsHasInstance, "");
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.boundFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSCellInlines.h b/Source/JavaScriptCore/runtime/JSCellInlines.h
>index 3c5ad64857c65356d06c4cfd3a38dc436fcbc3fa..06312f4678f90ba8f7f6faf8fefe22d513a2a9b8 100644
>--- a/Source/JavaScriptCore/runtime/JSCellInlines.h
>+++ b/Source/JavaScriptCore/runtime/JSCellInlines.h
>@@ -153,13 +153,34 @@ CompleteSubspace* JSCell::subspaceFor(VM& vm)
>     return &vm.cellDangerousBitsSpace;
> }
> 
>+template<bool isNonVirtual>
>+struct SubspaceAllocationTraits {
>+    template<typename CellType>
>+    static ALWAYS_INLINE void* allocate(VM& vm, size_t size, GCDeferralContext* deferralContext, AllocationFailureMode failureMode)
>+    {
>+        return subspaceFor<CellType>(vm)->allocateNonVirtual(vm, size, deferralContext, failureMode);
>+    }
>+};
>+
>+template<>
>+struct SubspaceAllocationTraits</* isNonVirtual */ false> {
>+    template<typename CellType>
>+    static ALWAYS_INLINE void* allocate(VM& vm, size_t size, GCDeferralContext* deferralContext, AllocationFailureMode failureMode)
>+    {
>+        if (VM::isInMiniMode())
>+            return static_cast<CompleteSubspace*>(subspaceFor<CellType>(vm))->allocateNonVirtual(vm, size, deferralContext, failureMode);
>+        return static_cast<IsoSubspace*>(subspaceFor<CellType>(vm))->allocateNonVirtual(vm, size, deferralContext, failureMode);
>+    }
>+};
>+
> template<typename T>
> ALWAYS_INLINE void* tryAllocateCellHelper(Heap& heap, size_t size, GCDeferralContext* deferralContext, AllocationFailureMode failureMode)
> {
>     VM& vm = *heap.vm();
>     ASSERT(deferralContext || !DisallowGC::isInEffectOnCurrentThread());
>     ASSERT(size >= sizeof(T));
>-    JSCell* result = static_cast<JSCell*>(subspaceFor<T>(vm)->allocateNonVirtual(vm, size, deferralContext, failureMode));
>+    JSCell* result =
>+        static_cast<JSCell*>(SubspaceAllocationTraits<!std::is_same<decltype(subspaceFor<T>(vm)), Subspace*>::value>::template allocate<T>(vm, size, deferralContext, failureMode));
>     if (failureMode == AllocationFailureMode::ReturnNull && !result)
>         return nullptr;
> #if ENABLE(GC_VALIDATION)
>diff --git a/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h b/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h
>index 17c7f18be8db35a85d216906312f1a1e8d5439cc..6482337b74e7247fb70a505ca3a05f82146068b8 100644
>--- a/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h
>@@ -41,8 +41,10 @@ class JSCustomGetterSetterFunction final : public JSFunction {
>     static const unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.customGetterSetterFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSDestructibleObject.h b/Source/JavaScriptCore/runtime/JSDestructibleObject.h
>index 43828f0fc1df41bf35b9f13777d987a53b92ce82..80597d22be210c223d44abd0aa63adfa53c6c770 100644
>--- a/Source/JavaScriptCore/runtime/JSDestructibleObject.h
>+++ b/Source/JavaScriptCore/runtime/JSDestructibleObject.h
>@@ -40,6 +40,8 @@ class JSDestructibleObject : public JSNonFinalObject {
>     template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.destructibleObjectSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSDestructibleObjectHeapCellType.h b/Source/JavaScriptCore/runtime/JSDestructibleObjectHeapCellType.h
>index 3339f608f568156bc645e790b8f550fe7531a2dc..7d6da081604a7a8b3e69000fdc507dbadcd4e85c 100644
>--- a/Source/JavaScriptCore/runtime/JSDestructibleObjectHeapCellType.h
>+++ b/Source/JavaScriptCore/runtime/JSDestructibleObjectHeapCellType.h
>@@ -29,7 +29,7 @@
> 
> namespace JSC {
> 
>-class JSDestructibleObjectHeapCellType : public HeapCellType {
>+class JSDestructibleObjectHeapCellType final : public HeapCellType {
> public:
>     JS_EXPORT_PRIVATE JSDestructibleObjectHeapCellType();
>     JS_EXPORT_PRIVATE virtual ~JSDestructibleObjectHeapCellType();
>diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
>index 1e77632b511f2e26e2c4d2af892d9a6966b4c63b..61207215c032387d4541003b5e94628576ec8855 100644
>--- a/Source/JavaScriptCore/runtime/JSFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSFunction.h
>@@ -63,8 +63,10 @@ class JSFunction : public JSCallee {
> public:
>     
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.functionSpace;
>     }
>     
>diff --git a/Source/JavaScriptCore/runtime/JSGeneratorFunction.h b/Source/JavaScriptCore/runtime/JSGeneratorFunction.h
>index 0e88fc735cb92a72b1c0b495b7fa630c25fe9490..490b19156e8a888c21971a44b95d5b9331a8b65c 100644
>--- a/Source/JavaScriptCore/runtime/JSGeneratorFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSGeneratorFunction.h
>@@ -67,8 +67,10 @@ class JSGeneratorFunction final : public JSFunction {
>     const static unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.generatorFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h b/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>index cfec9567b6746ddd06e464133121a9dd021deea2..0a5c48cd8c9a7f9488612a377383a3fac41ebe89 100644
>--- a/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>+++ b/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h
>@@ -43,7 +43,9 @@ class JSLexicalEnvironment : public JSSymbolTableObject {
>     template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>-        RELEASE_ASSERT(!CellType::needsDestruction);
>+        static_assert(!CellType::needsDestruction, "");
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.jsValueGigacageCellSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSNativeStdFunction.h b/Source/JavaScriptCore/runtime/JSNativeStdFunction.h
>index e2041496f8e7aa208c0fc66a034980d98d0ff0ac..4c3acb3033e52a531b2892da3b56e69dbec4aec5 100644
>--- a/Source/JavaScriptCore/runtime/JSNativeStdFunction.h
>+++ b/Source/JavaScriptCore/runtime/JSNativeStdFunction.h
>@@ -41,8 +41,10 @@ class JSNativeStdFunction final : public JSFunction {
>     const static unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.nativeStdFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSObject.h b/Source/JavaScriptCore/runtime/JSObject.h
>index 192db5eeea713e617b71219af7f749a20ea0481f..f7ecebe0aa10605ac4aaa3d6aa24027810f613fb 100644
>--- a/Source/JavaScriptCore/runtime/JSObject.h
>+++ b/Source/JavaScriptCore/runtime/JSObject.h
>@@ -104,9 +104,11 @@ class JSObject : public JSCell {
> public:
>     typedef JSCell Base;
> 
>-    template<typename>
>+    template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.cellJSValueOOBSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp b/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp
>index e5603699d0e426c03b2f40fc4c92249bcf06fcaf..bf8840d975f80dc342cbf7936f09b5512c0022d6 100644
>--- a/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp
>+++ b/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp
>@@ -115,6 +115,7 @@ JSSegmentedVariableObject::~JSSegmentedVariableObject()
> void JSSegmentedVariableObject::finishCreation(VM& vm)
> {
>     Base::finishCreation(vm);
>+    RELEASE_ASSERT(type() == GlobalObjectType || type() == GlobalLexicalEnvironmentType);
>     setSymbolTable(vm, SymbolTable::create(vm));
> }
> 
>diff --git a/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h b/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h
>index cb5fe372ae22fbe10fba8a650f84cef59a24a511..c0c6e921735525d1eaf45fff308d05592b49f3cb 100644
>--- a/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h
>+++ b/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h
>@@ -56,6 +56,8 @@ class JSSegmentedVariableObject : public JSSymbolTableObject {
> public:
>     using Base = JSSymbolTableObject;
> 
>+    static const bool needsDestruction = true;
>+
>     DECLARE_INFO;
> 
>     bool isValidScopeOffset(ScopeOffset offset)
>@@ -90,9 +92,11 @@ class JSSegmentedVariableObject : public JSSymbolTableObject {
>     
>     static void destroy(JSCell*);
>     
>-    template<typename>
>+    template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.segmentedVariableObjectSpace;
>     }
>     
>diff --git a/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectHeapCellType.h b/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectHeapCellType.h
>index f8bac6be90380ef5df9cf30af330ba237b6aee5e..0eece28c1365ecaa7dede573b04e8ded7c31b5cd 100644
>--- a/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectHeapCellType.h
>+++ b/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectHeapCellType.h
>@@ -29,7 +29,7 @@
> 
> namespace JSC {
> 
>-class JSSegmentedVariableObjectHeapCellType : public HeapCellType {
>+class JSSegmentedVariableObjectHeapCellType final : public HeapCellType {
> public:
>     JS_EXPORT_PRIVATE JSSegmentedVariableObjectHeapCellType();
>     JS_EXPORT_PRIVATE virtual ~JSSegmentedVariableObjectHeapCellType();
>diff --git a/Source/JavaScriptCore/runtime/JSString.h b/Source/JavaScriptCore/runtime/JSString.h
>index 57d7f9040240f06f700fb88dd1233134c374f1af..523d92c701668be58a547623c0577d445a42cc79 100644
>--- a/Source/JavaScriptCore/runtime/JSString.h
>+++ b/Source/JavaScriptCore/runtime/JSString.h
>@@ -89,9 +89,11 @@ class JSString : public JSCell {
>     
>     // We specialize the string subspace to get the fastest possible sweep. This wouldn't be
>     // necessary if JSString didn't have a destructor.
>-    template<typename>
>+    template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.stringSpace;
>     }
>     
>diff --git a/Source/JavaScriptCore/runtime/JSStringHeapCellType.h b/Source/JavaScriptCore/runtime/JSStringHeapCellType.h
>index 762b88fa520d716bb277555e2b3a0c9f039eaf40..57827e1517d82593f061d6d87fd2acb24aca685a 100644
>--- a/Source/JavaScriptCore/runtime/JSStringHeapCellType.h
>+++ b/Source/JavaScriptCore/runtime/JSStringHeapCellType.h
>@@ -29,7 +29,7 @@
> 
> namespace JSC {
> 
>-class JSStringHeapCellType : public HeapCellType {
>+class JSStringHeapCellType final : public HeapCellType {
> public:
>     JS_EXPORT_PRIVATE JSStringHeapCellType();
>     JS_EXPORT_PRIVATE virtual ~JSStringHeapCellType();
>diff --git a/Source/JavaScriptCore/runtime/MiniVMModeHeapCellType.cpp b/Source/JavaScriptCore/runtime/MiniVMModeHeapCellType.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..b6aa8b8668a4ef208f2c21b3e5aaaeee329fe3ca
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/MiniVMModeHeapCellType.cpp
>@@ -0,0 +1,78 @@
>+/*
>+ * Copyright (C) 2019 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "MiniVMModeHeapCellType.h"
>+
>+#include "JSCInlines.h"
>+#include "MarkedBlockInlines.h"
>+
>+namespace JSC {
>+
>+struct UnifiedDestroyFunc {
>+    ALWAYS_INLINE void operator()(VM& vm, JSCell* cell) const
>+    {
>+        if (TypeInfo::isObject(cell->type())) {
>+            switch (cell->type()) {
>+            case GlobalLexicalEnvironmentType:
>+            case GlobalObjectType: {
>+                static_cast<JSSegmentedVariableObject*>(cell)->classInfo()->methodTable.destroy(cell);
>+                return;
>+            }
>+            default:
>+                static_cast<JSDestructibleObject*>(cell)->classInfo()->methodTable.destroy(cell);
>+                return;
>+            }
>+            return;
>+        }
>+        ASSERT(cell->structureID());
>+        Structure* structure = cell->structure(vm);
>+        ASSERT(structure->typeInfo().structureIsImmortal());
>+        const ClassInfo* classInfo = structure->classInfo();
>+        MethodTable::DestroyFunctionPtr destroy = classInfo->methodTable.destroy;
>+        destroy(cell);
>+    }
>+};
>+
>+MiniVMModeHeapCellType::MiniVMModeHeapCellType(CellAttributes attributes)
>+    : HeapCellType(attributes)
>+{
>+}
>+
>+MiniVMModeHeapCellType::~MiniVMModeHeapCellType()
>+{
>+}
>+
>+void MiniVMModeHeapCellType::finishSweep(MarkedBlock::Handle& block, FreeList* freeList)
>+{
>+    block.finishSweepKnowingHeapCellType(freeList, UnifiedDestroyFunc());
>+}
>+
>+void MiniVMModeHeapCellType::destroy(VM& vm, JSCell* cell)
>+{
>+    UnifiedDestroyFunc()(vm, cell);
>+}
>+
>+} // namespace JSC
>diff --git a/Source/JavaScriptCore/runtime/MiniVMModeHeapCellType.h b/Source/JavaScriptCore/runtime/MiniVMModeHeapCellType.h
>new file mode 100644
>index 0000000000000000000000000000000000000000..9790bf5da53d82385f517a281dae52d88601ab7b
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/MiniVMModeHeapCellType.h
>@@ -0,0 +1,42 @@
>+/*
>+ * Copyright (C) 2019 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+#include "HeapCellType.h"
>+#include "MarkedBlock.h"
>+
>+namespace JSC {
>+
>+class MiniVMModeHeapCellType final : public HeapCellType {
>+public:
>+    JS_EXPORT_PRIVATE MiniVMModeHeapCellType(CellAttributes);
>+    JS_EXPORT_PRIVATE virtual ~MiniVMModeHeapCellType();
>+
>+    void finishSweep(MarkedBlock::Handle&, FreeList*) override;
>+    void destroy(VM&, JSCell*) override;
>+};
>+
>+} // namespace JSC
>diff --git a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
>index f5171d4c34ad27d9b92167d64471964156b0d524..8f24f2ae43bb907ca7503986fc6cd7557da67018 100644
>--- a/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
>+++ b/Source/JavaScriptCore/runtime/ModuleProgramExecutable.h
>@@ -37,8 +37,10 @@ class ModuleProgramExecutable final : public ScriptExecutable {
>     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.moduleProgramExecutableSpace.space;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/NativeExecutable.h b/Source/JavaScriptCore/runtime/NativeExecutable.h
>index 637be6fde74715921559e6159b3717a89a0849a2..275876384467d076b1985aaad19c59b374e15918 100644
>--- a/Source/JavaScriptCore/runtime/NativeExecutable.h
>+++ b/Source/JavaScriptCore/runtime/NativeExecutable.h
>@@ -45,8 +45,10 @@ class NativeExecutable final : public ExecutableBase {
>     static void destroy(JSCell*);
>     
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.nativeExecutableSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
>index 27edadc47ccd864ab01f5c3950dcf18828888058..bf6a5a9d2a3f9f471dda394b04588d85301992b8 100644
>--- a/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
>+++ b/Source/JavaScriptCore/runtime/PropertyMapHashTable.h
>@@ -124,8 +124,10 @@ class PropertyTable final : public JSCell {
>     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.propertyTableSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/ProxyRevoke.h b/Source/JavaScriptCore/runtime/ProxyRevoke.h
>index 322096564e9870cc392e383c9005f770ba8e7e80..4837c3cedd2f62291c9c3dcddc5e6aabe7064e02 100644
>--- a/Source/JavaScriptCore/runtime/ProxyRevoke.h
>+++ b/Source/JavaScriptCore/runtime/ProxyRevoke.h
>@@ -37,8 +37,10 @@ class ProxyRevoke final : public InternalFunction {
>     static const unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.proxyRevokeSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/ScopedArguments.h b/Source/JavaScriptCore/runtime/ScopedArguments.h
>index a9c0b2407fa50018c337169233dc7ff2f57829ad..340d531740c84aa03a56f02c6b1a6195086c5a64 100644
>--- a/Source/JavaScriptCore/runtime/ScopedArguments.h
>+++ b/Source/JavaScriptCore/runtime/ScopedArguments.h
>@@ -46,7 +46,9 @@ class ScopedArguments final : public GenericArguments<ScopedArguments> {
>     template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>-        RELEASE_ASSERT(!CellType::needsDestruction);
>+        static_assert(!CellType::needsDestruction, "");
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.jsValueGigacageCellSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
>index e11a853e1acbd24b695d10109d1dd3205ce0ea62..30f9a498f90d876baabfe72ba4827ea7fe99f248 100644
>--- a/Source/JavaScriptCore/runtime/Structure.h
>+++ b/Source/JavaScriptCore/runtime/Structure.h
>@@ -133,8 +133,10 @@ class Structure final : public JSCell {
>     ~Structure();
>     
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.structureSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/StructureRareData.h b/Source/JavaScriptCore/runtime/StructureRareData.h
>index 336732d11d873d42f20f9910871e28c270f6a885..a73b092e0076b81801f87a82d63483cc78c6fccb 100644
>--- a/Source/JavaScriptCore/runtime/StructureRareData.h
>+++ b/Source/JavaScriptCore/runtime/StructureRareData.h
>@@ -44,8 +44,10 @@ class StructureRareData final : public JSCell {
>     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.structureRareDataSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
>index d91b3b85417f0d1a9df3eae4e9d8341864b20772..80390f4d5dcd6c9e86eda023227578ef25526aaa 100644
>--- a/Source/JavaScriptCore/runtime/VM.cpp
>+++ b/Source/JavaScriptCore/runtime/VM.cpp
>@@ -108,6 +108,7 @@
> #include "LLIntData.h"
> #include "Lexer.h"
> #include "Lookup.h"
>+#include "MiniVMModeHeapCellType.h"
> #include "MinimumReservedZoneSize.h"
> #include "ModuleProgramCodeBlock.h"
> #include "ModuleProgramExecutable.h"
>@@ -278,13 +279,14 @@ VM::VM(VMType vmType, HeapType heapType)
> #if ENABLE(WEBASSEMBLY)
>     , webAssemblyCodeBlockHeapCellType(std::make_unique<JSWebAssemblyCodeBlockHeapCellType>())
> #endif
>+    , miniVMModeHeapCellType(isInMiniMode() ? std::make_unique<MiniVMModeHeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)) : nullptr)
>     , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), primitiveGigacageAllocator.get())
>     , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, auxiliaryHeapCellType.get(), jsValueGigacageAllocator.get())
>     , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithInteriorPointers", heap, immutableButterflyHeapCellType.get(), jsValueGigacageAllocator.get())
>     , cellJSValueOOBSpace("JSCell JSValueOOB", heap, cellJSValueOOBHeapCellType.get(), fastMallocAllocator.get())
>-    , cellDangerousBitsSpace("JSCell DangerousBits", heap, cellDangerousBitsHeapCellType.get(), fastMallocAllocator.get())
>+    , cellDangerousBitsSpace("JSCell DangerousBits", heap, isInMiniMode() ? cellDangerousBitsHeapCellType.get() : miniVMModeHeapCellType.get(), fastMallocAllocator.get())
>     , jsValueGigacageCellSpace("JSValue Gigacage JSCell", heap, cellJSValueOOBHeapCellType.get(), jsValueGigacageAllocator.get())
>-    , destructibleCellSpace("Destructible JSCell", heap, destructibleCellHeapCellType.get(), fastMallocAllocator.get())
>+    , destructibleCellSpace("Destructible JSCell", heap, isInMiniMode() ? miniVMModeHeapCellType.get() :destructibleCellHeapCellType.get(), fastMallocAllocator.get())
>     , stringSpace("JSString", heap, stringHeapCellType.get(), fastMallocAllocator.get())
>     , destructibleObjectSpace("JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
>     , eagerlySweptDestructibleObjectSpace("Eagerly Swept JSDestructibleObject", heap, destructibleObjectHeapCellType.get(), fastMallocAllocator.get())
>@@ -319,10 +321,10 @@ VM::VM(VMType vmType, HeapType heapType)
>     , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
>     , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
>     , inferredValuesWithFinalizers(inferredValueSpace)
>-    , evalCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock)
>-    , functionCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionCodeBlock)
>-    , moduleProgramCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramCodeBlock)
>-    , programCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramCodeBlock)
>+    , m_evalCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), EvalCodeBlock)
>+    , m_functionCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionCodeBlock)
>+    , m_moduleProgramCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ModuleProgramCodeBlock)
>+    , m_programCodeBlockSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), ProgramCodeBlock)
>     , directEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), DirectEvalExecutable)
>     , functionExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), FunctionExecutable)
>     , indirectEvalExecutableSpace ISO_SUBSPACE_INIT(heap, destructibleCellHeapCellType.get(), IndirectEvalExecutable)
>diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
>index 5839e207fe375d24d9c526090dc3bd6ba2055c93..f9cab82b3e5525196fdd3a1d8780db18c4cdbba0 100644
>--- a/Source/JavaScriptCore/runtime/VM.h
>+++ b/Source/JavaScriptCore/runtime/VM.h
>@@ -105,10 +105,12 @@ class CommonIdentifiers;
> class CompactVariableMap;
> class CustomGetterSetter;
> class DOMAttributeGetterSetter;
>+class EvalCodeBlock;
> class ExecState;
> class Exception;
> class ExceptionScope;
> class FastMallocAlignedMemoryAllocator;
>+class FunctionCodeBlock;
> class GigacageAlignedMemoryAllocator;
> class HandleStack;
> class TypeProfiler;
>@@ -127,7 +129,10 @@ class JSStringHeapCellType;
> class JSWebAssemblyCodeBlockHeapCellType;
> class JSWebAssemblyInstance;
> class LLIntOffsetsExtractor;
>+class MiniVMModeHeapCellType;
>+class ModuleProgramCodeBlock;
> class NativeExecutable;
>+class ProgramCodeBlock;
> class PromiseDeferredTimer;
> class RegExp;
> class RegExpCache;
>@@ -333,6 +338,7 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
> #if ENABLE(WEBASSEMBLY)
>     std::unique_ptr<JSWebAssemblyCodeBlockHeapCellType> webAssemblyCodeBlockHeapCellType;
> #endif
>+    std::unique_ptr<MiniVMModeHeapCellType> miniVMModeHeapCellType;
>     
>     CompleteSubspace primitiveGigacageAuxiliarySpace; // Typed arrays, strings, bitvectors, etc go here.
>     CompleteSubspace jsValueGigacageAuxiliarySpace; // Butterflies, arrays of JSValues, etc go here.
>@@ -367,6 +373,15 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
>     CompleteSubspace destructibleObjectSpace;
>     CompleteSubspace eagerlySweptDestructibleObjectSpace;
>     CompleteSubspace segmentedVariableObjectSpace;
>+
>+    template<typename CellType>
>+    static CompleteSubspace* subspaceInMiniMode(VM& vm)
>+    {
>+        ASSERT(VM::isInMiniMode());
>+        if (CellType::needsDestruction)
>+            return &vm.destructibleCellSpace;
>+        return &vm.cellDangerousBitsSpace;
>+    }
>     
>     IsoSubspace asyncFunctionSpace;
>     IsoSubspace asyncGeneratorFunctionSpace;
>@@ -420,20 +435,42 @@ class VM : public ThreadSafeRefCounted<VM>, public DoublyLinkedListNode<VM> {
>         }
>     };
>     
>-    SpaceAndFinalizerSet evalCodeBlockSpace;
>-    SpaceAndFinalizerSet functionCodeBlockSpace;
>-    SpaceAndFinalizerSet moduleProgramCodeBlockSpace;
>-    SpaceAndFinalizerSet programCodeBlockSpace;
>+    SpaceAndFinalizerSet m_evalCodeBlockSpace;
>+    SpaceAndFinalizerSet m_functionCodeBlockSpace;
>+    SpaceAndFinalizerSet m_moduleProgramCodeBlockSpace;
>+    SpaceAndFinalizerSet m_programCodeBlockSpace;
>+
>+    template<typename CellType>
>+    static IsoSubspace* codeBlockSubspace(VM& vm)
>+    {
>+        if (VM::isInMiniMode())
>+            return &vm.m_functionCodeBlockSpace.space; // We always use functionCodeBlockSpace.
>+
>+        if (std::is_same<CellType, FunctionCodeBlock>::value)
>+            return &vm.m_functionCodeBlockSpace.space;
>+        if (std::is_same<CellType, ProgramCodeBlock>::value)
>+            return &vm.m_programCodeBlockSpace.space;
>+        if (std::is_same<CellType, ModuleProgramCodeBlock>::value)
>+            return &vm.m_moduleProgramCodeBlockSpace.space;
>+        if (std::is_same<CellType, EvalCodeBlock>::value)
>+            return &vm.m_evalCodeBlockSpace.space;
>+        static_assert(std::is_same<CellType, FunctionCodeBlock>::value || std::is_same<CellType, ProgramCodeBlock>::value || std::is_same<CellType, ModuleProgramCodeBlock>::value || std::is_same<CellType, EvalCodeBlock>::value, "");
>+        return nullptr;
>+    }
> 
>     template<typename Func>
>     void forEachCodeBlockSpace(const Func& func)
>     {
>         // This should not include webAssemblyCodeBlockSpace because this is about subsclasses of
>         // JSC::CodeBlock.
>-        func(evalCodeBlockSpace);
>-        func(functionCodeBlockSpace);
>-        func(moduleProgramCodeBlockSpace);
>-        func(programCodeBlockSpace);
>+        if (VM::isInMiniMode()) {
>+            func(m_functionCodeBlockSpace);
>+            return;
>+        }
>+        func(m_evalCodeBlockSpace);
>+        func(m_functionCodeBlockSpace);
>+        func(m_moduleProgramCodeBlockSpace);
>+        func(m_programCodeBlockSpace);
>     }
> 
>     struct ScriptExecutableSpaceAndSet {
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlockHeapCellType.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlockHeapCellType.h
>index fd4ba63adcd3b79562fe55ac20e5b0bcb226aa6d..2431102346d37b155e172a66a5869394bd22611f 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlockHeapCellType.h
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlockHeapCellType.h
>@@ -31,7 +31,7 @@
> 
> namespace JSC {
> 
>-class JSWebAssemblyCodeBlockHeapCellType : public HeapCellType {
>+class JSWebAssemblyCodeBlockHeapCellType final : public HeapCellType {
> public:
>     JSWebAssemblyCodeBlockHeapCellType();
>     virtual ~JSWebAssemblyCodeBlockHeapCellType();
>diff --git a/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h b/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h
>index b03ae04171158bb4a34ca4b5aec7d50a1564c3d7..0274f7b2b74ea3b852d93af921bb7192efdc4e75 100644
>--- a/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h
>+++ b/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h
>@@ -46,6 +46,8 @@ class JSWebAssemblyMemory final : public JSDestructibleObject {
>     template<typename CellType>
>     static CompleteSubspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         // We hold onto a lot of memory, so it makes a lot of sense to be swept eagerly.
>         return &vm.eagerlySweptDestructibleObjectSpace;
>     }
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
>index 344390099ea133ac9d3f60530fddad359cc6c64f..8b963cdec18f0f6661350ae1e88b8408ea8b8f4b 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
>@@ -50,8 +50,10 @@ class WebAssemblyFunction final : public WebAssemblyFunctionBase {
>     const static unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.webAssemblyFunctionSpace;
>     }
> 
>diff --git a/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h b/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h
>index 015fef2cda7fcf5502a618cce5a706b2547d1a8c..d2be65f015d5f2d185261ae24900fa72d4e4d143 100644
>--- a/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h
>+++ b/Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h
>@@ -41,8 +41,10 @@ class WebAssemblyWrapperFunction final : public WebAssemblyFunctionBase {
>     const static unsigned StructureFlags = Base::StructureFlags;
> 
>     template<typename CellType>
>-    static IsoSubspace* subspaceFor(VM& vm)
>+    static Subspace* subspaceFor(VM& vm)
>     {
>+        if (VM::isInMiniMode())
>+            return VM::subspaceInMiniMode<CellType>(vm);
>         return &vm.webAssemblyWrapperFunctionSpace;
>     }
>

Actions: View | Formatted Diff | Diff

Attachments on bug 194136: 360819 | 360830 | 360833 | 360838 | 360840 | 360842 | 360845 | 360847