[JSC] Introduce JSNonDestructibleProxy for JavaScriptCore.framework's GlobalThis
authorysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 19 Feb 2019 20:14:57 +0000 (20:14 +0000)
committerysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 19 Feb 2019 20:14:57 +0000 (20:14 +0000)
https://bugs.webkit.org/show_bug.cgi?id=194799

Reviewed by Saam Barati.

JSProxy is destructible one because we have JSWindowProxy which has ref counted object.
However, JavaScriptCore.framework's JSProxy for GlobalThis does not need to be destructible.
This is important since we need to separate Heap subspaces between destructible and non-destructible objects.
If we can put more and more objects in non-destructible status, we can get rid of low-usage MarkedBlock.
This patch adds JSNonDestructibleProxy, which is not destructible JSProxy. While it inherits JSDestructibleObject,
we can make the subclass still non-destructible thanks to Subspace mechanism. This drops one more low-usage MarkedBlock.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::resetPrototype):
(JSC::JSGlobalObject::finishCreation):
* runtime/JSNonDestructibleProxy.cpp: Added.
* runtime/JSNonDestructibleProxy.h: Added.
(JSC::JSNonDestructibleProxy::subspaceFor):
(JSC::JSNonDestructibleProxy::create):
(JSC::JSNonDestructibleProxy::createStructure):
(JSC::JSNonDestructibleProxy::JSNonDestructibleProxy):
* runtime/JSProxy.h:
(JSC::JSProxy::JSProxy):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@241769 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/CMakeLists.txt
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
Source/JavaScriptCore/Sources.txt
Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Source/JavaScriptCore/runtime/JSNonDestructibleProxy.cpp [new file with mode: 0644]
Source/JavaScriptCore/runtime/JSNonDestructibleProxy.h [new file with mode: 0644]
Source/JavaScriptCore/runtime/JSProxy.h
Source/JavaScriptCore/runtime/Options.cpp

index e311ace..6afab27 100644 (file)
@@ -859,6 +859,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
     runtime/JSModuleLoader.h
     runtime/JSModuleRecord.h
     runtime/JSNativeStdFunction.h
+    runtime/JSNonDestructibleProxy.h
     runtime/JSONObject.h
     runtime/JSObject.h
     runtime/JSObjectInlines.h
index 48ae586..2037305 100644 (file)
@@ -1,3 +1,32 @@
+2019-02-18  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Introduce JSNonDestructibleProxy for JavaScriptCore.framework's GlobalThis
+        https://bugs.webkit.org/show_bug.cgi?id=194799
+
+        Reviewed by Saam Barati.
+
+        JSProxy is destructible one because we have JSWindowProxy which has ref counted object.
+        However, JavaScriptCore.framework's JSProxy for GlobalThis does not need to be destructible.
+        This is important since we need to separate Heap subspaces between destructible and non-destructible objects.
+        If we can put more and more objects in non-destructible status, we can get rid of low-usage MarkedBlock.
+        This patch adds JSNonDestructibleProxy, which is not destructible JSProxy. While it inherits JSDestructibleObject,
+        we can make the subclass still non-destructible thanks to Subspace mechanism. This drops one more low-usage MarkedBlock.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Sources.txt:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resetPrototype):
+        (JSC::JSGlobalObject::finishCreation):
+        * runtime/JSNonDestructibleProxy.cpp: Added.
+        * runtime/JSNonDestructibleProxy.h: Added.
+        (JSC::JSNonDestructibleProxy::subspaceFor):
+        (JSC::JSNonDestructibleProxy::create):
+        (JSC::JSNonDestructibleProxy::createStructure):
+        (JSC::JSNonDestructibleProxy::JSNonDestructibleProxy):
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::JSProxy):
+
 2019-02-19  Robin Morisset  <rmorisset@apple.com>
 
         B3ReduceStrength::simplifyCFG() could do a lot more on each iteration
index 4613ea3..1812930 100644 (file)
                E36CC9472086314F0051FFD6 /* WasmCreationMode.h in Headers */ = {isa = PBXBuildFile; fileRef = E36CC9462086314F0051FFD6 /* WasmCreationMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
                E3794E761B77EB97005543AE /* ModuleAnalyzer.h in Headers */ = {isa = PBXBuildFile; fileRef = E3794E741B77EB97005543AE /* ModuleAnalyzer.h */; settings = {ATTRIBUTES = (Private, ); }; };
                E3893A1D2203A7C600E79A74 /* AsyncFromSyncIteratorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = E3893A1C2203A7C600E79A74 /* AsyncFromSyncIteratorPrototype.lut.h */; };
+               E38D999C221B78BB00D50474 /* JSNonDestructibleProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = E38D999A221B789F00D50474 /* JSNonDestructibleProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
                E39006212208BFC4001019CF /* SubspaceAccess.h in Headers */ = {isa = PBXBuildFile; fileRef = E39006202208BFC3001019CF /* SubspaceAccess.h */; settings = {ATTRIBUTES = (Private, ); }; };
                E393ADD81FE702D00022D681 /* WeakMapImplInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E393ADD71FE702CC0022D681 /* WeakMapImplInlines.h */; };
                E39D45F51D39005600B3B377 /* InterpreterInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E39D9D841D39000600667282 /* InterpreterInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
                E38D060B1F8E814100649CF2 /* JSScriptFetchParameters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScriptFetchParameters.h; sourceTree = "<group>"; };
                E38D060C1F8E814100649CF2 /* ScriptFetchParameters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFetchParameters.h; sourceTree = "<group>"; };
                E38D060D1F8E814100649CF2 /* JSScriptFetchParameters.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSScriptFetchParameters.cpp; sourceTree = "<group>"; };
+               E38D999A221B789F00D50474 /* JSNonDestructibleProxy.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSNonDestructibleProxy.h; sourceTree = "<group>"; };
+               E38D999B221B789F00D50474 /* JSNonDestructibleProxy.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSNonDestructibleProxy.cpp; sourceTree = "<group>"; };
                E39006202208BFC3001019CF /* SubspaceAccess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SubspaceAccess.h; sourceTree = "<group>"; };
                E393ADD71FE702CC0022D681 /* WeakMapImplInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakMapImplInlines.h; sourceTree = "<group>"; };
                E3963CEC1B73F75000EB4CE5 /* NodesAnalyzeModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesAnalyzeModule.cpp; sourceTree = "<group>"; };
                                E39DA4A51B7E8B7C0084F33A /* JSModuleRecord.h */,
                                E33E8D1A1B9013C300346B52 /* JSNativeStdFunction.cpp */,
                                E33E8D1B1B9013C300346B52 /* JSNativeStdFunction.h */,
+                               E38D999B221B789F00D50474 /* JSNonDestructibleProxy.cpp */,
+                               E38D999A221B789F00D50474 /* JSNonDestructibleProxy.h */,
                                BC22A3980E16E14800AF21C8 /* JSObject.cpp */,
                                BC22A3990E16E14800AF21C8 /* JSObject.h */,
                                0F93275E1C21EF7F00CF6564 /* JSObjectInlines.h */,
                                534E034E1E4D4B1600213F64 /* AccessCase.h in Headers */,
                                E3BFD0BC1DAF808E0065DEA2 /* AccessCaseSnippetParams.h in Headers */,
                                5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers */,
+                               524E9D7322092B5200A6BEEE /* AirAllocateRegistersAndStackAndGenerateCode.h in Headers */,
                                0F2AC56B1E8A0BD50001EE3F /* AirAllocateRegistersAndStackByLinearScan.h in Headers */,
                                7965C2171E5D799600B7591D /* AirAllocateRegistersByGraphColoring.h in Headers */,
                                0FEC856E1BDACDC70080FF74 /* AirAllocateStackByGraphColoring.h in Headers */,
                                A7D89CFE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h in Headers */,
                                0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */,
                                0FD8A32617D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h in Headers */,
-                               524E9D7322092B5200A6BEEE /* AirAllocateRegistersAndStackAndGenerateCode.h in Headers */,
                                0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */,
                                0F235BEC17178E7300690C7F /* DFGOSRExitBase.h in Headers */,
                                0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */,
                                E318CBC11B8AEF5100A2929D /* JSModuleNamespaceObject.h in Headers */,
                                E39DA4A71B7E8B7C0084F33A /* JSModuleRecord.h in Headers */,
                                E33E8D1D1B9013C300346B52 /* JSNativeStdFunction.h in Headers */,
+                               E38D999C221B78BB00D50474 /* JSNonDestructibleProxy.h in Headers */,
                                BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */,
                                0F93275F1C21EF7F00CF6564 /* JSObjectInlines.h in Headers */,
                                BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */,
index c2fbd66..ad71971 100644 (file)
@@ -832,6 +832,7 @@ runtime/JSModuleLoader.cpp
 runtime/JSModuleNamespaceObject.cpp
 runtime/JSModuleRecord.cpp
 runtime/JSNativeStdFunction.cpp
+runtime/JSNonDestructibleProxy.cpp
 runtime/JSONObject.cpp
 runtime/JSObject.cpp
 runtime/JSPromise.cpp
index 493e481..a91abd7 100644 (file)
 #include "JSModuleNamespaceObject.h"
 #include "JSModuleRecord.h"
 #include "JSNativeStdFunction.h"
+#include "JSNonDestructibleProxy.h"
 #include "JSONObject.h"
 #include "JSPromise.h"
 #include "JSPromiseConstructor.h"
@@ -1540,7 +1541,7 @@ void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
         oldLastInPrototypeChain->setPrototypeDirect(vm, objectPrototype);
 
     // Whenever we change the prototype of the global object, we need to create a new JSProxy with the correct prototype.
-    setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
+    setGlobalThis(vm, JSNonDestructibleProxy::create(vm, JSNonDestructibleProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
 }
 
 void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
@@ -1935,7 +1936,7 @@ void JSGlobalObject::finishCreation(VM& vm)
     structure(vm)->setGlobalObject(vm, this);
     m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
     init(vm);
-    setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(vm), PureForwardingProxyType), this));
+    setGlobalThis(vm, JSNonDestructibleProxy::create(vm, JSNonDestructibleProxy::createStructure(vm, this, getPrototypeDirect(vm), PureForwardingProxyType), this));
     ASSERT(type() == GlobalObjectType);
 }
 
diff --git a/Source/JavaScriptCore/runtime/JSNonDestructibleProxy.cpp b/Source/JavaScriptCore/runtime/JSNonDestructibleProxy.cpp
new file mode 100644 (file)
index 0000000..9e08ca2
--- /dev/null
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSNonDestructibleProxy.h"
+
+namespace JSC {
+
+const ClassInfo JSNonDestructibleProxy::s_info = { "JSNonDestructibleProxy", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSNonDestructibleProxy) };
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSNonDestructibleProxy.h b/Source/JavaScriptCore/runtime/JSNonDestructibleProxy.h
new file mode 100644 (file)
index 0000000..913e54a
--- /dev/null
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "JSProxy.h"
+
+namespace JSC {
+
+    class JSNonDestructibleProxy : public JSProxy {
+        public:
+            using Base = JSProxy;
+            static const unsigned StructureFlags = Base::StructureFlags;
+            static const bool needsDestruction = false;
+
+            template<typename CellType, SubspaceAccess mode>
+                static CompleteSubspace* subspaceFor(VM& vm)
+                {
+                    // JSProxy is JSDestrucitbleObject, but we make this JSNonDestructibleProxy non-destructible by using non-destructible subspace.
+                    // The motivation behind this is (1) except for JSWindowProxy JSProxy does not need to be destructible, and (2) subspace of destructible
+                    // and non-destructible objects are separated and JSProxy is using one MarkedBlock only for JSProxy class in the JSC framework and wasting memory.
+                    // Basically, to make objects destructible, objects need to inherit JSDestructibleObject. It holds a classInfo at a specific offset
+                    // so that Heap can get methodTable::destroy even if structures held by objects are destroyed before objects' destructions. But this
+                    // requirement forces JSProxy to inherit JSDestructibleObject for JSWindowProxy even while the other JSProxy does not need to be
+                    // destructible. We create JSNonDestructibleProxy, which is a subclass of JSProxy, and make it non-destructible so that we still keep
+                    // JSWindowProxy destructible while making JSNonDestructibleProxy non-destructible.
+                    return JSNonFinalObject::subspaceFor<CellType, mode>(vm);
+                }
+
+            static JSNonDestructibleProxy* create(VM& vm, Structure* structure, JSObject* target)
+            {
+                JSNonDestructibleProxy* proxy = new (NotNull, allocateCell<JSNonDestructibleProxy>(vm.heap)) JSNonDestructibleProxy(vm, structure);
+                proxy->finishCreation(vm, target);
+                return proxy;
+            }
+
+            static JSNonDestructibleProxy* create(VM& vm, Structure* structure)
+            {
+                JSNonDestructibleProxy* proxy = new (NotNull, allocateCell<JSNonDestructibleProxy>(vm.heap)) JSNonDestructibleProxy(vm, structure);
+                proxy->finishCreation(vm);
+                return proxy;
+            }
+
+            static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, JSType proxyType)
+            {
+                ASSERT(proxyType == ImpureProxyType || proxyType == PureForwardingProxyType);
+                return Structure::create(vm, globalObject, prototype, TypeInfo(proxyType, StructureFlags), info());
+            }
+
+            DECLARE_EXPORT_INFO;
+
+        protected:
+            JSNonDestructibleProxy(VM& vm, Structure* structure)
+                : Base(vm, structure)
+            {
+            }
+    };
+
+} // namespace JSC
index 0bd35c9..ace1703 100644 (file)
@@ -31,7 +31,7 @@ namespace JSC {
 
 class JSProxy : public JSDestructibleObject {
 public:
-    typedef JSDestructibleObject Base;
+    using Base = JSDestructibleObject;
     static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;
 
     static JSProxy* create(VM& vm, Structure* structure, JSObject* target)
@@ -63,7 +63,7 @@ public:
 
 protected:
     JSProxy(VM& vm, Structure* structure)
-        : JSDestructibleObject(vm, structure)
+        : Base(vm, structure)
     {
     }
 
index 84d7326..b9e972d 100644 (file)
@@ -27,6 +27,7 @@
 #include "Options.h"
 
 #include "AssemblerCommon.h"
+#include "CPU.h"
 #include "LLIntCommon.h"
 #include "MinimumReservedZoneSize.h"
 #include "SigillCrashAnalyzer.h"