Structure::get should instantiate DeferGC only when materializing property map
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 11 Jun 2014 19:29:51 +0000 (19:29 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 11 Jun 2014 19:29:51 +0000 (19:29 +0000)
commit2e371a1f0d9bbaecc3e6e9dce396f4c3f4d3bc59
tree6c71d1bb8d365ce4f1e103afd90a66aef52a007a
parent2fc93a6611487496d4e4bbbbd7a673ea869698ce
Structure::get should instantiate DeferGC only when materializing property map
https://bugs.webkit.org/show_bug.cgi?id=133727

Reviewed by Geoffrey Garen.

DeferGC instances in Structure::get was added in http://trac.webkit.org/r157539 in order to avoid
collecting the property table newly created by materializePropertyMapIfNecessary since GC can happen
when GCSafeConcurrentJITLocker goes out of scope.

However, always instantiating DeferGC inside Structure::get introduced a new performance bottleneck
in JSObject::getPropertySlot because frequently incrementing and decrementing a counter in vm.m_heap
and running a release assertion inside Heap::incrementDeferralDepth() is expensive.

Work around this by instantiating DeferGC only when we're actually calling materializePropertyMap,
and immediately storing a pointer to the newly created property table in the stack before DeferGC
goes out of scope so that the property table will be marked.

This shows 13-16% improvement on the microbenchmark attached in the bug.

* runtime/JSCJSValue.cpp:
* runtime/JSObject.h:
(JSC::JSObject::fastGetOwnPropertySlot):
* runtime/Structure.h:
(JSC::Structure::materializePropertyMapIfNecessary):
* runtime/StructureInlines.h:
(JSC::Structure::get):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@169816 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSCJSValue.cpp
Source/JavaScriptCore/runtime/JSObject.h
Source/JavaScriptCore/runtime/Structure.h
Source/JavaScriptCore/runtime/StructureInlines.h