Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
[JSC] Introduce JSNonDestructibleProxy for JavaScriptCore.framework's…
… GlobalThis

https://bugs.webkit.org/show_bug.cgi?id=194799

Reviewed by Saam Barati.

JSProxy is destructible one because we have JSWindowProxy which has ref counted object.
However, JavaScriptCore.framework's JSProxy for GlobalThis does not need to be destructible.
This is important since we need to separate Heap subspaces between destructible and non-destructible objects.
If we can put more and more objects in non-destructible status, we can get rid of low-usage MarkedBlock.
This patch adds JSNonDestructibleProxy, which is not destructible JSProxy. While it inherits JSDestructibleObject,
we can make the subclass still non-destructible thanks to Subspace mechanism. This drops one more low-usage MarkedBlock.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::resetPrototype):
(JSC::JSGlobalObject::finishCreation):
* runtime/JSNonDestructibleProxy.cpp: Added.
* runtime/JSNonDestructibleProxy.h: Added.
(JSC::JSNonDestructibleProxy::subspaceFor):
(JSC::JSNonDestructibleProxy::create):
(JSC::JSNonDestructibleProxy::createStructure):
(JSC::JSNonDestructibleProxy::JSNonDestructibleProxy):
* runtime/JSProxy.h:
(JSC::JSProxy::JSProxy):

Canonical link: https://commits.webkit.org/209194@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@241769 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
Constellation committed Feb 19, 2019
1 parent 0fb91d2 commit 5c4c3aa
Show file tree
Hide file tree
Showing 9 changed files with 158 additions and 5 deletions.
1 change: 1 addition & 0 deletions Source/JavaScriptCore/CMakeLists.txt
Expand Up @@ -859,6 +859,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
runtime/JSModuleLoader.h
runtime/JSModuleRecord.h
runtime/JSNativeStdFunction.h
runtime/JSNonDestructibleProxy.h
runtime/JSONObject.h
runtime/JSObject.h
runtime/JSObjectInlines.h
Expand Down
29 changes: 29 additions & 0 deletions Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,32 @@
2019-02-18 Yusuke Suzuki <ysuzuki@apple.com>

[JSC] Introduce JSNonDestructibleProxy for JavaScriptCore.framework's GlobalThis
https://bugs.webkit.org/show_bug.cgi?id=194799

Reviewed by Saam Barati.

JSProxy is destructible one because we have JSWindowProxy which has ref counted object.
However, JavaScriptCore.framework's JSProxy for GlobalThis does not need to be destructible.
This is important since we need to separate Heap subspaces between destructible and non-destructible objects.
If we can put more and more objects in non-destructible status, we can get rid of low-usage MarkedBlock.
This patch adds JSNonDestructibleProxy, which is not destructible JSProxy. While it inherits JSDestructibleObject,
we can make the subclass still non-destructible thanks to Subspace mechanism. This drops one more low-usage MarkedBlock.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::resetPrototype):
(JSC::JSGlobalObject::finishCreation):
* runtime/JSNonDestructibleProxy.cpp: Added.
* runtime/JSNonDestructibleProxy.h: Added.
(JSC::JSNonDestructibleProxy::subspaceFor):
(JSC::JSNonDestructibleProxy::create):
(JSC::JSNonDestructibleProxy::createStructure):
(JSC::JSNonDestructibleProxy::JSNonDestructibleProxy):
* runtime/JSProxy.h:
(JSC::JSProxy::JSProxy):

2019-02-19 Robin Morisset <rmorisset@apple.com>

B3ReduceStrength::simplifyCFG() could do a lot more on each iteration
Expand Down
Expand Up @@ -1767,6 +1767,7 @@
E36CC9472086314F0051FFD6 /* WasmCreationMode.h in Headers */ = {isa = PBXBuildFile; fileRef = E36CC9462086314F0051FFD6 /* WasmCreationMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
E3794E761B77EB97005543AE /* ModuleAnalyzer.h in Headers */ = {isa = PBXBuildFile; fileRef = E3794E741B77EB97005543AE /* ModuleAnalyzer.h */; settings = {ATTRIBUTES = (Private, ); }; };
E3893A1D2203A7C600E79A74 /* AsyncFromSyncIteratorPrototype.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = E3893A1C2203A7C600E79A74 /* AsyncFromSyncIteratorPrototype.lut.h */; };
E38D999C221B78BB00D50474 /* JSNonDestructibleProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = E38D999A221B789F00D50474 /* JSNonDestructibleProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
E39006212208BFC4001019CF /* SubspaceAccess.h in Headers */ = {isa = PBXBuildFile; fileRef = E39006202208BFC3001019CF /* SubspaceAccess.h */; settings = {ATTRIBUTES = (Private, ); }; };
E393ADD81FE702D00022D681 /* WeakMapImplInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E393ADD71FE702CC0022D681 /* WeakMapImplInlines.h */; };
E39D45F51D39005600B3B377 /* InterpreterInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = E39D9D841D39000600667282 /* InterpreterInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
Expand Down Expand Up @@ -4713,6 +4714,8 @@
E38D060B1F8E814100649CF2 /* JSScriptFetchParameters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScriptFetchParameters.h; sourceTree = "<group>"; };
E38D060C1F8E814100649CF2 /* ScriptFetchParameters.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFetchParameters.h; sourceTree = "<group>"; };
E38D060D1F8E814100649CF2 /* JSScriptFetchParameters.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSScriptFetchParameters.cpp; sourceTree = "<group>"; };
E38D999A221B789F00D50474 /* JSNonDestructibleProxy.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSNonDestructibleProxy.h; sourceTree = "<group>"; };
E38D999B221B789F00D50474 /* JSNonDestructibleProxy.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSNonDestructibleProxy.cpp; sourceTree = "<group>"; };
E39006202208BFC3001019CF /* SubspaceAccess.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SubspaceAccess.h; sourceTree = "<group>"; };
E393ADD71FE702CC0022D681 /* WeakMapImplInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakMapImplInlines.h; sourceTree = "<group>"; };
E3963CEC1B73F75000EB4CE5 /* NodesAnalyzeModule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesAnalyzeModule.cpp; sourceTree = "<group>"; };
Expand Down Expand Up @@ -6933,6 +6936,8 @@
E39DA4A51B7E8B7C0084F33A /* JSModuleRecord.h */,
E33E8D1A1B9013C300346B52 /* JSNativeStdFunction.cpp */,
E33E8D1B1B9013C300346B52 /* JSNativeStdFunction.h */,
E38D999B221B789F00D50474 /* JSNonDestructibleProxy.cpp */,
E38D999A221B789F00D50474 /* JSNonDestructibleProxy.h */,
BC22A3980E16E14800AF21C8 /* JSObject.cpp */,
BC22A3990E16E14800AF21C8 /* JSObject.h */,
0F93275E1C21EF7F00CF6564 /* JSObjectInlines.h */,
Expand Down Expand Up @@ -8389,6 +8394,7 @@
534E034E1E4D4B1600213F64 /* AccessCase.h in Headers */,
E3BFD0BC1DAF808E0065DEA2 /* AccessCaseSnippetParams.h in Headers */,
5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers */,
524E9D7322092B5200A6BEEE /* AirAllocateRegistersAndStackAndGenerateCode.h in Headers */,
0F2AC56B1E8A0BD50001EE3F /* AirAllocateRegistersAndStackByLinearScan.h in Headers */,
7965C2171E5D799600B7591D /* AirAllocateRegistersByGraphColoring.h in Headers */,
0FEC856E1BDACDC70080FF74 /* AirAllocateStackByGraphColoring.h in Headers */,
Expand Down Expand Up @@ -8857,7 +8863,6 @@
A7D89CFE17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.h in Headers */,
0FD82E57141DAF1000179C94 /* DFGOSREntry.h in Headers */,
0FD8A32617D51F5700CA2C40 /* DFGOSREntrypointCreationPhase.h in Headers */,
524E9D7322092B5200A6BEEE /* AirAllocateRegistersAndStackAndGenerateCode.h in Headers */,
0FC0976A1468A6F700CF2442 /* DFGOSRExit.h in Headers */,
0F235BEC17178E7300690C7F /* DFGOSRExitBase.h in Headers */,
0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */,
Expand Down Expand Up @@ -9336,6 +9341,7 @@
E318CBC11B8AEF5100A2929D /* JSModuleNamespaceObject.h in Headers */,
E39DA4A71B7E8B7C0084F33A /* JSModuleRecord.h in Headers */,
E33E8D1D1B9013C300346B52 /* JSNativeStdFunction.h in Headers */,
E38D999C221B78BB00D50474 /* JSNonDestructibleProxy.h in Headers */,
BC18C4240E16F5CD00B34460 /* JSObject.h in Headers */,
0F93275F1C21EF7F00CF6564 /* JSObjectInlines.h in Headers */,
BC18C4250E16F5CD00B34460 /* JSObjectRef.h in Headers */,
Expand Down
1 change: 1 addition & 0 deletions Source/JavaScriptCore/Sources.txt
Expand Up @@ -832,6 +832,7 @@ runtime/JSModuleLoader.cpp
runtime/JSModuleNamespaceObject.cpp
runtime/JSModuleRecord.cpp
runtime/JSNativeStdFunction.cpp
runtime/JSNonDestructibleProxy.cpp
runtime/JSONObject.cpp
runtime/JSObject.cpp
runtime/JSPromise.cpp
Expand Down
5 changes: 3 additions & 2 deletions Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Expand Up @@ -109,6 +109,7 @@
#include "JSModuleNamespaceObject.h"
#include "JSModuleRecord.h"
#include "JSNativeStdFunction.h"
#include "JSNonDestructibleProxy.h"
#include "JSONObject.h"
#include "JSPromise.h"
#include "JSPromiseConstructor.h"
Expand Down Expand Up @@ -1540,7 +1541,7 @@ void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
oldLastInPrototypeChain->setPrototypeDirect(vm, objectPrototype);

// Whenever we change the prototype of the global object, we need to create a new JSProxy with the correct prototype.
setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
setGlobalThis(vm, JSNonDestructibleProxy::create(vm, JSNonDestructibleProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
}

void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
Expand Down Expand Up @@ -1935,7 +1936,7 @@ void JSGlobalObject::finishCreation(VM& vm)
structure(vm)->setGlobalObject(vm, this);
m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
init(vm);
setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(vm), PureForwardingProxyType), this));
setGlobalThis(vm, JSNonDestructibleProxy::create(vm, JSNonDestructibleProxy::createStructure(vm, this, getPrototypeDirect(vm), PureForwardingProxyType), this));
ASSERT(type() == GlobalObjectType);
}

Expand Down
33 changes: 33 additions & 0 deletions Source/JavaScriptCore/runtime/JSNonDestructibleProxy.cpp
@@ -0,0 +1,33 @@
/*
* Copyright (C) 2019 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
* THE POSSIBILITY OF SUCH DAMAGE.
*/

#include "config.h"
#include "JSNonDestructibleProxy.h"

namespace JSC {

const ClassInfo JSNonDestructibleProxy::s_info = { "JSNonDestructibleProxy", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSNonDestructibleProxy) };

} // namespace JSC
81 changes: 81 additions & 0 deletions Source/JavaScriptCore/runtime/JSNonDestructibleProxy.h
@@ -0,0 +1,81 @@
/*
* Copyright (C) 2019 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

#pragma once

#include "JSProxy.h"

namespace JSC {

class JSNonDestructibleProxy : public JSProxy {
public:
using Base = JSProxy;
static const unsigned StructureFlags = Base::StructureFlags;
static const bool needsDestruction = false;

template<typename CellType, SubspaceAccess mode>
static CompleteSubspace* subspaceFor(VM& vm)
{
// JSProxy is JSDestrucitbleObject, but we make this JSNonDestructibleProxy non-destructible by using non-destructible subspace.
// The motivation behind this is (1) except for JSWindowProxy JSProxy does not need to be destructible, and (2) subspace of destructible
// and non-destructible objects are separated and JSProxy is using one MarkedBlock only for JSProxy class in the JSC framework and wasting memory.
// Basically, to make objects destructible, objects need to inherit JSDestructibleObject. It holds a classInfo at a specific offset
// so that Heap can get methodTable::destroy even if structures held by objects are destroyed before objects' destructions. But this
// requirement forces JSProxy to inherit JSDestructibleObject for JSWindowProxy even while the other JSProxy does not need to be
// destructible. We create JSNonDestructibleProxy, which is a subclass of JSProxy, and make it non-destructible so that we still keep
// JSWindowProxy destructible while making JSNonDestructibleProxy non-destructible.
return JSNonFinalObject::subspaceFor<CellType, mode>(vm);
}

static JSNonDestructibleProxy* create(VM& vm, Structure* structure, JSObject* target)
{
JSNonDestructibleProxy* proxy = new (NotNull, allocateCell<JSNonDestructibleProxy>(vm.heap)) JSNonDestructibleProxy(vm, structure);
proxy->finishCreation(vm, target);
return proxy;
}

static JSNonDestructibleProxy* create(VM& vm, Structure* structure)
{
JSNonDestructibleProxy* proxy = new (NotNull, allocateCell<JSNonDestructibleProxy>(vm.heap)) JSNonDestructibleProxy(vm, structure);
proxy->finishCreation(vm);
return proxy;
}

static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype, JSType proxyType)
{
ASSERT(proxyType == ImpureProxyType || proxyType == PureForwardingProxyType);
return Structure::create(vm, globalObject, prototype, TypeInfo(proxyType, StructureFlags), info());
}

DECLARE_EXPORT_INFO;

protected:
JSNonDestructibleProxy(VM& vm, Structure* structure)
: Base(vm, structure)
{
}
};

} // namespace JSC
4 changes: 2 additions & 2 deletions Source/JavaScriptCore/runtime/JSProxy.h
Expand Up @@ -31,7 +31,7 @@ namespace JSC {

class JSProxy : public JSDestructibleObject {
public:
typedef JSDestructibleObject Base;
using Base = JSDestructibleObject;
static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero;

static JSProxy* create(VM& vm, Structure* structure, JSObject* target)
Expand Down Expand Up @@ -63,7 +63,7 @@ class JSProxy : public JSDestructibleObject {

protected:
JSProxy(VM& vm, Structure* structure)
: JSDestructibleObject(vm, structure)
: Base(vm, structure)
{
}

Expand Down
1 change: 1 addition & 0 deletions Source/JavaScriptCore/runtime/Options.cpp
Expand Up @@ -27,6 +27,7 @@
#include "Options.h"

#include "AssemblerCommon.h"
#include "CPU.h"
#include "LLIntCommon.h"
#include "MinimumReservedZoneSize.h"
#include "SigillCrashAnalyzer.h"
Expand Down

0 comments on commit 5c4c3aa

Please sign in to comment.