Unreviewed, rolling out r163542.

http://trac.webkit.org/changeset/163542 https://bugs.webkit.org/show_bug.cgi?id=128324 Caused many assertion failures (Requested by ap on #webkit). Source/JavaScriptCore: * GNUmakefile.list.am: * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj: * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters: * JavaScriptCore.xcodeproj/project.pbxproj: * heap/CopyWriteBarrier.h: (JSC::CopyWriteBarrier::set): * heap/Heap.cpp: (JSC::Heap::writeBarrier): * heap/Heap.h: (JSC::Heap::writeBarrier): * jit/JITOperations.cpp: * jit/JITWriteBarrier.h: (JSC::JITWriteBarrierBase::set): * llint/LLIntSlowPaths.cpp: (JSC::LLInt::llint_write_barrier_slow): * runtime/Arguments.h: * runtime/JSWeakMap.cpp: * runtime/MapData.cpp: (JSC::MapData::ensureSpaceForAppend): * runtime/PropertyTable.cpp: (JSC::PropertyTable::PropertyTable): * runtime/Structure.h: * runtime/WriteBarrier.h: (JSC::WriteBarrierBase::set): (JSC::WriteBarrierBase::setMayBeNull): (JSC::WriteBarrierBase::setEarlyValue): (JSC::WriteBarrierBase<Unknown>::set): * runtime/WriteBarrierInlines.h: Removed. Source/WebCore: * bindings/js/JSEventListener.cpp: (WebCore::JSEventListener::JSEventListener): * bindings/js/JSEventListener.h: (WebCore::JSEventListener::jsFunction): Canonical link: https://commits.webkit.org/146338@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@163556 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Feb 6, 2014 · 987b24b · 987b24b
1 parent 5fcede2
commit 987b24b
Show file tree

Hide file tree

Showing 21 changed files with 94 additions and 102 deletions.
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,40 @@
+2014-02-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r163542.
+        http://trac.webkit.org/changeset/163542
+        https://bugs.webkit.org/show_bug.cgi?id=128324
+
+        Caused many assertion failures (Requested by ap on #webkit).
+
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopyWriteBarrier.h:
+        (JSC::CopyWriteBarrier::set):
+        * heap/Heap.cpp:
+        (JSC::Heap::writeBarrier):
+        * heap/Heap.h:
+        (JSC::Heap::writeBarrier):
+        * jit/JITOperations.cpp:
+        * jit/JITWriteBarrier.h:
+        (JSC::JITWriteBarrierBase::set):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::llint_write_barrier_slow):
+        * runtime/Arguments.h:
+        * runtime/JSWeakMap.cpp:
+        * runtime/MapData.cpp:
+        (JSC::MapData::ensureSpaceForAppend):
+        * runtime/PropertyTable.cpp:
+        (JSC::PropertyTable::PropertyTable):
+        * runtime/Structure.h:
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::set):
+        (JSC::WriteBarrierBase::setMayBeNull):
+        (JSC::WriteBarrierBase::setEarlyValue):
+        (JSC::WriteBarrierBase<Unknown>::set):
+        * runtime/WriteBarrierInlines.h: Removed.
+
 2014-02-06  Oliver Hunt  <oliver@apple.com>
 
         Make 32bit pass the correct this value to custom getters

diff --git a/Source/JavaScriptCore/GNUmakefile.list.am b/Source/JavaScriptCore/GNUmakefile.list.am
@@ -1221,7 +1221,6 @@ javascriptcore_sources += \
 	Source/JavaScriptCore/runtime/WeakMapPrototype.h \
 	Source/JavaScriptCore/runtime/WeakRandom.h \
 	Source/JavaScriptCore/runtime/WriteBarrier.h \
-    Source/JavaScriptCore/runtime/WriteBarrierInlines.h \
 	Source/JavaScriptCore/tools/CodeProfile.cpp \
 	Source/JavaScriptCore/tools/CodeProfile.h \
 	Source/JavaScriptCore/tools/CodeProfiling.cpp \

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj b/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj
@@ -1388,7 +1388,6 @@
     <ClInclude Include="..\runtime\WeakMapPrototype.h" />
     <ClInclude Include="..\runtime\WeakRandom.h" />
     <ClInclude Include="..\runtime\WriteBarrier.h" />
-    <ClInclude Include="..\runtime\WriteBarrierInlines.h" />
     <ClInclude Include="..\tools\CodeProfile.h" />
     <ClInclude Include="..\tools\CodeProfiling.h" />
     <ClInclude Include="..\tools\ProfileTreeNode.h" />

diff --git a/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters b/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters
@@ -2438,9 +2438,6 @@
     <ClInclude Include="..\runtime\WriteBarrier.h">
       <Filter>runtime</Filter>
     </ClInclude>
-    <ClInclude Include="..\runtime\WriteBarrierInlines.h">
-      <Filter>runtime</Filter>
-    </ClInclude>
     <ClInclude Include="..\tools\CodeProfile.h">
       <Filter>tools</Filter>
     </ClInclude>

diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -1333,7 +1333,6 @@
 		C2981FDD17BAFF4400A3BC98 /* DFGDesiredWriteBarriers.h in Headers */ = {isa = PBXBuildFile; fileRef = C2981FDB17BAFF4400A3BC98 /* DFGDesiredWriteBarriers.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C29ECB031804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm in Sources */ = {isa = PBXBuildFile; fileRef = C29ECB011804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm */; };
 		C2A7F688160432D400F76B98 /* JSDestructibleObject.h in Headers */ = {isa = PBXBuildFile; fileRef = C2A7F687160432D400F76B98 /* JSDestructibleObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C2B916C514DA040C00CBAC86 /* MarkedAllocator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */; };
 		C2C0F7CD17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */; };
@@ -2766,7 +2765,6 @@
 		C29ECB011804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = CurrentThisInsideBlockGetterTest.mm; path = API/tests/CurrentThisInsideBlockGetterTest.mm; sourceTree = "<group>"; };
 		C29ECB021804D0ED00D2CBB4 /* CurrentThisInsideBlockGetterTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CurrentThisInsideBlockGetterTest.h; path = API/tests/CurrentThisInsideBlockGetterTest.h; sourceTree = "<group>"; };
 		C2A7F687160432D400F76B98 /* JSDestructibleObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDestructibleObject.h; sourceTree = "<group>"; };
-		C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierInlines.h; sourceTree = "<group>"; };
 		C2B916C114DA014E00CBAC86 /* MarkedAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkedAllocator.h; sourceTree = "<group>"; };
 		C2B916C414DA040C00CBAC86 /* MarkedAllocator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkedAllocator.cpp; sourceTree = "<group>"; };
 		C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredTransitions.cpp; path = dfg/DFGDesiredTransitions.cpp; sourceTree = "<group>"; };
@@ -3626,7 +3624,6 @@
 		7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
 			isa = PBXGroup;
 			children = (
-				C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */,
 				BCF605110E203EF800B9A64D /* ArgList.cpp */,
 				BCF605120E203EF800B9A64D /* ArgList.h */,
 				BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
@@ -4644,7 +4641,6 @@
 				65C0285D1717966800351E35 /* ARMv7DOpcode.h in Headers */,
 				2A68295B1875F80500B6C3E2 /* CopyWriteBarrier.h in Headers */,
 				2A4EC90C1860D6C20094F782 /* WriteBarrierBuffer.h in Headers */,
-				C2B6D75318A33793004A9301 /* WriteBarrierInlines.h in Headers */,
 				FE5932A8183C5A2600A1ECCC /* VMEntryScope.h in Headers */,
 				A532439318569709002ED692 /* CodeGeneratorInspectorStrings.py in Headers */,
 				A532439218569709002ED692 /* CodeGeneratorInspector.py in Headers */,

diff --git a/Source/JavaScriptCore/heap/CopyWriteBarrier.h b/Source/JavaScriptCore/heap/CopyWriteBarrier.h
@@ -68,10 +68,10 @@ class CopyWriteBarrier {
         return get();
     }
 
-    void set(VM& vm, const JSCell* owner, T* value)
+    void set(VM&, const JSCell* owner, T* value)
     {
         this->m_value = value;
-        vm.heap.writeBarrier(owner);
+        Heap::writeBarrier(owner);
     }
 
     void setWithoutWriteBarrier(T* value)

diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
@@ -1087,7 +1087,8 @@ void Heap::writeBarrier(const JSCell* from)
     ASSERT_GC_OBJECT_LOOKS_VALID(const_cast<JSCell*>(from));
     if (!from || !isMarked(from))
         return;
-    addToRememberedSet(from);
+    Heap* heap = Heap::heap(from);
+    heap->addToRememberedSet(from);
 #else
     UNUSED_PARAM(from);
 #endif

diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
@@ -102,9 +102,9 @@ namespace JSC {
             return MarkedBlock::blockFor(cell)->isRemembered(cell);
         }
         static bool isWriteBarrierEnabled();
-        JS_EXPORT_PRIVATE void writeBarrier(const JSCell*);
-        void writeBarrier(const JSCell*, JSValue);
-        void writeBarrier(const JSCell*, JSCell*);
+        JS_EXPORT_PRIVATE static void writeBarrier(const JSCell*);
+        static void writeBarrier(const JSCell*, JSValue);
+        static void writeBarrier(const JSCell*, JSCell*);
 
         WriteBarrierBuffer& writeBarrierBuffer() { return m_writeBarrierBuffer; }
         void flushWriteBarrierBuffer(JSCell*);
@@ -401,7 +401,7 @@ namespace JSC {
             return;
         if (!to || isMarked(to))
             return;
-        addToRememberedSet(from);
+        Heap::heap(from)->addToRememberedSet(from);
     }
 
     inline void Heap::writeBarrier(const JSCell* from, JSValue to)

diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
@@ -1740,7 +1740,7 @@ void JIT_OPERATION operationOSRWriteBarrier(ExecState* exec, JSCell* cell)
 {
     VM* vm = &exec->vm();
     NativeCallFrameTracer tracer(vm, exec);
-    vm->heap.writeBarrier(cell);
+    exec->heap()->writeBarrier(cell);
 }
 
 // NB: We don't include the value as part of the barrier because the write barrier elision
@@ -1750,7 +1750,7 @@ void JIT_OPERATION operationUnconditionalWriteBarrier(ExecState* exec, JSCell* c
 {
     VM* vm = &exec->vm();
     NativeCallFrameTracer tracer(vm, exec);
-    vm->heap.writeBarrier(cell);
+    Heap::writeBarrier(cell);
 }
 
 void JIT_OPERATION operationInitGlobalConst(ExecState* exec, Instruction* pc)

diff --git a/Source/JavaScriptCore/jit/JITWriteBarrier.h b/Source/JavaScriptCore/jit/JITWriteBarrier.h
@@ -77,9 +77,9 @@ class JITWriteBarrierBase {
     {
     }
 
-    void set(VM& vm, CodeLocationDataLabelPtr location, JSCell* owner, JSCell* value)
+    void set(VM&, CodeLocationDataLabelPtr location, JSCell* owner, JSCell* value)
     {
-        vm.heap.writeBarrier(owner, value);
+        Heap::writeBarrier(owner, value);
         m_location = location;
         ASSERT(((!!m_location) && m_location.executableAddress() != JITWriteBarrierFlag) || (location.executableAddress() == m_location.executableAddress()));
         MacroAssembler::repatchPointer(m_location, value);

diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -1436,10 +1436,9 @@ extern "C" SlowPathReturnType llint_stack_check_at_vm_entry(VM* vm, Register* ne
 }
 #endif
 
-extern "C" void llint_write_barrier_slow(ExecState* exec, JSCell* cell)
+extern "C" void llint_write_barrier_slow(ExecState*, JSCell* cell)
 {
-    VM& vm = exec->vm();
-    vm.heap.writeBarrier(cell);
+    Heap::writeBarrier(cell);
 }
 
 } } // namespace JSC::LLInt

diff --git a/Source/JavaScriptCore/runtime/Arguments.h b/Source/JavaScriptCore/runtime/Arguments.h
@@ -31,7 +31,6 @@
 #include "JSGlobalObject.h"
 #include "Interpreter.h"
 #include "ObjectConstructor.h"
-#include "WriteBarrierInlines.h"
 #include <wtf/StdLibExtras.h>
 
 namespace JSC {

diff --git a/Source/JavaScriptCore/runtime/JSWeakMap.cpp b/Source/JavaScriptCore/runtime/JSWeakMap.cpp
@@ -29,7 +29,6 @@
 #include "JSCJSValueInlines.h"
 #include "SlotVisitorInlines.h"
 #include "WeakMapData.h"
-#include "WriteBarrierInlines.h"
 
 namespace JSC {
 

diff --git a/Source/JavaScriptCore/runtime/MapData.cpp b/Source/JavaScriptCore/runtime/MapData.cpp
@@ -208,7 +208,7 @@ CheckedBoolean MapData::ensureSpaceForAppend(CallFrame* callFrame)
         replaceAndPackBackingStore(newEntries, requiredSize);
     else
         replaceBackingStore(newEntries, requiredSize);
-    callFrame->heap()->writeBarrier(this);
+    Heap::writeBarrier(this);
     return true;
 }
 

diff --git a/Source/JavaScriptCore/runtime/PropertyTable.cpp b/Source/JavaScriptCore/runtime/PropertyTable.cpp
@@ -84,7 +84,7 @@ PropertyTable::PropertyTable(VM& vm, JSCell* owner, const PropertyTable& other)
     iterator end = this->end();
     for (iterator iter = begin(); iter != end; ++iter) {
         iter->key->ref();
-        vm.heap.writeBarrier(owner, iter->specificValue.get());
+        Heap::writeBarrier(owner, iter->specificValue.get());
     }
 
     // Copy the m_deletedOffsets vector.
@@ -109,7 +109,7 @@ PropertyTable::PropertyTable(VM& vm, JSCell* owner, unsigned initialCapacity, co
         ASSERT(canInsert());
         reinsert(*iter);
         iter->key->ref();
-        vm.heap.writeBarrier(owner, iter->specificValue.get());
+        Heap::writeBarrier(owner, iter->specificValue.get());
     }
 
     // Copy the m_deletedOffsets vector.

diff --git a/Source/JavaScriptCore/runtime/Structure.h b/Source/JavaScriptCore/runtime/Structure.h
@@ -42,7 +42,6 @@
 #include "JSTypeInfo.h"
 #include "Watchpoint.h"
 #include "Weak.h"
-#include "WriteBarrierInlines.h"
 #include <wtf/CompilationThread.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/PrintStream.h>

diff --git a/Source/JavaScriptCore/runtime/WriteBarrier.h b/Source/JavaScriptCore/runtime/WriteBarrier.h
@@ -71,7 +71,13 @@ template<class T> inline void validateCell(T)
 // We have a separate base class with no constructors for use in Unions.
 template <typename T> class WriteBarrierBase {
 public:
-    void set(VM&, const JSCell* owner, T* value);
+    void set(VM& vm, const JSCell* owner, T* value)
+    {
+        ASSERT(value);
+        ASSERT(!Options::enableConcurrentJIT() || !isCompilationThread());
+        validateCell(value);
+        setEarlyValue(vm, owner, value);
+    }
 
     // This is meant to be used like operator=, but is called copyFrom instead, in
     // order to kindly inform the C++ compiler that its advice is not appreciated.
@@ -80,11 +86,20 @@ template <typename T> class WriteBarrierBase {
         m_cell = other.m_cell;
     }
 
-    void setMayBeNull(VM&, const JSCell* owner, T* value);
+    void setMayBeNull(VM& vm, const JSCell* owner, T* value)
+    {
+        if (value)
+            validateCell(value);
+        setEarlyValue(vm, owner, value);
+    }
 
     // Should only be used by JSCell during early initialisation
     // when some basic types aren't yet completely instantiated
-    void setEarlyValue(VM&, const JSCell* owner, T* value);
+    void setEarlyValue(VM&, const JSCell* owner, T* value)
+    {
+        this->m_cell = reinterpret_cast<JSCell*>(value);
+        Heap::writeBarrier(owner, this->m_cell);
+    }
 
     T* get() const
     {
@@ -136,7 +151,13 @@ template <typename T> class WriteBarrierBase {
 
 template <> class WriteBarrierBase<Unknown> {
 public:
-    void set(VM&, const JSCell* owner, JSValue);
+    void set(VM&, const JSCell* owner, JSValue value)
+    {
+        ASSERT(!Options::enableConcurrentJIT() || !isCompilationThread());
+        m_value = JSValue::encode(value);
+        Heap::writeBarrier(owner, value);
+    }
+
     void setWithoutWriteBarrier(JSValue value)
     {
         m_value = JSValue::encode(value);

diff --git a/Source/JavaScriptCore/runtime/WriteBarrierInlines.h b/Source/JavaScriptCore/runtime/WriteBarrierInlines.h
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,16 @@
+2014-02-06  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r163542.
+        http://trac.webkit.org/changeset/163542
+        https://bugs.webkit.org/show_bug.cgi?id=128324
+
+        Caused many assertion failures (Requested by ap on #webkit).
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::jsFunction):
+
 2014-02-06  Frédéric Wang  <fred.wang@free.fr>
 
         Do not draw multi-characters <mi> in italic.

diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -47,7 +47,7 @@ JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isA
     , m_isolatedWorld(&isolatedWorld)
 {
     if (wrapper) {
-        JSC::Heap::heap(wrapper)->writeBarrier(wrapper, function);
+        JSC::Heap::writeBarrier(wrapper, function);
         m_jsFunction = JSC::Weak<JSC::JSObject>(function);
     } else
         ASSERT(!function);

diff --git a/Source/WebCore/bindings/js/JSEventListener.h b/Source/WebCore/bindings/js/JSEventListener.h
@@ -84,7 +84,7 @@ namespace WebCore {
 
         if (!m_jsFunction) {
             JSC::JSObject* function = initializeJSFunction(scriptExecutionContext);
-            JSC::Heap::heap(m_wrapper.get())->writeBarrier(m_wrapper.get(), function);
+            JSC::Heap::writeBarrier(m_wrapper.get(), function);
             m_jsFunction = JSC::Weak<JSC::JSObject>(function);
         }