Disallow synchronous sweeping for eden GCs.

https://bugs.webkit.org/show_bug.cgi?id=160716

Reviewed by Geoffrey Garen.

JSTests:

* stress/eden-gc-with-retired-blocks.js: Added.
- This test is just in case we add back support for eden GCs with synchronous
  sweeping in the future.

Source/JavaScriptCore:

* heap/Heap.cpp:
(JSC::Heap::collectAllGarbage):
(JSC::Heap::collectAndSweep): Deleted.
* heap/Heap.h:
(JSC::Heap::collectAllGarbage): Deleted.
- No need for a separate collectAndSweep() anymore since we only call it for
  FullCollections.
- Since we've already swept all the blocks, I cleared m_blockSnapshot so that the
  IncrementalSweeper can bail earlier when it runs later.

* heap/MarkedBlock.cpp:
(JSC::MarkedBlock::sweepHelper):
- Removed the unreachable return statement.

* heap/MarkedBlock.h:
- Document what "Retired" means.

* tools/JSDollarVMPrototype.cpp:
(JSC::JSDollarVMPrototype::edenGC):



Canonical link: https://commits.webkit.org/178898@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@204387 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog

@@ -1,3 +1,14 @@
+2016-08-10  Mark Lam  <mark.lam@apple.com>
+
+        Disallow synchronous sweeping for eden GCs.
+        https://bugs.webkit.org/show_bug.cgi?id=160716
+
+        Reviewed by Geoffrey Garen.
+
+        * stress/eden-gc-with-retired-blocks.js: Added.
+        - This test is just in case we add back support for eden GCs with synchronous
+          sweeping in the future.
+
 2016-08-10  Michael Saboff  <msaboff@apple.com>
 
         Baseline GetByVal and PutByVal for cache ID stubs need to handle exceptions

JSTests/stress/eden-gc-with-retired-blocks.js

@@ -0,0 +1,24 @@
+//@ runDefault
+// This test should not crash.
+
+var objs;
+
+for (let i = 0; i < 500; i += 100) {
+    objs = [];
+    gc();
+
+    // Make "Retired" blocks.
+    for (let j = 0; j < i; j++) {
+        let o;
+        switch (i % 6) {
+        case 0: o = { };
+        case 1: o = { a: i };
+        case 2: o = { a: i, b: i};
+        case 3: o = { a: i, b: i, c: i };
+        case 4: o = { a: i, b: i, c: i, d: i };
+        case 5: o = { a: i, b: i, c: i, d: i, e: i };
+        }
+        objs[j] = o;
+    }
+    edenGC();
+}

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,30 @@
+2016-08-10  Mark Lam  <mark.lam@apple.com>
+
+        Disallow synchronous sweeping for eden GCs.
+        https://bugs.webkit.org/show_bug.cgi?id=160716
+
+        Reviewed by Geoffrey Garen.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::collectAllGarbage):
+        (JSC::Heap::collectAndSweep): Deleted.
+        * heap/Heap.h:
+        (JSC::Heap::collectAllGarbage): Deleted.
+        - No need for a separate collectAndSweep() anymore since we only call it for
+          FullCollections.
+        - Since we've already swept all the blocks, I cleared m_blockSnapshot so that the
+          IncrementalSweeper can bail earlier when it runs later.
+
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::sweepHelper):
+        - Removed the unreachable return statement.
+
+        * heap/MarkedBlock.h:
+        - Document what "Retired" means.
+
+        * tools/JSDollarVMPrototype.cpp:
+        (JSC::JSDollarVMPrototype::edenGC):
+
 2016-08-11  Per Arne Vollan  <pvollan@apple.com>
 
         [Win] Warning fix.

Source/JavaScriptCore/heap/Heap.cpp

@@ -1071,16 +1071,17 @@ void Heap::addToRememberedSet(const JSCell* cell)
     m_slotVisitor.appendToMarkStack(const_cast<JSCell*>(cell));
 }
 
-void Heap::collectAndSweep(HeapOperation collectionType)
+void Heap::collectAllGarbage()
 {
     if (!m_isSafeToCollect)
         return;
 
-    collect(collectionType);
+    collect(FullCollection);
 
     DeferGCForAWhile deferGC(*this);
     m_objectSpace.sweep();
     m_objectSpace.shrink();
+    m_blockSnapshot.clear();
 
     sweepAllLogicallyEmptyWeakBlocks();
 }

Source/JavaScriptCore/heap/Heap.h

@@ -165,8 +165,8 @@ class Heap {
     JS_EXPORT_PRIVATE bool isHeapSnapshotting() const;
 
     JS_EXPORT_PRIVATE void collectAllGarbageIfNotDoneRecently();
-    void collectAllGarbage() { collectAndSweep(FullCollection); }
-    JS_EXPORT_PRIVATE void collectAndSweep(HeapOperation collectionType = AnyCollection);
+    JS_EXPORT_PRIVATE void collectAllGarbage();
+
     bool shouldCollect();
     JS_EXPORT_PRIVATE void collect(HeapOperation collectionType = AnyCollection);
     bool collectIfNecessaryOrDefer(); // Returns true if it did collect.

Source/JavaScriptCore/heap/MarkedBlock.cpp

@@ -163,9 +163,6 @@ MarkedBlock::FreeList MarkedBlock::sweepHelper(SweepMode sweepMode)
             ? specializedSweep<Marked, SweepToFreeList, callDestructors>()
             : specializedSweep<Marked, SweepOnly, callDestructors>();
     }
-
-    RELEASE_ASSERT_NOT_REACHED();
-    return FreeList();
 }
 
 class SetNewlyAllocatedFunctor : public MarkedBlock::VoidFunctor {

Source/JavaScriptCore/heap/MarkedBlock.h

@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2016 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003-2009, 2011, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -183,6 +183,16 @@ namespace JSC {
     private:
         static const size_t atomAlignmentMask = atomSize - 1;
 
+        // During allocation, we look for available space in free lists in blocks.
+        // If a block's utilization is sufficiently high (i.e. it's almost full),
+        // we want to remove that block as a candidate for allocating to reduce
+        // the likelihood of allocation having to take a slow path. When the
+        // block is in this state, we say that it is "Retired".
+        //
+        // A full GC can take a Retired blocks out of retirement. An eden GC
+        // will simply ignore Retired blocks (i.e. they will not be swept even
+        // if they no longer have live objects).
+
         enum BlockState { New, FreeListed, Allocated, Marked, Retired };
         template<bool callDestructors> FreeList sweepHelper(SweepMode = SweepOnly);
 

Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp

@@ -129,7 +129,7 @@ void JSDollarVMPrototype::edenGC(ExecState* exec)
 {
     if (!ensureCurrentThreadOwnsJSLock(exec))
         return;
-    exec->heap()->collectAndSweep(EdenCollection);
+    exec->heap()->collect(EdenCollection);
 }
 
 static EncodedJSValue JSC_HOST_CALL functionEdenGC(ExecState* exec)