Bug 87599

Created attachment 144240 [details] Patch

Benchmark results from gc-dom-latency.html: TOT: ------ average pause: 182.59259259259258 max pause: 714 iterations / pause: 24008.283950617282 iterations / pause ms: 131.48553076402976 iterations / ms: 53.93773229045321 PATCH: ------ average pause: 73.04878048780488 [2.5X improvement] max pause: 218 [3.3X improvement] iterations / pause: 39871.19512195122 [1.7X improvement] iterations / pause ms: 545.8160267111853 [4.2X improvement] iterations / ms: 64.52923064777168 [1.2X improvement]

Committed r118646: <http://trac.webkit.org/changeset/118646>

Re-opened since this is blocked by 87691

This causes crashes when running the V8 raytrace benchmark within the V8v6 harness: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000048 JSC::Structure::classInfo (this=0x0) at Structure.h:186 186 const ClassInfo* classInfo() const { return m_classInfo; } (gdb) bt #0 JSC::Structure::classInfo (this=0x0) at Structure.h:186 #1 0x000000010007e2f8 in JSC::Structure::typeInfo (this=0x100fc3740) at Structure.h:121 #2 0x000000010039f636 in JSC::Structure::Structure (this=0x100fcf220, globalData=@0x101007c00, previous=0x100fc3740) at /Volumes/Data/pizlo/quartary/OpenSource/Source/JavaScriptCore/runtime/Structure.cpp:197 #3 0x000000010039f5d5 in JSC::Structure::Structure (this=0x100fcf220, globalData=@0x101007c00, previous=0x100fc3740) at /Volumes/Data/pizlo/quartary/OpenSource/Source/JavaScriptCore/runtime/Structure.cpp:215 #4 0x00000001003a2e17 in JSC::Structure::create (globalData=@0x101007c00, structure=0x100fc3740) at Structure.h:223 #5 0x00000001003a041b in JSC::Structure::addPropertyTransition (globalData=@0x101007c00, structure=0x100fc3740, propertyName={m_impl = 0x101818080, static NotAnIndex = 4294967295}, attributes=0, specificValue=0x0, offset=@0x7fff5fbfde90) at /Volumes/Data/pizlo/quartary/OpenSource/Source/JavaScriptCore/runtime/Structure.cpp:329 #6 0x0000000100080a74 in JSC::JSObject::putDirectInternal<(JSC::JSObject::PutMode)1> (this=0x102fb7d80, globalData=@0x101007c00, propertyName={m_impl = 0x101818080, static NotAnIndex = 4294967295}, value={u = {asInt64 = -281474976710556, ptr = 0xffff000000000064, asBits = {payload = 100, tag = -65536}}}, attributes=0, slot=@0x7fff5fbfe050, specificFunction=0x0) at JSObject.h:744 #7 0x000000010017faa9 in JSC::JSObject::putDirect (this=0x102fb7d80, globalData=@0x101007c00, propertyName={m_impl = 0x101818080, static NotAnIndex = 4294967295}, value={u = {asInt64 = -281474976710556, ptr = 0xffff000000000064, asBits = {payload = 100, tag = -65536}}}, slot=@0x7fff5fbfe050) at JSObject.h:775 #8 0x000000010024ae9c in cti_op_put_by_id_direct (args=0x7fff5fbfe0b0) at /Volumes/Data/pizlo/quartary/OpenSource/Source/JavaScriptCore/jit/JITStubs.cpp:1445 #9 0x00000001002557f0 in JSC::JITThunks::clearHostFunctionStubs () at /Volumes/Data/pizlo/quartary/OpenSource/Source/JavaScriptCore/jit/JITStubs.cpp:3491 #10 0x000000010021d5a9 in JSC::JITCode::execute (this=0x100fcb6d8, registerFile=0x1018081d8, callFrame=0x104000038, globalData=0x101007c00) at JITCode.h:127 #11 0x00000001002192ab in JSC::Interpreter::execute (this=0x1018081c0, program=0x100fcb6c0, callFrame=0x100fdfb00, scopeChain=0x100feffc0, thisObj=0x100fdfa80) at /Volumes/Data/pizlo/quartary/OpenSource/Source/JavaScriptCore/interpreter/Interpreter.cpp:1232 #12 0x000000010010b442 in JSC::evaluate (exec=0x100fdfb00, scopeChain=0x100feffc0, source=@0x7fff5fbff8c0, thisValue={u = {asInt64 = 4311612032, ptr = 0x100fdfa80, asBits = {payload = 16644736, tag = 1}}}, returnedException=0x7fff5fbff8e0) at /Volumes/Data/pizlo/quartary/OpenSource/Source/JavaScriptCore/runtime/Completion.cpp:73 #13 0x0000000100008480 in runWithScripts (globalObject=0x100fdfa80, scripts=@0x7fff5fbff9a8, dump=false) at jsc.cpp:528 #14 0x0000000100007f4b in jscmain (argc=2, argv=0x7fff5fbffa50) at jsc.cpp:678 #15 0x0000000100007e5e in main (argc=2, argv=0x7fff5fbffa50) at jsc.cpp:493

Back in: <http://trac.webkit.org/changeset/118868>

Re-opened since this is blocked by 87828

Created attachment 145466 [details] Patch

Comment on attachment 145466 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=145466&action=review > Source/JavaScriptCore/ChangeLog:8 > + This time for sure! We will see.

Committed r119364: <http://trac.webkit.org/changeset/119364>

Rolled out again in <http://trac.webkit.org/changeset/119453> because it caused crashes when running v8-earley stand-alone in DRT in run-jsc-benchmarks.

Rolled back in Part1: <http://trac.webkit.org/changeset/119878>.

Rolled back in Part2: <http://trac.webkit.org/changeset/119909>.