<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[207263] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/207263">207263</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2016-10-12 16:56:34 -0700 (Wed, 12 Oct 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>The blackening of CellState is a bad way of tracking if the object is being marked for the first time
https://bugs.webkit.org/show_bug.cgi?id=163343
Reviewed by Mark Lam.
When I first added the concept of NewGrey/OldGrey, I had the SlotVisitor store the old cell
state in itself, so that it could use it to decide what to do for reportExtraMemoryVisited().
Then I changed it in a recent commit, because I wanted the freedom to have SlotVisitor visit
multiple objects in tandem. But I never ended up using this capability. Still, I liked the
new way better: instead of the SlotVisitor rembemering the state-before-blackening, we would
make the object's state reflect whether it was black for the first time or not. That seemed
convenient.
Unfortunately it's wrong. After we blacken the object, a concurrent barrier could instantly
grey it. Then we would forget that we are visiting this object for the first time.
Subsequent visits will think that they are not the first. So, we will fail to do the right
thing in reportExtraMemoryVisited().
So, this reverts that change. This is a little more than just a revert, though. I've changed
the terminology a bit. For example, I got tired of reading Black and having to remind myself
that it really means that the object has begun being visited, instead of the more strict
meaning that implies that it has already been visited. We want to say that it's Black or
currently being scanned. I'm going to adopt Siebert's term for this: Anthracite [1]. So, our
black CellState is now called AnthraciteOrBlack.
[1] https://pdfs.semanticscholar.org/7ae4/633265aead1f8835cf7966e179d02c2c8a4b.pdf
* heap/CellState.h:
(JSC::isBlack): Deleted.
(JSC::blacken): Deleted.
* heap/Heap.cpp:
(JSC::Heap::addToRememberedSet):
(JSC::Heap::writeBarrierSlowPath):
* heap/Heap.h:
* heap/HeapInlines.h:
(JSC::Heap::reportExtraMemoryVisited):
(JSC::Heap::reportExternalMemoryVisited):
* heap/SlotVisitor.cpp:
(JSC::SlotVisitor::appendToMarkStack):
(JSC::SlotVisitor::visitChildren):
* heap/SlotVisitor.h:
* heap/SlotVisitorInlines.h:
(JSC::SlotVisitor::reportExtraMemoryVisited):
(JSC::SlotVisitor::reportExternalMemoryVisited):
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LowLevelInterpreter.asm:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapCellStateh">trunk/Source/JavaScriptCore/heap/CellState.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeaph">trunk/Source/JavaScriptCore/heap/Heap.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapInlinesh">trunk/Source/JavaScriptCore/heap/HeapInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapSlotVisitorcpp">trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapSlotVisitorh">trunk/Source/JavaScriptCore/heap/SlotVisitor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapSlotVisitorInlinesh">trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntDatacpp">trunk/Source/JavaScriptCore/llint/LLIntData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -1,3 +1,54 @@
</span><ins>+2016-10-12 Filip Pizlo <fpizlo@apple.com>
+
+ The blackening of CellState is a bad way of tracking if the object is being marked for the first time
+ https://bugs.webkit.org/show_bug.cgi?id=163343
+
+ Reviewed by Mark Lam.
+
+ When I first added the concept of NewGrey/OldGrey, I had the SlotVisitor store the old cell
+ state in itself, so that it could use it to decide what to do for reportExtraMemoryVisited().
+
+ Then I changed it in a recent commit, because I wanted the freedom to have SlotVisitor visit
+ multiple objects in tandem. But I never ended up using this capability. Still, I liked the
+ new way better: instead of the SlotVisitor rembemering the state-before-blackening, we would
+ make the object's state reflect whether it was black for the first time or not. That seemed
+ convenient.
+
+ Unfortunately it's wrong. After we blacken the object, a concurrent barrier could instantly
+ grey it. Then we would forget that we are visiting this object for the first time.
+ Subsequent visits will think that they are not the first. So, we will fail to do the right
+ thing in reportExtraMemoryVisited().
+
+ So, this reverts that change. This is a little more than just a revert, though. I've changed
+ the terminology a bit. For example, I got tired of reading Black and having to remind myself
+ that it really means that the object has begun being visited, instead of the more strict
+ meaning that implies that it has already been visited. We want to say that it's Black or
+ currently being scanned. I'm going to adopt Siebert's term for this: Anthracite [1]. So, our
+ black CellState is now called AnthraciteOrBlack.
+
+ [1] https://pdfs.semanticscholar.org/7ae4/633265aead1f8835cf7966e179d02c2c8a4b.pdf
+
+ * heap/CellState.h:
+ (JSC::isBlack): Deleted.
+ (JSC::blacken): Deleted.
+ * heap/Heap.cpp:
+ (JSC::Heap::addToRememberedSet):
+ (JSC::Heap::writeBarrierSlowPath):
+ * heap/Heap.h:
+ * heap/HeapInlines.h:
+ (JSC::Heap::reportExtraMemoryVisited):
+ (JSC::Heap::reportExternalMemoryVisited):
+ * heap/SlotVisitor.cpp:
+ (JSC::SlotVisitor::appendToMarkStack):
+ (JSC::SlotVisitor::visitChildren):
+ * heap/SlotVisitor.h:
+ * heap/SlotVisitorInlines.h:
+ (JSC::SlotVisitor::reportExtraMemoryVisited):
+ (JSC::SlotVisitor::reportExternalMemoryVisited):
+ * llint/LLIntData.cpp:
+ (JSC::LLInt::Data::performAssertions):
+ * llint/LowLevelInterpreter.asm:
+
</ins><span class="cx"> 2016-10-12 Mark Lam <mark.lam@apple.com>
</span><span class="cx">
</span><span class="cx"> Rename variables in arrayProtoFuncSplice() to match names in the spec.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapCellStateh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CellState.h (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/CellState.h 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/heap/CellState.h 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -30,28 +30,27 @@
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><span class="cx"> enum class CellState : uint8_t {
</span><del>- // The object is black for the first time during this GC.
- NewBlack = 0,
</del><ins>+ // The object is either currently being scanned (anthracite) or it has finished being scanned
+ // (black). It could be scanned for the first time this GC, or the Nth time - if it's anthracite
+ // then the SlotVisitor knows. We explicitly say "anthracite or black" to emphasize the fact that
+ // this is no guarantee that we have finished scanning the object, unless you also know that all
+ // SlotVisitors are done.
+ AnthraciteOrBlack = 0,
</ins><span class="cx">
</span><del>- // The object is black for the Nth time during this full GC cycle (N > 1). An object may get to
- // this state if it transitions from black back to grey during a concurrent GC, or because it
- // wound up in the remembered set because of a generational barrier.
- OldBlack = 1,
-
</del><span class="cx"> // The object is in eden. During GC, this means that the object has not been marked yet.
</span><del>- NewWhite = 2,
</del><ins>+ NewWhite = 1,
</ins><span class="cx">
</span><span class="cx"> // The object is grey - i.e. it will be scanned - and this is the first time in this GC that we are
</span><span class="cx"> // going to scan it. If this is an eden GC, this also means that the object is in eden.
</span><del>- NewGrey = 3,
</del><ins>+ NewGrey = 2,
</ins><span class="cx">
</span><span class="cx"> // The object is grey - i.e. it will be scanned - but it either belongs to old gen (if this is eden
</span><span class="cx"> // GC) or it is grey a second time in this current GC (because a concurrent store barrier requested
</span><span class="cx"> // re-greying).
</span><del>- OldGrey = 4
</del><ins>+ OldGrey = 3
</ins><span class="cx"> };
</span><span class="cx">
</span><del>-static const unsigned blackThreshold = 1; // x <= blackThreshold means x is black.
</del><ins>+static const unsigned blackThreshold = 0; // x <= blackThreshold means x is AnthraciteOrBlack.
</ins><span class="cx"> static const unsigned tautologicalThreshold = 100; // x <= tautologicalThreshold is always true.
</span><span class="cx">
</span><span class="cx"> inline bool isWithinThreshold(CellState cellState, unsigned threshold)
</span><span class="lines">@@ -59,17 +58,4 @@
</span><span class="cx"> return static_cast<unsigned>(cellState) <= threshold;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-inline bool isBlack(CellState cellState)
-{
- return isWithinThreshold(cellState, blackThreshold);
-}
-
-inline CellState blacken(CellState cellState)
-{
- if (cellState == CellState::NewGrey)
- return CellState::NewBlack;
- ASSERT(cellState == CellState::NewBlack || cellState == CellState::OldBlack || cellState == CellState::OldGrey);
- return CellState::OldBlack;
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/heap/Heap.cpp 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -916,7 +916,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(cell);
</span><span class="cx"> ASSERT(!Options::useConcurrentJIT() || !isCompilationThread());
</span><del>- ASSERT(isBlack(cell->cellState()));
</del><ins>+ ASSERT(cell->cellState() == CellState::AnthraciteOrBlack);
</ins><span class="cx"> // Indicate that this object is grey and that it's one of the following:
</span><span class="cx"> // - A re-greyed object during a concurrent collection.
</span><span class="cx"> // - An old remembered object.
</span><span class="lines">@@ -1552,7 +1552,7 @@
</span><span class="cx"> // In this case, the barrierThreshold is the tautological threshold, so from could still be
</span><span class="cx"> // not black. But we can't know for sure until we fire off a fence.
</span><span class="cx"> WTF::storeLoadFence();
</span><del>- if (!isBlack(from->cellState()))
</del><ins>+ if (from->cellState() != CellState::AnthraciteOrBlack)
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.h (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.h 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/heap/Heap.h 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -181,11 +181,11 @@
</span><span class="cx"> // call both of these functions: Calling only one may trigger catastropic
</span><span class="cx"> // memory growth.
</span><span class="cx"> void reportExtraMemoryAllocated(size_t);
</span><del>- void reportExtraMemoryVisited(JSCell*, size_t);
</del><ins>+ void reportExtraMemoryVisited(CellState oldState, size_t);
</ins><span class="cx">
</span><span class="cx"> #if ENABLE(RESOURCE_USAGE)
</span><span class="cx"> // Use this API to report the subset of extra memory that lives outside this process.
</span><del>- void reportExternalMemoryVisited(JSCell*, size_t);
</del><ins>+ void reportExternalMemoryVisited(CellState oldState, size_t);
</ins><span class="cx"> size_t externalMemorySize() { return m_externalMemorySize; }
</span><span class="cx"> #endif
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/HeapInlines.h (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/HeapInlines.h 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/heap/HeapInlines.h 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -158,10 +158,10 @@
</span><span class="cx"> reportExtraMemoryAllocatedSlowCase(size);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-inline void Heap::reportExtraMemoryVisited(JSCell* cell, size_t size)
</del><ins>+inline void Heap::reportExtraMemoryVisited(CellState oldState, size_t size)
</ins><span class="cx"> {
</span><span class="cx"> // We don't want to double-count the extra memory that was reported in previous collections.
</span><del>- if (operationInProgress() == EdenCollection && cell->cellState() == CellState::OldBlack)
</del><ins>+ if (operationInProgress() == EdenCollection && oldState == CellState::OldGrey)
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> size_t* counter = &m_extraMemorySize;
</span><span class="lines">@@ -174,10 +174,10 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if ENABLE(RESOURCE_USAGE)
</span><del>-inline void Heap::reportExternalMemoryVisited(JSCell* cell, size_t size)
</del><ins>+inline void Heap::reportExternalMemoryVisited(CellState oldState, size_t size)
</ins><span class="cx"> {
</span><span class="cx"> // We don't want to double-count the external memory that was reported in previous collections.
</span><del>- if (operationInProgress() == EdenCollection && cell->cellState() == CellState::OldBlack)
</del><ins>+ if (operationInProgress() == EdenCollection && oldState == CellState::OldGrey)
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> size_t* counter = &m_externalMemorySize;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapSlotVisitorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -228,6 +228,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(Heap::isMarkedConcurrently(cell));
</span><span class="cx"> ASSERT(!cell->isZapped());
</span><ins>+ ASSERT(cell->cellState() == CellState::NewGrey || cell->cellState() == CellState::OldGrey);
</ins><span class="cx">
</span><span class="cx"> container.noteMarked();
</span><span class="cx">
</span><span class="lines">@@ -293,8 +294,15 @@
</span><span class="cx">
</span><span class="cx"> SetCurrentCellScope currentCellScope(*this, cell);
</span><span class="cx">
</span><del>- cell->setCellState(blacken(cell->cellState()));
</del><ins>+ m_oldCellState = cell->cellState();
</ins><span class="cx">
</span><ins>+ // There is no race here - the cell state cannot change right now. Grey objects can only be
+ // visited by one marking thread. Neither the barrier nor marking will change the state of an
+ // object that is already grey.
+ ASSERT(m_oldCellState == CellState::OldGrey || m_oldCellState == CellState::NewGrey);
+
+ cell->setCellState(CellState::AnthraciteOrBlack);
+
</ins><span class="cx"> WTF::storeLoadFence();
</span><span class="cx">
</span><span class="cx"> switch (cell->type()) {
</span><span class="lines">@@ -318,7 +326,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (UNLIKELY(m_heapSnapshotBuilder)) {
</span><del>- if (cell->cellState() != CellState::OldBlack)
</del><ins>+ if (m_oldCellState == CellState::NewGrey)
</ins><span class="cx"> m_heapSnapshotBuilder->appendNode(const_cast<JSCell*>(cell));
</span><span class="cx"> }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapSlotVisitorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/SlotVisitor.h (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/SlotVisitor.h 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/heap/SlotVisitor.h 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -165,6 +165,7 @@
</span><span class="cx">
</span><span class="cx"> HeapSnapshotBuilder* m_heapSnapshotBuilder { nullptr };
</span><span class="cx"> JSCell* m_currentCell { nullptr };
</span><ins>+ CellState m_oldCellState;
</ins><span class="cx">
</span><span class="cx"> public:
</span><span class="cx"> #if !ASSERT_DISABLED
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapSlotVisitorInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -105,13 +105,13 @@
</span><span class="cx">
</span><span class="cx"> inline void SlotVisitor::reportExtraMemoryVisited(size_t size)
</span><span class="cx"> {
</span><del>- heap()->reportExtraMemoryVisited(m_currentCell, size);
</del><ins>+ heap()->reportExtraMemoryVisited(m_oldCellState, size);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if ENABLE(RESOURCE_USAGE)
</span><span class="cx"> inline void SlotVisitor::reportExternalMemoryVisited(size_t size)
</span><span class="cx"> {
</span><del>- heap()->reportExternalMemoryVisited(m_currentCell, size);
</del><ins>+ heap()->reportExternalMemoryVisited(m_oldCellState, size);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntData.cpp (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntData.cpp 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/llint/LLIntData.cpp 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -214,7 +214,7 @@
</span><span class="cx"> STATIC_ASSERT(GetPutInfo::initializationBits == 0xffc00);
</span><span class="cx">
</span><span class="cx"> STATIC_ASSERT(MarkedBlock::blockSize == 16 * 1024);
</span><del>- STATIC_ASSERT(blackThreshold == 1);
</del><ins>+ STATIC_ASSERT(blackThreshold == 0);
</ins><span class="cx">
</span><span class="cx"> ASSERT(bitwise_cast<uintptr_t>(ShadowChicken::Packet::tailMarker()) == static_cast<uintptr_t>(0x7a11));
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (207262 => 207263)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2016-10-12 23:17:52 UTC (rev 207262)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2016-10-12 23:56:34 UTC (rev 207263)
</span><span class="lines">@@ -409,7 +409,7 @@
</span><span class="cx"> const MarkedBlockSize = 16 * 1024
</span><span class="cx"> const MarkedBlockMask = ~(MarkedBlockSize - 1)
</span><span class="cx">
</span><del>-const BlackThreshold = 1
</del><ins>+const BlackThreshold = 0
</ins><span class="cx">
</span><span class="cx"> # Allocation constants
</span><span class="cx"> if JSVALUE64
</span></span></pre>
</div>
</div>
</body>
</html>