[Webkit-unassigned] [Bug 43641] New: Mark all JSCell*s visible from structures

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=43641

           Summary: Mark all JSCell*s visible from structures
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: nlawrence at apple.com
                CC: ggaren at apple.com, nlawrence at apple.com


Updating these is required for movable objects.  There are two types of pointers we are looking at:

(1) The specificValue properties in PropertyMapHashTable
(2) The structures's prototype

It is slightly more complicated than simply marking these properties on each object's structures since each structure is part of a tree.  We need to mark both the pointers linked to by m_previous as well as the structure transition table.

In order not to fully visit each structure graph more than once per garbage collection, I suggest adding an additional bit to the structure class that denotes an alternating color used to determine whether or not that structure has been visited on that particular collection.

The specificValue properties in PropertyMapHashTable can be replaced by WeakGCPtr's which avoids us needing to update those particular values, however there is still a few percent overhead in needing to visit the whole structure graph.  It may make sense to have a ref-counted indirect pointer to the prototype that is shared between all structures in the graph.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.