ChangeLog

2017-12-16  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Number of SlotVisitors can increase after setting up m_visitCounters

        https://bugs.webkit.org/show_bug.cgi?id=180906

        Reviewed by NOBODY (OOPS!).

        The number of SlotVisitors can increase after setting up m_visitCounters.

        If it happens, our m_visitCounters misses the visit count of newly added

        SlotVisitors. It accidentally decides that constraints are converged.

        This leads to random assertion hits in Linux environment.

        In this patch, we compare the number of SlotVisitors in didVisitSomething().

        If the number of SlotVisitors is changed, we conservatively say we did

        visit something.

        * heap/Heap.h:

        * heap/HeapInlines.h:

        (JSC::Heap::numberOfSlotVisitors):

        * heap/MarkingConstraintSet.h:

        * heap/MarkingConstraintSolver.cpp:

        (JSC::MarkingConstraintSolver::didVisitSomething const):

2017-12-15  Yusuke Suzuki  <utatane.tea@gmail.com>

        Unreviewed, 32bit JSEmpty is not nullptr + CellTag

Source/JavaScriptCore/heap/Heap.h

@@class Heap {

    template<typename Func>

    void forEachSlotVisitor(const Func&);

375 unsigned numberOfSlotVisitors();

private:

    friend class AllocatingScope;

Source/JavaScriptCore/heap/HeapInlines.h

@@void Heap::forEachSlotVisitor(const Func& func)

        func(*slotVisitor);

}

inline unsigned Heap::numberOfSlotVisitors()

{

    auto locker = holdLock(m_parallelSlotVisitorLock);

    return m_parallelSlotVisitors.size() + 2; // m_collectorSlotVisitor and m_mutatorSlotVisitor

}

272278} // namespace JSC

Source/JavaScriptCore/heap/MarkingConstraintSet.h

@@class MarkingConstraintSet {

    
    bool executeConvergenceImpl(SlotVisitor&);

70 bool drain(SlotVisitor&, BitVector& unexecuted, BitVector& executed, bool& didVisitSomething);

71

    Heap& m_heap;

    BitVector m_unexecutedRoots;

    BitVector m_unexecutedOutgrowths;

Source/JavaScriptCore/heap/MarkingConstraintSolver.cpp

@@bool MarkingConstraintSolver::didVisitSomething() const

        if (visitCounter.visitCount())

            return true;

    }

    // If the number of SlotVisitors increases after creating m_visitCounters,

    // we conservatively say there could be something visited by added SlotVisitors.

    if (m_heap.numberOfSlotVisitors() > m_visitCounters.size())

        return true;

    return false;

}