Bug 114987 - fourthTier: Create an equivalent of Structure::get() that can work from a compilation thread
Summary: fourthTier: Create an equivalent of Structure::get() that can work from a com...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Filip Pizlo
URL:
Keywords:
Depends on:
Blocks: 112839
  Show dependency treegraph
 
Reported: 2013-04-22 13:03 PDT by Filip Pizlo
Modified: 2013-04-22 17:15 PDT (History)
7 users (show)

See Also:


Attachments
the patch (20.42 KB, patch)
2013-04-22 13:10 PDT, Filip Pizlo
ggaren: review-
Details | Formatted Diff | Diff
the patch (20.50 KB, patch)
2013-04-22 13:54 PDT, Filip Pizlo
no flags Details | Formatted Diff | Diff
the patch (20.41 KB, patch)
2013-04-22 15:03 PDT, Filip Pizlo
msaboff: review-
Details | Formatted Diff | Diff
the patch (18.79 KB, patch)
2013-04-22 15:34 PDT, Filip Pizlo
ggaren: review+
Details | Formatted Diff | Diff
patch for landing (17.80 KB, patch)
2013-04-22 16:21 PDT, Filip Pizlo
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2013-04-22 13:03:03 PDT
r148570 sort of did most of this, but we need to finish it.  Patch forthcoming.
Comment 1 Filip Pizlo 2013-04-22 13:10:39 PDT
Created attachment 199095 [details]
the patch
Comment 2 Oliver Hunt 2013-04-22 13:19:24 PDT
Comment on attachment 199095 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=199095&action=review

> Source/JavaScriptCore/ChangeLog:73
> +2013-04-22  Filip Pizlo  <fpizlo@apple.com>
> +
> +        * bytecode/GetByIdStatus.cpp:
> +        (JSC::GetByIdStatus::computeFromLLInt):
> +        (JSC::GetByIdStatus::computeForChain):
> +        (JSC::GetByIdStatus::computeFor):
> +        * bytecode/PutByIdStatus.cpp:
> +        (JSC::PutByIdStatus::computeFromLLInt):
> +        (JSC::PutByIdStatus::computeFor):
> +        * runtime/PropertyMapHashTable.h:
> +        (PropertyTable):
> +        (JSC::PropertyTable::findConcurrently):
> +        (JSC):
> +        (JSC::PropertyTable::add):
> +        (JSC::PropertyTable::remove):
> +        (JSC::PropertyTable::reinsert):
> +        (JSC::PropertyTable::rehash):
> +        * runtime/PropertyTable.cpp:
> +        (JSC::PropertyTable::PropertyTable):
> +        * runtime/Structure.cpp:
> +        (JSC::Structure::findStructuresAndMapForMaterialization):
> +        (JSC::Structure::getConcurrently):
> +        * runtime/Structure.h:

Duplicate changelog

> Source/JavaScriptCore/runtime/PropertyMapHashTable.h:366
> +    Locker locker(m_lock);

So add() locks, what about delete?  Do we need that to lock?

> Source/WTF/wtf/Locker.h:43
> +    Locker(AssumeLockedTag)
> +        : m_lockable(0)
> +    {
> +    }

I wonder if there's someway we could add an assertion to make sure this is the case
Comment 3 Geoffrey Garen 2013-04-22 13:20:10 PDT
Comment on attachment 199095 [details]
the patch

As discussed in person, there is a race here between the compiler doing a lookup and the mutator stealing a property table from one structure and giving it to another.
Comment 4 Filip Pizlo 2013-04-22 13:32:40 PDT
(In reply to comment #2)
> (From update of attachment 199095 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=199095&action=review
> 
> > Source/JavaScriptCore/ChangeLog:73
> > +2013-04-22  Filip Pizlo  <fpizlo@apple.com>
> > +
> > +        * bytecode/GetByIdStatus.cpp:
> > +        (JSC::GetByIdStatus::computeFromLLInt):
> > +        (JSC::GetByIdStatus::computeForChain):
> > +        (JSC::GetByIdStatus::computeFor):
> > +        * bytecode/PutByIdStatus.cpp:
> > +        (JSC::PutByIdStatus::computeFromLLInt):
> > +        (JSC::PutByIdStatus::computeFor):
> > +        * runtime/PropertyMapHashTable.h:
> > +        (PropertyTable):
> > +        (JSC::PropertyTable::findConcurrently):
> > +        (JSC):
> > +        (JSC::PropertyTable::add):
> > +        (JSC::PropertyTable::remove):
> > +        (JSC::PropertyTable::reinsert):
> > +        (JSC::PropertyTable::rehash):
> > +        * runtime/PropertyTable.cpp:
> > +        (JSC::PropertyTable::PropertyTable):
> > +        * runtime/Structure.cpp:
> > +        (JSC::Structure::findStructuresAndMapForMaterialization):
> > +        (JSC::Structure::getConcurrently):
> > +        * runtime/Structure.h:
> 
> Duplicate changelog
> 
> > Source/JavaScriptCore/runtime/PropertyMapHashTable.h:366
> > +    Locker locker(m_lock);
> 
> So add() locks, what about delete?  Do we need that to lock?
> 
> > Source/WTF/wtf/Locker.h:43
> > +    Locker(AssumeLockedTag)
> > +        : m_lockable(0)
> > +    {
> > +    }
> 
> I wonder if there's someway we could add an assertion to make sure this is the case

I don't think there is.  The point is that you would use this in constructors, for example: you just allocated an object and you want to tell it "no, I didn't grab a lock, and yes, that is correct" because you know that since you just allocated it, it could not have escaped.
Comment 5 Filip Pizlo 2013-04-22 13:54:09 PDT
Created attachment 199102 [details]
the patch

Not yet ready for review because I want to rerun perf tests and such.
Comment 6 Filip Pizlo 2013-04-22 15:03:50 PDT
Created attachment 199113 [details]
the patch
Comment 7 Michael Saboff 2013-04-22 15:26:40 PDT
Comment on attachment 199113 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=199113&action=review

> Source/JavaScriptCore/runtime/Structure.cpp:274
> +        createPropertyMap(AssumeLocked, vm, numberOfSlotsForLastOffset(m_offset, m_inlineCapacity));

You need to have a lock here through the end of the function in the create case.
Comment 8 Filip Pizlo 2013-04-22 15:28:48 PDT
(In reply to comment #7)
> (From update of attachment 199113 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=199113&action=review
> 
> > Source/JavaScriptCore/runtime/Structure.cpp:274
> > +        createPropertyMap(AssumeLocked, vm, numberOfSlotsForLastOffset(m_offset, m_inlineCapacity));
> 
> You need to have a lock here through the end of the function in the create case.

Threads, man.  How do they work?
Comment 9 Filip Pizlo 2013-04-22 15:34:20 PDT
Created attachment 199118 [details]
the patch
Comment 10 Geoffrey Garen 2013-04-22 16:18:30 PDT
Comment on attachment 199118 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=199118&action=review

If we use findStructuresAndMapForMaterialization in more places, let's add a helper object that unlocks automatically for you when it goes out of scope.

> Source/JavaScriptCore/ChangeLog:45
> +2013-04-22  Filip Pizlo  <fpizlo@apple.com>

M-x Delete.
Comment 11 Filip Pizlo 2013-04-22 16:21:22 PDT
Created attachment 199127 [details]
patch for landing

Deleted the part of the ChangeLog that needed deleting.  Still running LayoutTests.
Comment 12 Filip Pizlo 2013-04-22 17:15:51 PDT
Landed in http://trac.webkit.org/changeset/148936