I think, just putting RefPtr<WatchpointSet> in ArrayBuffer is enough.
By reordering ArrayBuffer's field, we can save 8bytes. We can put RefPtr<WatchpointSet> in this place.
This is the last patch, after that, all non-object non-butterfly JSCells are in IsoSubspace.
Created attachment 385655 [details] Patch
Created attachment 385658 [details] Patch
Created attachment 385661 [details] Patch
Created attachment 385663 [details] Patch
Created attachment 385665 [details] Patch
Created attachment 385666 [details] Patch
Created attachment 385675 [details] Patch
Created attachment 385678 [details] Patch
Comment on attachment 385678 [details] Patch r=me
Comment on attachment 385678 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=385678&action=review > Source/JavaScriptCore/runtime/ArrayBuffer.cpp:387 > + m_neuteringWatchpointSet.fireAll(vm, "Array buffer was neutered"); is it worth keeping this in notifyIncommingReferencesOfTransfer?
Comment on attachment 385678 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=385678&action=review >> Source/JavaScriptCore/runtime/ArrayBuffer.cpp:387 >> + m_neuteringWatchpointSet.fireAll(vm, "Array buffer was neutered"); > > is it worth keeping this in notifyIncommingReferencesOfTransfer? Renamed it to `notifyNeutering` and add this firing into `notifyNeutering` method :)
Committed r253576: <https://trac.webkit.org/changeset/253576>
<rdar://problem/57984773>