Add logic to collect dirty objects as roots
https://bugs.webkit.org/show_bug.cgi?id=69100

Reviewed by Geoff Garen.

This gives us the ability to walk all the MarkedBlocks in an
AllocationSpace and collect the dirty objects, and then use
them as GC roots.

* dfg/DFGJITCodeGenerator.cpp:
(JSC::DFG::JITCodeGenerator::markCellCard):
* dfg/DFGJITCodeGenerator32_64.cpp:
(JSC::DFG::JITCodeGenerator::markCellCard):
* heap/AllocationSpace.cpp:
   Tidy up the write barrier logic a bit
(JSC::MarkedBlock::gatherDirtyObjects):
(JSC::TakeIfDirty::returnValue):
(JSC::TakeIfDirty::TakeIfDirty):
(JSC::TakeIfDirty::operator()):
(JSC::AllocationSpace::gatherDirtyObjects):
* heap/AllocationSpace.h:
* heap/CardSet.h:
(JSC::::isCardMarked):
(JSC::::clearCard):
* heap/Heap.cpp:
(JSC::Heap::markRoots):
* heap/Heap.h:
(JSC::Heap::writeBarrier):
* heap/MarkStack.cpp:
(JSC::SlotVisitor::visitChildren):
* heap/MarkedBlock.h:
(JSC::MarkedBlock::setDirtyObject):
(JSC::MarkedBlock::addressOfCardFor):
* heap/SlotVisitor.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitWriteBarrier):
   Tidy the write barrier a bit

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@96372 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index f0b3c09..37cf164 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -471,12 +471,27 @@
     m_jettisonedCodeBlocks.clearMarks();
     registerFile().gatherConservativeRoots(registerFileRoots, m_jettisonedCodeBlocks);
     m_jettisonedCodeBlocks.deleteUnmarkedCodeBlocks();
+#if ENABLE(GGC)
+    MarkedBlock::DirtyCellVector dirtyCells;
+    // Until we have a sensible policy we just random choose to perform
+    // young generation collections 90% of the time.
+    if (WTF::randomNumber() > 0.1)
+        m_objectSpace.gatherDirtyCells(dirtyCells);
+    else
+#endif
+        clearMarks();
 
-    clearMarks();
 
     SlotVisitor& visitor = m_slotVisitor;
     HeapRootVisitor heapRootVisitor(visitor);
-    
+
+#if ENABLE(GGC)
+    for (size_t i = 0; i < dirtyObjectCount; i++) {
+        heapRootVisitor.visitChildren(dirtyCells[i]);
+        visitor.drain();
+    }
+#endif
+
     visitor.append(machineThreadRoots);
     visitor.drain();