Unreviewed, revert "The extraMemorySize() get wrong when transferring ArrayBuffer from Worker VM"
https://bugs.webkit.org/show_bug.cgi?id=241826
rdar://95384643

This reverts commit 71960bed2a3ee0917367bc4144911a9e8168deea.

m_extraMemorySize must be monotonically increasing during GC cycles until
full-collection happens. And after the full-collection, it is adjusted.
We already adjusted it in sweep of m_arrayBuffer, so, we should not reduce
that number. This is used for GC invocation scheduling. So, if we would like to
have a number which more precisely reflecting the current status,
then we should have yet another one. And we can still use extraMemorySize
since it will be adjusted after the full-collection. So we can consider
that transferred array-buffer is collected at the full-collection.

Canonical link: https://commits.webkit.org/251708@main


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@295703 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/heap/GCIncomingRefCountedSet.h b/Source/JavaScriptCore/heap/GCIncomingRefCountedSet.h
index 869c19f..c73a897 100644
--- a/Source/JavaScriptCore/heap/GCIncomingRefCountedSet.h
+++ b/Source/JavaScriptCore/heap/GCIncomingRefCountedSet.h
@@ -44,7 +44,6 @@
     void sweep(VM&);
     
     size_t size() const { return m_bytes; };
-    void reduceSize(size_t);
     
 private:
     Vector<T*> m_vector;
diff --git a/Source/JavaScriptCore/heap/GCIncomingRefCountedSetInlines.h b/Source/JavaScriptCore/heap/GCIncomingRefCountedSetInlines.h
index dbf11b2..33ef4d0 100644
--- a/Source/JavaScriptCore/heap/GCIncomingRefCountedSetInlines.h
+++ b/Source/JavaScriptCore/heap/GCIncomingRefCountedSetInlines.h
@@ -72,23 +72,6 @@
         m_vector[i--] = m_vector.last();
         m_vector.removeLast();
     }
-
-    constexpr bool verify = false;
-    if constexpr (verify) {
-        CheckedSize size;
-        for (size_t i = m_vector.size(); i--;) {
-            T* object = m_vector[i];
-            size += object->gcSizeEstimateInBytes();
-        }
-        ASSERT(m_bytes == size);
-    }
-}
-
-template<typename T>
-void GCIncomingRefCountedSet<T>::reduceSize(size_t bytes)
-{
-    ASSERT(m_bytes >= bytes);
-    m_bytes -= bytes;
 }
 
 } // namespace JSC
diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
index 2ea3c35..63d1503 100644
--- a/Source/JavaScriptCore/heap/Heap.cpp
+++ b/Source/JavaScriptCore/heap/Heap.cpp
@@ -659,11 +659,6 @@
     }
 }
 
-void Heap::reduceArrayBufferSize(size_t bytes)
-{
-    m_arrayBuffers.reduceSize(bytes);
-}
-
 template<typename CellType, typename CellSet>
 void Heap::finalizeMarkedUnconditionalFinalizers(CellSet& cellSet)
 {
diff --git a/Source/JavaScriptCore/heap/Heap.h b/Source/JavaScriptCore/heap/Heap.h
index 0fa5c9c..418f24f 100644
--- a/Source/JavaScriptCore/heap/Heap.h
+++ b/Source/JavaScriptCore/heap/Heap.h
@@ -439,7 +439,6 @@
     const JITStubRoutineSet& jitStubRoutines() { return *m_jitStubRoutines; }
     
     void addReference(JSCell*, ArrayBuffer*);
-    void reduceArrayBufferSize(size_t bytes);
     
     bool isDeferred() const { return !!m_deferralDepth; }
 
diff --git a/Source/JavaScriptCore/runtime/ArrayBuffer.cpp b/Source/JavaScriptCore/runtime/ArrayBuffer.cpp
index 921dcfd..fa5fab3 100644
--- a/Source/JavaScriptCore/runtime/ArrayBuffer.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayBuffer.cpp
@@ -303,11 +303,8 @@
         return true;
     }
 
-    CheckedSize sizeReduced { gcSizeEstimateInBytes() };
     result = WTFMove(m_contents);
     notifyDetaching(vm);
-    sizeReduced -= gcSizeEstimateInBytes();
-    vm.heap.reduceArrayBufferSize(sizeReduced);
     return true;
 }