tree 5dd246ec0691ebaf24952de288a6929e142221ae
parent bac848d174a0ee081fddd5c3be9a2432f6a6dfe6
author justin_michaud@apple.com <justin_michaud@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1579293488 +0000
committer justin_michaud@apple.com <justin_michaud@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1579293488 +0000

Separate storage of Structure::m_offset into transition and max offset
https://bugs.webkit.org/show_bug.cgi?id=206365

Reviewed by Saam Barati.

Right now, deleteProperty/removePropertyTransition causes a structure transition to uncacheable dictionary. Other transitions
assume that the transition offset (m_offset) is monotonically increasing. In order to support structure transitions for deletion that
do not involve turning into a dictionary (<https://bugs.webkit.org/show_bug.cgi?id=206430>), we first need to separate the transition
offset (the offset of the property that was added/deleted) from the maximum offset.

For example, suppose we have the following operations:
  Structure 1 (pinned property table, transitionOffset = _, maxOffset = 2): x y z (delete y, assuming that deletion transitions have been added)
  Structure 2 (transitionOffset = 1, maxOffset = 2):                        x _ z (add w)
  Structure 3 (transitionOffset = 1, maxOffset = 2):                        x w z

Note that without splitting the two, Structures 2/3 would be impossible to represent.

This change:

We split the existing Structure::m_offset into two 16-bit fields, transitionOffset and maxOffset, and put them in 32-bit rare data fields if they overflow. We also rename _inPrevious fields to
transition_ and lastOffset to maxOffset to make the code more clear.

* runtime/ClonedArguments.cpp:
(JSC::ClonedArguments::createStructure):
* runtime/JSObject.cpp:
(JSC::JSObject::markAuxiliaryAndVisitOutOfLineProperties):
(JSC::JSObject::visitButterflyImpl):
* runtime/JSObject.h:
* runtime/JSObjectInlines.h:
(JSC::JSObject::prepareToPutDirectWithoutTransition):
* runtime/ObjectInitializationScope.cpp:
(JSC::ObjectInitializationScope::verifyPropertiesAreInitialized):
* runtime/PropertyOffset.h:
(JSC::numberOfOutOfLineSlotsForMaxOffset):
(JSC::numberOfSlotsForMaxOffset):
(JSC::numberOfOutOfLineSlotsForLastOffset): Deleted.
(JSC::numberOfSlotsForLastOffset): Deleted.
* runtime/Structure.cpp:
(JSC::StructureTransitionTable::contains const):
(JSC::StructureTransitionTable::get const):
(JSC::StructureTransitionTable::add):
(JSC::Structure::Structure):
(JSC::Structure::create):
(JSC::Structure::materializePropertyTable):
(JSC::Structure::addPropertyTransitionToExistingStructureImpl):
(JSC::Structure::addNewPropertyTransition):
(JSC::Structure::changePrototypeTransition):
(JSC::Structure::attributeChangeTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::nonPropertyTransitionSlow):
(JSC::Structure::flattenDictionaryStructure):
(JSC::Structure::pin):
(JSC::Structure::pinForCaching):
(JSC::Structure::add):
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::forEachPropertyConcurrently):
(JSC::Structure::checkOffsetConsistency const):
(JSC::Structure::add):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::StructureRareData):
* runtime/StructureRareData.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@254760 268f45cc-cd09-0410-ab3c-d52691b4dbfc