Oilpan: Replace the positive heap-contains cache with a binary search tree of memory regions.

Source/platform/heap/ThreadState.h

Index: Source/platform/heap/ThreadState.h
diff --git a/Source/platform/heap/ThreadState.h b/Source/platform/heap/ThreadState.h
index 2513756aae2b550b1871a7f1c07efebffb3c35b5..3690b2c5d63805e5cb5ae767625288e3e29befeb 100644
--- a/Source/platform/heap/ThreadState.h
+++ b/Source/platform/heap/ThreadState.h
@@ -52,7 +52,6 @@ class BaseHeap;
 class BaseHeapPage;
 class FinalizedHeapObjectHeader;
 struct GCInfo;
-class HeapContainsCache;
 class HeapObjectHeader;
 class PageMemory;
 class PersistentNode;
@@ -62,6 +61,7 @@ class SafePointBarrier;
 class SafePointAwareMutexLocker;
 template<typename Header> class ThreadHeap;
 class CallbackStack;
+class PageMemoryRegion;
 
 typedef uint8_t* Address;
 
@@ -548,7 +548,6 @@ public:
     // Infrastructure to determine if an address is within one of the
     // address ranges for the Blink heap. If the address is in the Blink
     // heap the containing heap page is returned.
-    HeapContainsCache* heapContainsCache() { return m_heapContainsCache.get(); }
     BaseHeapPage* contains(Address address) { return heapPageFromAddress(address); }
     BaseHeapPage* contains(void* pointer) { return contains(reinterpret_cast<Address>(pointer)); }
     BaseHeapPage* contains(const void* pointer) { return contains(const_cast<void*>(pointer)); }
@@ -579,10 +578,6 @@ public:
     // Visit all persistents allocated on this thread.
     void visitPersistents(Visitor*);
 
-    // Checks a given address and if a pointer into the oilpan heap marks
-    // the object to which it points.
-    bool checkAndMarkPointer(Visitor*, Address);
-
 #if ENABLE(GC_PROFILE_MARKING)
     const GCInfo* findGCInfo(Address);
     static const GCInfo* findGCInfoFromAllThreads(Address);
@@ -631,6 +626,8 @@ public:
 
     Mutex& sweepMutex() { return m_sweepMutex; }
 
+    Vector<PageMemoryRegion*>& allocatedRegionsSinceLastGC() { return m_allocatedRegionsSinceLastGC; }
+
 private:
     explicit ThreadState();
     ~ThreadState();
@@ -703,7 +700,6 @@ private:
     size_t m_noAllocationCount;
     bool m_inGC;
     BaseHeap* m_heaps[NumberOfHeaps];
-    OwnPtr<HeapContainsCache> m_heapContainsCache;
     HeapStats m_stats;
     HeapStats m_statsAfterLastGC;
 
@@ -722,6 +718,8 @@ private:
 #if defined(ADDRESS_SANITIZER)
     void* m_asanFakeStack;
 #endif
+
+    Vector<PageMemoryRegion*> m_allocatedRegionsSinceLastGC;

[haraken, 2014/10/02 02:31:35]

Just to confirm: This PageMemoryRegion* shouldn't become a dangling pointer
because PageMemoryRegions will never be destructed until the next GC happens
(and at the point where the next GC happens, m_allocatedRegionsSinceLastGC is
already cleared).

[zerny-chromium, 2014/10/02 07:48:42]

Exactly. Even for a worker thread that is destructed it will do a thread-local
gc which in its prepareForGC will move the regions to the global tree.

 };
 
 template<ThreadAffinity affinity> class ThreadStateFor;