Do not fire timers for finalizing objects.

Source/platform/heap/Heap.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 525 matching lines @@
 {
     HeapObjectHeader* header = heapObjectHeader();
     if (header->isMarked())
         header->unmark();
     else
         header->markDead();
 }
 
 void LargeObject::removeFromHeap(ThreadHeap* heap)
 {
+    m_sweepStatus = 0;
     heap->freeLargeObject(this);
 }
 
 ThreadHeap::ThreadHeap(ThreadState* state, int index)
     : m_currentAllocationPoint(nullptr)
     , m_remainingAllocationSize(0)
     , m_lastRemainingAllocationSize(0)
     , m_firstPage(nullptr)
     , m_firstLargeObject(nullptr)
     , m_firstUnsweptPage(nullptr)
@@ skipping 184 matching lines @@
         HeapPage* page = m_firstUnsweptPage;
         if (page->isEmpty()) {
             page->unlink(&m_firstUnsweptPage);
             page->removeFromHeap(this);
         } else {
             // Sweep a page and move the page from m_firstUnsweptPages to
             // m_firstPages.
             page->sweep(this);
             page->unlink(&m_firstUnsweptPage);
             page->link(&m_firstPage);
+            page->markAsLazilySwept();
 
             result = allocateFromFreeList(allocationSize, gcInfoIndex);
-            if (result) {
+            if (result)
                 break;
-            }
         }
     }
 
     if (threadState()->isMainThread())
         ScriptForbiddenScope::exit();
     return result;
 }
 
 bool ThreadHeap::lazySweepLargeObjects(size_t allocationSize)
 {
@@ skipping 32 matching lines @@
             if (sweptSize >= allocationSize) {
                 result = true;
                 break;
             }
         } else {
             // Sweep a large object and move the large object from
             // m_firstUnsweptLargeObjects to m_firstLargeObjects.
             largeObject->sweep(this);
             largeObject->unlink(&m_firstUnsweptLargeObject);
             largeObject->link(&m_firstLargeObject);
+            largeObject->markAsLazilySwept();
         }
     }
 
     if (threadState()->isMainThread())
         ScriptForbiddenScope::exit();
     return result;
 }
 
 void ThreadHeap::completeSweep()
 {
     RELEASE_ASSERT(threadState()->isSweepingInProgress());
     ASSERT(threadState()->sweepForbidden());
 
     if (threadState()->isMainThread())
         ScriptForbiddenScope::enter();
 
     // Sweep normal pages.
     while (m_firstUnsweptPage) {
         HeapPage* page = m_firstUnsweptPage;
         if (page->isEmpty()) {
             page->unlink(&m_firstUnsweptPage);
             page->removeFromHeap(this);
         } else {
             // Sweep a page and move the page from m_firstUnsweptPages to
             // m_firstPages.
             page->sweep(this);
             page->unlink(&m_firstUnsweptPage);
             page->link(&m_firstPage);
+            page->markAsLazilySwept();
         }
     }
 
     // Sweep large objects.
     while (m_firstUnsweptLargeObject) {
         LargeObject* largeObject = m_firstUnsweptLargeObject;
         if (largeObject->isEmpty()) {
             largeObject->unlink(&m_firstUnsweptLargeObject);
             largeObject->removeFromHeap(this);
         } else {
             // Sweep a large object and move the large object from
             // m_firstUnsweptLargeObjects to m_firstLargeObjects.
             largeObject->sweep(this);
             largeObject->unlink(&m_firstUnsweptLargeObject);
             largeObject->link(&m_firstLargeObject);
+            largeObject->markAsLazilySwept();
         }
     }
 
     if (threadState()->isMainThread())
         ScriptForbiddenScope::exit();
 }
 
 #if ENABLE(ASSERT)
 static bool isLargeObjectAligned(LargeObject* largeObject, Address address)
 {
@@ skipping 371 matching lines @@
 }
 
 BaseHeapPage::BaseHeapPage(PageMemory* storage, ThreadState* state)
     : m_storage(storage)
     , m_threadState(state)
     , m_terminating(false)
 {
     ASSERT(isPageHeaderAddress(reinterpret_cast<Address>(this)));
 }
 
+void BaseHeapPage::markAsLazilySwept()
+{
+    // To signal completion of a lazy sweep, update the
+    // page's sweep status to match that of the ThreadState's
+    // flip-flop sweep token.
+    bool currentToken = threadState()->lazySweepToken();
+    m_sweepStatus = currentToken ? 2 : 1;
+}
+
+bool BaseHeapPage::hasBeenLazilySwept() const
+{
+    // Returns true if this page has been swept
+    // by the ongoing lazy sweep operation.
+    ASSERT(threadState()->isSweepingInProgress());
+    ASSERT(m_sweepStatus <= 2);
+    if (!m_sweepStatus)
+        return false;
+
+    bool currentToken = threadState()->lazySweepToken();
+    return currentToken == (m_sweepStatus == 2);
+}
+
 void BaseHeapPage::markOrphaned()
 {
     m_threadState = nullptr;
     m_terminating = false;
     // Since we zap the page payload for orphaned pages we need to mark it as
     // unused so a conservative pointer won't interpret the object headers.
     storage()->markUnused();
 }
 
 OrphanedPagePool::~OrphanedPagePool()
@@ skipping 360 matching lines @@
         if (header->isMarked())
             header->unmark();
         else
             header->markDead();
         headerAddress += header->size();
     }
 }
 
 void HeapPage::removeFromHeap(ThreadHeap* heap)
 {
+    m_sweepStatus = 0;
     heap->freePage(this);
 }
 
 void HeapPage::populateObjectStartBitMap()
 {
     memset(&m_objectStartBitMap, 0, objectStartBitMapSize);
     Address start = payload();
     for (Address headerAddress = start; headerAddress < payloadEnd();) {
         HeapObjectHeader* header = reinterpret_cast<HeapObjectHeader*>(headerAddress);
         size_t objectOffset = headerAddress - start;
@@ skipping 488 matching lines @@
 
 #if !ENABLE(ASSERT)
     s_heapDoesNotContainCache->addEntry(address);
 #else
     if (!s_heapDoesNotContainCache->lookup(address))
         s_heapDoesNotContainCache->addEntry(address);
 #endif
     return nullptr;
 }
 
+bool Heap::isFinalizedObjectAlive(const void* objectPointer)

[haraken, 2015/01/16 00:57:10]

I like having this method in our heap infrastructure -- it would be useful to
catch various errors. For example, we can add
ASSERT(!isFinalizedObjectAlive(m_raw)) to Member::operator-> to detect code that
is accessing on-heap objects in destructors etc.

+{
+#if ENABLE(OILPAN)
+    if (!ThreadState::current()->isSweepingInProgress())
+        return true;
+
+    BaseHeapPage* page = pageFromObject(objectPointer);
+    if (page->hasBeenLazilySwept())
+        return true;
+
+    return s_markingVisitor->isMarked(objectPointer);
+#else
+    // FIXME: remove when incremental sweeping is always on
+    // (cf. ThreadState::postGCProcessing()).
+    return true;
+#endif
+}
+
 #if ENABLE(GC_PROFILE_MARKING)
 const GCInfo* Heap::findGCInfo(Address address)
 {
     return ThreadState::findGCInfoFromAllThreads(address);
 }
 #endif
 
 #if ENABLE(GC_PROFILE_MARKING)
 void Heap::dumpPathToObjectOnNextGC(void* p)
 {
@@ skipping 548 matching lines @@
 bool Heap::s_shutdownCalled = false;
 bool Heap::s_lastGCWasConservative = false;
 FreePagePool* Heap::s_freePagePool;
 OrphanedPagePool* Heap::s_orphanedPagePool;
 Heap::RegionTree* Heap::s_regionTree = nullptr;
 size_t Heap::s_allocatedObjectSize = 0;
 size_t Heap::s_allocatedSpace = 0;
 size_t Heap::s_markedObjectSize = 0;
 
 } // namespace blink