Separate the stack used for GC from the regular JS stack

This is required to be able to implement concurrent or
incremental garbage collection.

Change-Id: Ib3c5eee3779ca2ee08a57cd3961dbcb0537bbb54
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

25 files changed, 162 insertions, 130 deletions

diff --git a/src/qml/compiler/qv4compileddata.cpp b/src/qml/compiler/qv4compileddata.cpp
index c56f08c2f0..7940e5715e 100644
--- a/src/qml/compiler/qv4compileddata.cpp
+++ b/src/qml/compiler/qv4compileddata.cpp
@@ -249,14 +249,14 @@ void CompilationUnit::unlink()
 #endif
 }
 
-void CompilationUnit::markObjects(QV4::ExecutionEngine *e)
+void CompilationUnit::markObjects(QV4::MarkStack *markStack)
 {
     for (uint i = 0; i < data->stringTableSize; ++i)
         if (runtimeStrings[i])
-            runtimeStrings[i]->mark(e);
+            runtimeStrings[i]->mark(markStack);
     if (runtimeRegularExpressions) {
         for (uint i = 0; i < data->regexpTableSize; ++i)
-            runtimeRegularExpressions[i].mark(e);
+            runtimeRegularExpressions[i].mark(markStack);
     }
 }
 
diff --git a/src/qml/compiler/qv4compileddata_p.h b/src/qml/compiler/qv4compileddata_p.h
index 6e9121b5e3..f4ba257cf5 100644
--- a/src/qml/compiler/qv4compileddata_p.h
+++ b/src/qml/compiler/qv4compileddata_p.h
@@ -897,7 +897,7 @@ struct Q_QML_PRIVATE_EXPORT CompilationUnit : public CompilationUnitBase, public
     QV4::Function *linkToEngine(QV4::ExecutionEngine *engine);
     void unlink();
 
-    void markObjects(QV4::ExecutionEngine *e);
+    void markObjects(MarkStack *markStack);
 
     void destroy() Q_DECL_OVERRIDE;
 
diff --git a/src/qml/jsruntime/qv4engine.cpp b/src/qml/jsruntime/qv4engine.cpp
index b9408be218..dd8cb177b4 100644
--- a/src/qml/jsruntime/qv4engine.cpp
+++ b/src/qml/jsruntime/qv4engine.cpp
@@ -136,6 +136,7 @@ ExecutionEngine::ExecutionEngine(EvalISelFactory *factory)
     , currentContext(0)
     , bumperPointerAllocator(new WTF::BumpPointerAllocator)
     , jsStack(new WTF::PageAllocation)
+    , gcStack(new WTF::PageAllocation)
     , globalCode(0)
     , v8Engine(0)
     , argumentsAccessors(0)
@@ -188,18 +189,22 @@ ExecutionEngine::ExecutionEngine(EvalISelFactory *factory)
     iselFactory.reset(factory);
 
     // reserve space for the JS stack
-    // we allow it to grow to 2 times JSStackLimit, as we can overshoot due to garbage collection
-    // and ScopedValues allocated outside of JIT'ed methods.
-    *jsStack = WTF::PageAllocation::allocate(2 * JSStackLimit, WTF::OSAllocator::JSVMStackPages,
+    // we allow it to grow to a bit more than JSStackLimit, as we can overshoot due to ScopedValues
+    // allocated outside of JIT'ed methods.
+    *jsStack = WTF::PageAllocation::allocate(JSStackLimit + 256*1024, WTF::OSAllocator::JSVMStackPages,
                                              /* writable */ true, /* executable */ false,
                                              /* includesGuardPages */ true);
     jsStackBase = (Value *)jsStack->base();
 #ifdef V4_USE_VALGRIND
-    VALGRIND_MAKE_MEM_UNDEFINED(jsStackBase, 2*JSStackLimit);
+    VALGRIND_MAKE_MEM_UNDEFINED(jsStackBase, JSStackLimit + 256*1024);
 #endif
 
     jsStackTop = jsStackBase;
 
+    *gcStack = WTF::PageAllocation::allocate(GCStackLimit, WTF::OSAllocator::JSVMStackPages,
+                                             /* writable */ true, /* executable */ false,
+                                             /* includesGuardPages */ true);
+
     exceptionValue = jsAlloca(1);
     globalObject = static_cast<Object *>(jsAlloca(1));
     jsObjects = jsAlloca(NJSObjects);
@@ -493,6 +498,8 @@ ExecutionEngine::~ExecutionEngine()
     delete executableAllocator;
     jsStack->deallocate();
     delete jsStack;
+    gcStack->deallocate();
+    delete gcStack;
     delete [] argumentsAccessors;
 }
 
@@ -930,23 +937,23 @@ void ExecutionEngine::requireArgumentsAccessors(int n)
     }
 }
 
-void ExecutionEngine::markObjects()
+void ExecutionEngine::markObjects(MarkStack *markStack)
 {
-    identifierTable->mark(this);
+    identifierTable->mark(markStack);
 
     for (int i = 0; i < nArgumentsAccessors; ++i) {
         const Property &pd = argumentsAccessors[i];
         if (Heap::FunctionObject *getter = pd.getter())
-            getter->mark(this);
+            getter->mark(markStack);
         if (Heap::FunctionObject *setter = pd.setter())
-            setter->mark(this);
+            setter->mark(markStack);
     }
 
-    classPool->markObjects(this);
+    classPool->markObjects(markStack);
 
     for (QSet<CompiledData::CompilationUnit*>::ConstIterator it = compilationUnits.constBegin(), end = compilationUnits.constEnd();
          it != end; ++it)
-        (*it)->markObjects(this);
+        (*it)->markObjects(markStack);
 }
 
 ReturnedValue ExecutionEngine::throwError(const Value &value)
diff --git a/src/qml/jsruntime/qv4engine_p.h b/src/qml/jsruntime/qv4engine_p.h
index fdfdeada9a..bace8b700b 100644
--- a/src/qml/jsruntime/qv4engine_p.h
+++ b/src/qml/jsruntime/qv4engine_p.h
@@ -108,18 +108,14 @@ public:
 
     WTF::BumpPointerAllocator *bumperPointerAllocator; // Used by Yarr Regex engine.
 
-    enum { JSStackLimit = 4*1024*1024 };
+    enum {
+        JSStackLimit = 4*1024*1024,
+        GCStackLimit = 2*1024*1024
+    };
     WTF::PageAllocation *jsStack;
     Value *jsStackBase;
 
-    void pushForGC(Heap::Base *m) {
-        *jsStackTop = m;
-        ++jsStackTop;
-    }
-    Heap::Base *popForGC() {
-        --jsStackTop;
-        return jsStackTop->m();
-    }
+    WTF::PageAllocation *gcStack;
 
     QML_NEARLY_ALWAYS_INLINE Value *jsAlloca(int nValues) {
         Value *ptr = jsStackTop;
@@ -446,7 +442,7 @@ public:
 
     void requireArgumentsAccessors(int n);
 
-    void markObjects();
+    void markObjects(MarkStack *markStack);
 
     void initRootContext();
 
@@ -541,7 +537,7 @@ inline ExecutionContext *ExecutionEngine::parentContext(ExecutionContext *contex
 }
 
 inline
-void Heap::Base::mark(QV4::ExecutionEngine *engine)
+void Heap::Base::mark(QV4::MarkStack *markStack)
 {
     Q_ASSERT(inUse());
     const HeapItem *h = reinterpret_cast<const HeapItem *>(this);
@@ -552,15 +548,15 @@ void Heap::Base::mark(QV4::ExecutionEngine *engine)
     quintptr bit = Chunk::bitForIndex(index);
     if (!(*bitmap & bit)) {
         *bitmap |= bit;
-        engine->pushForGC(this);
+        markStack->push(this);
     }
 }
 
-inline void Value::mark(ExecutionEngine *e)
+inline void Value::mark(MarkStack *markStack)
 {
     Heap::Base *o = heapObject();
     if (o)
-        o->mark(e);
+        o->mark(markStack);
 }
 
 #define CHECK_STACK_LIMITS(v4, scope) if ((v4)->checkStackLimits(scope)) return; \
diff --git a/src/qml/jsruntime/qv4identifiertable_p.h b/src/qml/jsruntime/qv4identifiertable_p.h
index 89af5db731..b0b08f1e54 100644
--- a/src/qml/jsruntime/qv4identifiertable_p.h
+++ b/src/qml/jsruntime/qv4identifiertable_p.h
@@ -93,14 +93,14 @@ public:
 
     Heap::String *stringFromIdentifier(Identifier *i);
 
-    void mark(ExecutionEngine *e) {
+    void mark(MarkStack *markStack) {
         for (int i = 0; i < alloc; ++i) {
             Heap::String *entry = entries[i];
             if (!entry || entry->isMarked())
                 continue;
             entry->setMarkBit();
             Q_ASSERT(entry->vtable()->markObjects);
-            entry->vtable()->markObjects(entry, e);
+            entry->vtable()->markObjects(entry, markStack);
         }
     }
 };
diff --git a/src/qml/jsruntime/qv4internalclass.cpp b/src/qml/jsruntime/qv4internalclass.cpp
index 9b18a5566e..3d9a672f2f 100644
--- a/src/qml/jsruntime/qv4internalclass.cpp
+++ b/src/qml/jsruntime/qv4internalclass.cpp
@@ -388,9 +388,9 @@ void InternalClass::destroy()
     }
 }
 
-void InternalClassPool::markObjects(ExecutionEngine *engine)
+void InternalClassPool::markObjects(MarkStack *markStack)
 {
-    Q_UNUSED(engine);
+    Q_UNUSED(markStack);
 }
 
 QT_END_NAMESPACE
diff --git a/src/qml/jsruntime/qv4internalclass_p.h b/src/qml/jsruntime/qv4internalclass_p.h
index 1d8ef4b0fb..a29ce5b5ff 100644
--- a/src/qml/jsruntime/qv4internalclass_p.h
+++ b/src/qml/jsruntime/qv4internalclass_p.h
@@ -291,7 +291,7 @@ inline uint InternalClass::find(const String *string)
 
 struct InternalClassPool : public QQmlJS::MemoryPool
 {
-    void markObjects(ExecutionEngine *engine);
+    void markObjects(MarkStack *markStack);
 };
 
 }
diff --git a/src/qml/jsruntime/qv4managed_p.h b/src/qml/jsruntime/qv4managed_p.h
index 3dc54b13da..9ecc4bd087 100644
--- a/src/qml/jsruntime/qv4managed_p.h
+++ b/src/qml/jsruntime/qv4managed_p.h
@@ -209,7 +209,7 @@ public:
     bool markBit() const { return d()->isMarked(); }
 
     static void destroy(Heap::Base *) {}
-    static void markObjects(Heap::Base *, ExecutionEngine *) {}
+    static void markObjects(Heap::Base *, MarkStack *) {}
 
     Q_ALWAYS_INLINE Heap::Base *heapObject() const {
         return m();
diff --git a/src/qml/jsruntime/qv4objectiterator.cpp b/src/qml/jsruntime/qv4objectiterator.cpp
index 59115dfe21..3427ee89fe 100644
--- a/src/qml/jsruntime/qv4objectiterator.cpp
+++ b/src/qml/jsruntime/qv4objectiterator.cpp
@@ -177,10 +177,10 @@ ReturnedValue ObjectIterator::nextPropertyNameAsString()
 
 DEFINE_OBJECT_VTABLE(ForEachIteratorObject);
 
-void ForEachIteratorObject::markObjects(Heap::Base *that, ExecutionEngine *e)
+void ForEachIteratorObject::markObjects(Heap::Base *that, MarkStack *markStack)
 {
     ForEachIteratorObject::Data *o = static_cast<ForEachIteratorObject::Data *>(that);
-    o->workArea[0].mark(e);
-    o->workArea[1].mark(e);
-    Object::markObjects(that, e);
+    o->workArea[0].mark(markStack);
+    o->workArea[1].mark(markStack);
+    Object::markObjects(that, markStack);
 }
diff --git a/src/qml/jsruntime/qv4objectiterator_p.h b/src/qml/jsruntime/qv4objectiterator_p.h
index 98e94a95ea..6168d59914 100644
--- a/src/qml/jsruntime/qv4objectiterator_p.h
+++ b/src/qml/jsruntime/qv4objectiterator_p.h
@@ -129,7 +129,7 @@ struct ForEachIteratorObject: Object {
     ReturnedValue nextPropertyName() { return d()->it().nextPropertyNameAsString(); }
 
 protected:
-    static void markObjects(Heap::Base *that, ExecutionEngine *e);
+    static void markObjects(Heap::Base *that, MarkStack *markStack);
 };
 
 inline
diff --git a/src/qml/jsruntime/qv4persistent.cpp b/src/qml/jsruntime/qv4persistent.cpp
index de82bf835f..0b31c971f9 100644
--- a/src/qml/jsruntime/qv4persistent.cpp
+++ b/src/qml/jsruntime/qv4persistent.cpp
@@ -215,17 +215,15 @@ void PersistentValueStorage::free(Value *v)
         freePage(p);
 }
 
-void PersistentValueStorage::mark(ExecutionEngine *e)
+void PersistentValueStorage::mark(MarkStack *markStack)
 {
-    Value *markBase = e->jsStackTop;
-
     Page *p = static_cast<Page *>(firstPage);
     while (p) {
         for (int i = 0; i < kEntriesPerPage; ++i) {
             if (Managed *m = p->values[i].as<Managed>())
-                m->mark(e);
+                m->mark(markStack);
         }
-        e->memoryManager->drainMarkStack(markBase);
+        markStack->drain();
 
         p = p->header.next;
     }
@@ -384,11 +382,11 @@ void WeakValue::allocVal(ExecutionEngine *engine)
     val = engine->memoryManager->m_weakValues->allocate();
 }
 
-void WeakValue::markOnce(ExecutionEngine *e)
+void WeakValue::markOnce(MarkStack *markStack)
 {
     if (!val)
         return;
-    val->mark(e);
+    val->mark(markStack);
 }
 
 void WeakValue::free()
diff --git a/src/qml/jsruntime/qv4persistent_p.h b/src/qml/jsruntime/qv4persistent_p.h
index c1cd1f34df..1f838f5531 100644
--- a/src/qml/jsruntime/qv4persistent_p.h
+++ b/src/qml/jsruntime/qv4persistent_p.h
@@ -65,7 +65,7 @@ struct Q_QML_EXPORT PersistentValueStorage
     Value *allocate();
     static void free(Value *e);
 
-    void mark(ExecutionEngine *e);
+    void mark(MarkStack *markStack);
 
     struct Iterator {
         Iterator(void *p, int idx);
@@ -203,7 +203,7 @@ public:
     bool isNullOrUndefined() const { return !val || val->isNullOrUndefined(); }
     void clear() { free(); }
 
-    void markOnce(ExecutionEngine *e);
+    void markOnce(MarkStack *markStack);
 
 private:
     Value *val;
diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 4f6c179026..2ac2b0b64d 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -539,7 +539,7 @@ ReturnedValue QObjectWrapper::wrap_slowPath(ExecutionEngine *engine, QObject *ob
     }
 }
 
-void QObjectWrapper::markWrapper(QObject *object, ExecutionEngine *engine)
+void QObjectWrapper::markWrapper(QObject *object, MarkStack *markStack)
 {
     if (QQmlData::wasDeleted(object))
         return;
@@ -548,10 +548,10 @@ void QObjectWrapper::markWrapper(QObject *object, ExecutionEngine *engine)
     if (!ddata)
         return;
 
-    if (ddata->jsEngineId == engine->m_engineId)
-        ddata->jsWrapper.markOnce(engine);
-    else  if (engine->m_multiplyWrappedQObjects && ddata->hasTaintedV4Object)
-        engine->m_multiplyWrappedQObjects->mark(object, engine);
+    if (ddata->jsEngineId == markStack->engine->m_engineId)
+        ddata->jsWrapper.markOnce(markStack);
+    else  if (markStack->engine->m_multiplyWrappedQObjects && ddata->hasTaintedV4Object)
+        markStack->engine->m_multiplyWrappedQObjects->mark(object, markStack);
 }
 
 ReturnedValue QObjectWrapper::getProperty(ExecutionEngine *engine, QObject *object, int propertyIndex, bool captureRequired)
@@ -938,36 +938,36 @@ void QObjectWrapper::method_disconnect(const BuiltinFunction *, Scope &scope, Ca
     RETURN_UNDEFINED();
 }
 
-static void markChildQObjectsRecursively(QObject *parent, QV4::ExecutionEngine *e)
+static void markChildQObjectsRecursively(QObject *parent, QV4::MarkStack *markStack)
 {
     const QObjectList &children = parent->children();
     for (int i = 0; i < children.count(); ++i) {
         QObject *child = children.at(i);
         if (!child)
             continue;
-        QObjectWrapper::markWrapper(child, e);
-        markChildQObjectsRecursively(child, e);
+        QObjectWrapper::markWrapper(child, markStack);
+        markChildQObjectsRecursively(child, markStack);
     }
 }
 
-void QObjectWrapper::markObjects(Heap::Base *that, QV4::ExecutionEngine *e)
+void QObjectWrapper::markObjects(Heap::Base *that, QV4::MarkStack *markStack)
 {
     QObjectWrapper::Data *This = static_cast<QObjectWrapper::Data *>(that);
 
     if (QObject *o = This->object()) {
         QQmlVMEMetaObject *vme = QQmlVMEMetaObject::get(o);
         if (vme)
-            vme->mark(e);
+            vme->mark(markStack);
 
         // Children usually don't need to be marked, the gc keeps them alive.
         // But in the rare case of a "floating" QObject without a parent that
         // _gets_ marked (we've been called here!) then we also need to
         // propagate the marking down to the children recursively.
         if (!o->parent())
-            markChildQObjectsRecursively(o, e);
+            markChildQObjectsRecursively(o, markStack);
     }
 
-    QV4::Object::markObjects(that, e);
+    QV4::Object::markObjects(that, markStack);
 }
 
 void QObjectWrapper::destroyObject(bool lastCall)
@@ -2066,12 +2066,12 @@ void MultiplyWrappedQObjectMap::remove(QObject *key)
     erase(it);
 }
 
-void MultiplyWrappedQObjectMap::mark(QObject *key, ExecutionEngine *engine)
+void MultiplyWrappedQObjectMap::mark(QObject *key, MarkStack *markStack)
 {
     Iterator it = find(key);
     if (it == end())
         return;
-    it->markOnce(engine);
+    it->markOnce(markStack);
 }
 
 void MultiplyWrappedQObjectMap::removeDestroyedObject(QObject *object)
diff --git a/src/qml/jsruntime/qv4qobjectwrapper_p.h b/src/qml/jsruntime/qv4qobjectwrapper_p.h
index c031a40211..dbb4a153e4 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper_p.h
+++ b/src/qml/jsruntime/qv4qobjectwrapper_p.h
@@ -171,7 +171,7 @@ struct Q_QML_EXPORT QObjectWrapper : public Object
     static bool setQmlProperty(ExecutionEngine *engine, QQmlContextData *qmlContext, QObject *object, String *name, RevisionMode revisionMode, const Value &value);
 
     static ReturnedValue wrap(ExecutionEngine *engine, QObject *object);
-    static void markWrapper(QObject *object, ExecutionEngine *engine);
+    static void markWrapper(QObject *object, MarkStack *markStack);
 
     using Object::get;
 
@@ -195,7 +195,7 @@ protected:
     static bool put(Managed *m, String *name, const Value &value);
     static PropertyAttributes query(const Managed *, String *name);
     static void advanceIterator(Managed *m, ObjectIterator *it, Value *name, uint *index, Property *p, PropertyAttributes *attributes);
-    static void markObjects(Heap::Base *that, QV4::ExecutionEngine *e);
+    static void markObjects(Heap::Base *that, QV4::MarkStack *markStack);
 
     static void method_connect(const BuiltinFunction *, Scope &scope, CallData *callData);
     static void method_disconnect(const BuiltinFunction *, Scope &scope, CallData *callData);
@@ -295,7 +295,7 @@ public:
     ReturnedValue value(QObject *key) const { return QHash<QObject*, QV4::WeakValue>::value(key).value(); }
     Iterator erase(Iterator it);
     void remove(QObject *key);
-    void mark(QObject *key, ExecutionEngine *engine);
+    void mark(QObject *key, MarkStack *markStack);
 
 private Q_SLOTS:
     void removeDestroyedObject(QObject*);
diff --git a/src/qml/jsruntime/qv4string.cpp b/src/qml/jsruntime/qv4string.cpp
index cde2131aab..71f85c2d71 100644
--- a/src/qml/jsruntime/qv4string.cpp
+++ b/src/qml/jsruntime/qv4string.cpp
@@ -54,12 +54,12 @@ using namespace QV4;
 
 DEFINE_MANAGED_VTABLE(String);
 
-void String::markObjects(Heap::Base *that, ExecutionEngine *e)
+void String::markObjects(Heap::Base *that, MarkStack *markStack)
 {
     String::Data *s = static_cast<String::Data *>(that);
     if (s->largestSubLength) {
-        s->left->mark(e);
-        s->right->mark(e);
+        s->left->mark(markStack);
+        s->right->mark(markStack);
     }
 }
 
diff --git a/src/qml/jsruntime/qv4string_p.h b/src/qml/jsruntime/qv4string_p.h
index 5b0fd292d6..71e55cbcd4 100644
--- a/src/qml/jsruntime/qv4string_p.h
+++ b/src/qml/jsruntime/qv4string_p.h
@@ -204,7 +204,7 @@ struct Q_QML_PRIVATE_EXPORT String : public Managed {
     Identifier *identifier() const { return d()->identifier; }
 
 protected:
-    static void markObjects(Heap::Base *that, ExecutionEngine *e);
+    static void markObjects(Heap::Base *that, MarkStack *markStack);
     static bool isEqualTo(Managed *that, Managed *o);
     static uint getLength(const Managed *m);
 #endif
diff --git a/src/qml/jsruntime/qv4value_p.h b/src/qml/jsruntime/qv4value_p.h
index 11d75dde99..56b4ec44a2 100644
--- a/src/qml/jsruntime/qv4value_p.h
+++ b/src/qml/jsruntime/qv4value_p.h
@@ -475,7 +475,7 @@ public:
     // Section 9.12
     bool sameValue(Value other) const;
 
-    inline void mark(ExecutionEngine *e);
+    inline void mark(MarkStack *markStack);
 
     Value &operator =(const ScopedValue &v);
     Value &operator=(ReturnedValue v) { _val = v; return *this; }
diff --git a/src/qml/memory/qv4heap_p.h b/src/qml/memory/qv4heap_p.h
index 6c7da91ba0..a38a938588 100644
--- a/src/qml/memory/qv4heap_p.h
+++ b/src/qml/memory/qv4heap_p.h
@@ -83,7 +83,7 @@ struct VTable
     uint type : 8;
     const char *className;
     void (*destroy)(Heap::Base *);
-    void (*markObjects)(Heap::Base *, ExecutionEngine *e);
+    void (*markObjects)(Heap::Base *, MarkStack *markStack);
     bool (*isEqualTo)(Managed *m, Managed *other);
 };
 
@@ -97,7 +97,7 @@ struct Q_QML_EXPORT Base {
     const VTable *vt;
 
     inline ReturnedValue asReturnedValue() const;
-    inline void mark(QV4::ExecutionEngine *engine);
+    inline void mark(QV4::MarkStack *markStack);
 
     void setVtable(const VTable *v) { vt = v; }
     const VTable *vtable() const { return vt; }
@@ -127,7 +127,7 @@ struct Q_QML_EXPORT Base {
         return Chunk::testBit(c->objectBitmap, h - c->realBase());
     }
 
-    inline void markChildren(ExecutionEngine *engine);
+    inline void markChildren(MarkStack *markStack);
 
     void *operator new(size_t, Managed *m) { return m; }
     void *operator new(size_t, Heap::Base *m) { return m; }
diff --git a/src/qml/memory/qv4mm.cpp b/src/qml/memory/qv4mm.cpp
index 28330a93c9..aebbc07826 100644
--- a/src/qml/memory/qv4mm.cpp
+++ b/src/qml/memory/qv4mm.cpp
@@ -260,10 +260,10 @@ void ChunkAllocator::free(Chunk *chunk, size_t size)
 }
 
 
-void Heap::Base::markChildren(ExecutionEngine *engine)
+void Heap::Base::markChildren(MarkStack *markStack)
 {
     if (vtable()->markObjects)
-        vtable()->markObjects(this, engine);
+        vtable()->markObjects(this, markStack);
     if (quint64 m = vtable()->markTable) {
 //            qDebug() << "using mark table:" << hex << m << "for" << h;
         void **mem = reinterpret_cast<void **>(this);
@@ -274,13 +274,13 @@ void Heap::Base::markChildren(ExecutionEngine *engine)
                 break;
             case Mark_Value:
 //                    qDebug() << "marking value at " << mem;
-                reinterpret_cast<Value *>(mem)->mark(engine);
+                reinterpret_cast<Value *>(mem)->mark(markStack);
                 break;
             case Mark_Pointer: {
 //                    qDebug() << "marking pointer at " << mem;
                 Heap::Base *p = *reinterpret_cast<Heap::Base **>(mem);
                 if (p)
-                    p->mark(engine);
+                    p->mark(markStack);
                 break;
             }
             case Mark_ValueArray: {
@@ -291,17 +291,20 @@ void Heap::Base::markChildren(ExecutionEngine *engine)
                 const Value *end = v + a->alloc;
                 if (a->alloc > 32*1024) {
                     // drain from time to time to avoid overflows in the js stack
-                    Value *currentBase = engine->jsStackTop;
+                    Heap::Base **currentBase = markStack->top;
                     while (v < end) {
-                        v->mark(engine);
+                        v->mark(markStack);
                         ++v;
-                        if (engine->jsStackTop >= currentBase + 32*1024)
-                            engine->memoryManager->drainMarkStack(currentBase);
+                        if (markStack->top >= currentBase + 32*1024) {
+                            Heap::Base **oldBase = markStack->base;
+                            markStack->base = currentBase;
+                            markStack->drain();
+                            markStack->base = oldBase;
+                        }
                     }
-
                 } else {
                     while (v < end) {
-                        v->mark(engine);
+                        v->mark(markStack);
                         ++v;
                     }
                 }
@@ -407,7 +410,7 @@ void Chunk::resetBlackBits()
 static uint nGrayItems = 0;
 #endif
 
-void Chunk::collectGrayItems(ExecutionEngine *engine)
+void Chunk::collectGrayItems(MarkStack *markStack)
 {
     //    DEBUG << "sweeping chunk" << this << (*freeList);
     HeapItem *o = realBase();
@@ -428,7 +431,7 @@ void Chunk::collectGrayItems(ExecutionEngine *engine)
             HeapItem *itemToFree = o + index;
             Heap::Base *b = *itemToFree;
             Q_ASSERT(b->inUse());
-            engine->pushForGC(b);
+            markStack->push(b);
 #ifdef MM_STATS
             ++nGrayItems;
 //            qDebug() << "adding gray item" << b << "to mark stack";
@@ -676,10 +679,10 @@ void BlockAllocator::resetBlackBits()
         c->resetBlackBits();
 }
 
-void BlockAllocator::collectGrayItems(ExecutionEngine *engine)
+void BlockAllocator::collectGrayItems(MarkStack *markStack)
 {
     for (auto c : chunks)
-        c->collectGrayItems(engine);
+        c->collectGrayItems(markStack);
 
 }
 
@@ -750,7 +753,7 @@ void HugeItemAllocator::resetBlackBits()
         Chunk::clearBit(c.chunk->blackBitmap, c.chunk->first() - c.chunk->realBase());
 }
 
-void HugeItemAllocator::collectGrayItems(ExecutionEngine *engine)
+void HugeItemAllocator::collectGrayItems(MarkStack *markStack)
 {
     for (auto c : chunks)
         // Correct for a Steele type barrier
@@ -758,7 +761,7 @@ void HugeItemAllocator::collectGrayItems(ExecutionEngine *engine)
             Chunk::testBit(c.chunk->grayBitmap, c.chunk->first() - c.chunk->realBase())) {
             HeapItem *i = c.chunk->first();
             Heap::Base *b = *i;
-            b->mark(engine);
+            b->mark(markStack);
         }
 }
 
@@ -908,34 +911,35 @@ Heap::Object *MemoryManager::allocObjectWithMemberData(std::size_t size, uint nM
 
 static uint markStackSize = 0;
 
-void MemoryManager::drainMarkStack(Value *markBase)
+MarkStack::MarkStack(ExecutionEngine *engine)
+    : engine(engine)
+{
+    base = (Heap::Base **)engine->gcStack->base();
+    top = base;
+    limit = base + ExecutionEngine::GCStackLimit/sizeof(Heap::Base)*3/4;
+}
+
+void MarkStack::drain()
 {
-    while (engine->jsStackTop > markBase) {
-        Heap::Base *h = engine->popForGC();
+    while (top > base) {
+        Heap::Base *h = pop();
         ++markStackSize;
         Q_ASSERT(h); // at this point we should only have Heap::Base objects in this area on the stack. If not, weird things might happen.
-        h->markChildren(engine);
+        h->markChildren(this);
     }
 }
 
-void MemoryManager::mark()
+void MemoryManager::collectRoots(MarkStack *markStack)
 {
-    Value *markBase = engine->jsStackTop;
-
-    markStackSize = 0;
-
-//    qDebug() << ">>>> Mark phase:";
-//    qDebug() << "   mark stack after gray items" << (engine->jsStackTop - markBase);
-
     if (!nextGCIsIncremental)
-        engine->markObjects();
+        engine->markObjects(markStack);
 
 //    qDebug() << "   mark stack after engine->mark" << (engine->jsStackTop - markBase);
 
-    collectFromJSStack();
+    collectFromJSStack(markStack);
 
 //    qDebug() << "   mark stack after js stack collect" << (engine->jsStackTop - markBase);
-    m_persistentValues->mark(engine);
+    m_persistentValues->mark(markStack);
 
 //    qDebug() << "   mark stack after persistants" << (engine->jsStackTop - markBase);
 
@@ -964,19 +968,27 @@ void MemoryManager::mark()
         }
 
         if (keepAlive)
-            qobjectWrapper->mark(engine);
+            qobjectWrapper->mark(markStack);
 
-        if (engine->jsStackTop >= engine->jsStackLimit)
-            drainMarkStack(markBase);
+        if (markStack->top >= markStack->limit)
+            markStack->drain();
     }
+}
+
+void MemoryManager::mark()
+{
+    markStackSize = 0;
+
+    MarkStack markStack(engine);
+    collectRoots(&markStack);
 
     if (nextGCIsIncremental) {
         // need to collect all gray items and push them onto the mark stack
-        blockAllocator.collectGrayItems(engine);
-        hugeItemAllocator.collectGrayItems(engine);
+        blockAllocator.collectGrayItems(&markStack);
+        hugeItemAllocator.collectGrayItems(&markStack);
     }
 
-    drainMarkStack(markBase);
+    markStack.drain();
 }
 
 void MemoryManager::sweep(bool lastSweep)
@@ -1242,7 +1254,7 @@ void MemoryManager::willAllocate(std::size_t size)
 
 #endif // DETAILED_MM_STATS
 
-void MemoryManager::collectFromJSStack() const
+void MemoryManager::collectFromJSStack(MarkStack *markStack) const
 {
     Value *v = engine->jsStackBase;
     Value *top = engine->jsStackTop;
@@ -1250,7 +1262,7 @@ void MemoryManager::collectFromJSStack() const
         Managed *m = v->managed();
         if (m && m->inUse())
             // Skip pointers to already freed objects, they are bogus as well
-            m->mark(engine);
+            m->mark(markStack);
         ++v;
     }
 }
diff --git a/src/qml/memory/qv4mm_p.h b/src/qml/memory/qv4mm_p.h
index 7f02a4f929..1335ea59b6 100644
--- a/src/qml/memory/qv4mm_p.h
+++ b/src/qml/memory/qv4mm_p.h
@@ -156,7 +156,7 @@ struct BlockAllocator {
     void sweep();
     void freeAll();
     void resetBlackBits();
-    void collectGrayItems(ExecutionEngine *engine);
+    void collectGrayItems(MarkStack *markStack);
 
     // bump allocations
     HeapItem *nextFree = 0;
@@ -179,7 +179,7 @@ struct HugeItemAllocator {
     void sweep();
     void freeAll();
     void resetBlackBits();
-    void collectGrayItems(ExecutionEngine *engine);
+    void collectGrayItems(MarkStack *markStack);
 
     size_t usedMem() const {
         size_t used = 0;
@@ -432,8 +432,6 @@ public:
 
     // called when a JS object grows itself. Specifically: Heap::String::append
     void changeUnmanagedHeapSizeUsage(qptrdiff delta) { unmanagedHeapSize += delta; }
-    void drainMarkStack(Value *markBase);
-
 
 protected:
     /// expects size to be aligned
@@ -446,10 +444,11 @@ protected:
 #endif // DETAILED_MM_STATS
 
 private:
-    void collectFromJSStack() const;
+    void collectFromJSStack(MarkStack *markStack) const;
     void mark();
     void sweep(bool lastSweep = false);
     bool shouldRunGC() const;
+    void collectRoots(MarkStack *markStack);
 
 public:
     QV4::ExecutionEngine *engine;
diff --git a/src/qml/memory/qv4mmdefs_p.h b/src/qml/memory/qv4mmdefs_p.h
index 1fc7b6a527..9512722782 100644
--- a/src/qml/memory/qv4mmdefs_p.h
+++ b/src/qml/memory/qv4mmdefs_p.h
@@ -59,6 +59,8 @@ QT_BEGIN_NAMESPACE
 
 namespace QV4 {
 
+struct MarkStack;
+
 /*
  * Chunks are the basic structure containing GC managed objects.
  *
@@ -185,7 +187,7 @@ struct Chunk {
     void sweep();
     void freeAll();
     void resetBlackBits();
-    void collectGrayItems(ExecutionEngine *engine);
+    void collectGrayItems(QV4::MarkStack *markStack);
 
     void sortIntoBins(HeapItem **bins, uint nBins);
 };
@@ -265,6 +267,24 @@ Q_STATIC_ASSERT(sizeof(HeapItem) == Chunk::SlotSize);
 Q_STATIC_ASSERT(QT_POINTER_SIZE*8 == Chunk::Bits);
 Q_STATIC_ASSERT((1 << Chunk::BitShift) == Chunk::Bits);
 
+struct MarkStack {\
+    MarkStack(ExecutionEngine *engine);
+    Heap::Base **top = 0;
+    Heap::Base **base = 0;
+    Heap::Base **limit = 0;
+    ExecutionEngine *engine;
+    void push(Heap::Base *m) {
+        *top = m;
+        ++top;
+    }
+    Heap::Base *pop() {
+        --top;
+        return *top;
+    }
+    void drain();
+
+};
+
 // Base class for the execution engine
 
 #if defined(Q_CC_MSVC) || defined(Q_CC_GNU)
diff --git a/src/qml/qml/qqmlvmemetaobject.cpp b/src/qml/qml/qqmlvmemetaobject.cpp
index f464a099e0..9f86d1cae9 100644
--- a/src/qml/qml/qqmlvmemetaobject.cpp
+++ b/src/qml/qml/qqmlvmemetaobject.cpp
@@ -1170,16 +1170,16 @@ void QQmlVMEMetaObject::ensureQObjectWrapper()
     QV4::QObjectWrapper::wrap(v4, object);
 }
 
-void QQmlVMEMetaObject::mark(QV4::ExecutionEngine *e)
+void QQmlVMEMetaObject::mark(QV4::MarkStack *markStack)
 {
     QV4::ExecutionEngine *v4 = cache ? cache->engine : 0;
-    if (v4 != e)
+    if (v4 != markStack->engine)
         return;
 
-    propertyAndMethodStorage.markOnce(e);
+    propertyAndMethodStorage.markOnce(markStack);
 
     if (QQmlVMEMetaObject *parent = parentVMEMetaObject())
-        parent->mark(e);
+        parent->mark(markStack);
 }
 
 bool QQmlVMEMetaObject::aliasTarget(int index, QObject **target, int *coreIndex, int *valueTypeIndex) const
diff --git a/src/qml/qml/qqmlvmemetaobject_p.h b/src/qml/qml/qqmlvmemetaobject_p.h
index bb6fede7c8..031a9a9ddd 100644
--- a/src/qml/qml/qqmlvmemetaobject_p.h
+++ b/src/qml/qml/qqmlvmemetaobject_p.h
@@ -203,7 +203,7 @@ public:
 
     void ensureQObjectWrapper();
 
-    void mark(QV4::ExecutionEngine *e);
+    void mark(QV4::MarkStack *markStack);
 
     void connectAlias(int aliasId);
 
diff --git a/src/quick/items/context2d/qquickcontext2d.cpp b/src/quick/items/context2d/qquickcontext2d.cpp
index db9b1acbdf..a32b065318 100644
--- a/src/quick/items/context2d/qquickcontext2d.cpp
+++ b/src/quick/items/context2d/qquickcontext2d.cpp
@@ -927,9 +927,9 @@ struct QQuickJSContext2DImageData : public QV4::Object
     static void method_get_height(const QV4::BuiltinFunction *, QV4::Scope &scope, QV4::CallData *callData);
     static void method_get_data(const QV4::BuiltinFunction *, QV4::Scope &scope, QV4::CallData *callData);
 
-    static void markObjects(QV4::Heap::Base *that, QV4::ExecutionEngine *engine) {
-        static_cast<QQuickJSContext2DImageData::Data *>(that)->pixelData.mark(engine);
-        QV4::Object::markObjects(that, engine);
+    static void markObjects(QV4::Heap::Base *that, QV4::MarkStack *markStack) {
+        static_cast<QQuickJSContext2DImageData::Data *>(that)->pixelData.mark(markStack);
+        QV4::Object::markObjects(that, markStack);
     }
 };
 
diff --git a/src/quick/items/qquickitem.cpp b/src/quick/items/qquickitem.cpp
index 539a374dd9..c62c0da445 100644
--- a/src/quick/items/qquickitem.cpp
+++ b/src/quick/items/qquickitem.cpp
@@ -8441,19 +8441,19 @@ struct QQuickItemWrapper : public QObjectWrapper {
 
 struct QQuickItemWrapper : public QV4::QObjectWrapper {
     V4_OBJECT2(QQuickItemWrapper, QV4::QObjectWrapper)
-    static void markObjects(QV4::Heap::Base *that, QV4::ExecutionEngine *e);
+    static void markObjects(QV4::Heap::Base *that, QV4::MarkStack *markStack);
 };
 
 DEFINE_OBJECT_VTABLE(QQuickItemWrapper);
 
-void QQuickItemWrapper::markObjects(QV4::Heap::Base *that, QV4::ExecutionEngine *e)
+void QQuickItemWrapper::markObjects(QV4::Heap::Base *that, QV4::MarkStack *markStack)
 {
     QObjectWrapper::Data *This = static_cast<QObjectWrapper::Data *>(that);
     if (QQuickItem *item = static_cast<QQuickItem*>(This->object())) {
         for (QQuickItem *child : qAsConst(QQuickItemPrivate::get(item)->childItems))
-            QV4::QObjectWrapper::markWrapper(child, e);
+            QV4::QObjectWrapper::markWrapper(child, markStack);
     }
-    QV4::QObjectWrapper::markObjects(that, e);
+    QV4::QObjectWrapper::markObjects(that, markStack);
 }
 
 quint64 QQuickItemPrivate::_q_createJSWrapper(QV4::ExecutionEngine *engine)