Changeset 100219 in webkit

Timestamp:

Nov 14, 2011, 5:04:08 PM (15 years ago)

Author:

fpizlo@apple.com

Message:

DFG put_by_id transition optimizations test the wrong structures
​https://bugs.webkit.org/show_bug.cgi?id=72324

Reviewed by Gavin Barraclough.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::structureChainIsStillValid):
(JSC::DFG::ByteCodeParser::parseBlock):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::privateCompilePutByIdTransition):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (2 diffs)
• jit/JITPropertyAccess.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG put_by_id transition optimizations test the wrong structures
+        https://bugs.webkit.org/show_bug.cgi?id=72324
+
+        Reviewed by Gavin Barraclough.
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::structureChainIsStillValid):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
 2011-11-14  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -683 +683 @@
         
         return nodeIndex;
+    }
+    
+    bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)
+    {
+        if (direct)
+            return true;
+        
+        if (!previousStructure->storedPrototype().isNull() && previousStructure->storedPrototype().asCell()->structure() != chain->head()->get())
+            return false;
+        
+        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
+            if (!(*it)->storedPrototype().isNull() && (*it)->storedPrototype().asCell()->structure() != it[1].get())
+                return false;
+        }
+        
+        return true;
     }
     
@@ -1804 +1820 @@
                     size_t offset = newStructure->get(*m_globalData, identifier);
                     
-                    if (offset != notFound) {
+                    if (offset != notFound && structureChainIsStillValid(direct, previousStructure, structureChain)) {
                         addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure)), base);
                         if (!direct) {
+                            if (!previousStructure->storedPrototype().isNull())
+                                addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure->storedPrototype().asCell()->structure())), cellConstant(previousStructure->storedPrototype().asCell()));
+                            
                             for (WriteBarrier<Structure>* it = structureChain->head(); *it; ++it) {
                                 JSValue prototype = (*it)->storedPrototype();

trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -522 +522 @@
     failureCases.append(emitJumpIfNotJSCell(regT0));
     failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
+    
     testPrototype(oldStructure->storedPrototype(), failureCases);
+    
+    ASSERT(oldStructure->storedPrototype().isNull() || oldStructure->storedPrototype().asCell()->structure() == chain->head()->get());
 
     // ecx = baseObject->m_structure
     if (!direct) {
-        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it)
+        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
+            ASSERT((*it)->storedPrototype().isNull() || (*it)->storedPrototype().asCell()->structure() == it[1].get());
             testPrototype((*it)->storedPrototype(), failureCases);
+        }
     }