Changeset 100221 in webkit

Timestamp:

Nov 14, 2011, 5:22:52 PM (15 years ago)

Author:

fpizlo@apple.com

Message:

DFG's inline references to objects should be tracked
​https://bugs.webkit.org/show_bug.cgi?id=72313

Reviewed by Gavin Barraclough.

Added a pinCell() method in the parser that currently creates a
dummy constant in CodeBlock. Added calls to pinCell() wherever the
DFG would inline a constant reference that the original code would
not have referred to.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::getCellConstantIndex):
(JSC::DFG::ByteCodeParser::pinCell):
(JSC::DFG::ByteCodeParser::cellConstant):
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::parseBlock):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (9 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-11-14  Filip Pizlo  <fpizlo@apple.com>
+
+        DFG's inline references to objects should be tracked
+        https://bugs.webkit.org/show_bug.cgi?id=72313
+
+        Reviewed by Gavin Barraclough.
+        
+        Added a pinCell() method in the parser that currently creates a
+        dummy constant in CodeBlock. Added calls to pinCell() wherever the
+        DFG would inline a constant reference that the original code would
+        not have referred to.
+        
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::getCellConstantIndex):
+        (JSC::DFG::ByteCodeParser::pinCell):
+        (JSC::DFG::ByteCodeParser::cellConstant):
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+
 2011-11-14  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -508 +508 @@
     }
     
-    NodeIndex cellConstant(JSCell* cell)
+    unsigned getCellConstantIndex(JSCell* cell)
     {
         HashMap<JSCell*, unsigned>::iterator iter = m_cellConstants.find(cell);
         if (iter != m_cellConstants.end())
-            return getJSConstant(iter->second);
+            return iter->second;
         
         m_codeBlock->addConstant(cell);
@@ -520 +520 @@
         m_cellConstants.add(cell, m_codeBlock->numberOfConstantRegisters() - 1);
         
-        return getJSConstant(m_codeBlock->numberOfConstantRegisters() - 1);
+        return m_codeBlock->numberOfConstantRegisters() - 1;
+    }
+    
+    void pinCell(JSCell* cell)
+    {
+        if (!cell)
+            return;
+        getCellConstantIndex(cell);
+    }
+    
+    NodeIndex cellConstant(JSCell* cell)
+    {
+        return getJSConstant(getCellConstantIndex(cell));
     }
     
@@ -922 +934 @@
                 
         if (intrinsic != NoIntrinsic) {
-            if (!certainAboutExpectedFunction)
+            if (!certainAboutExpectedFunction) {
+                pinCell(expectedFunction);
                 addToGraph(CheckFunction, OpInfo(expectedFunction), callTarget);
+            }
             
             if (handleIntrinsic(usesResult, resultOperand, intrinsic, firstArg, lastArg, prediction)) {
@@ -990 +1004 @@
     // by checking the callee (if necessary) and making sure that arguments and the callee
     // are flushed.
-    if (!certainAboutExpectedFunction)
+    if (!certainAboutExpectedFunction) {
+        pinCell(expectedFunction);
         addToGraph(CheckFunction, OpInfo(expectedFunction), callTargetNodeIndex);
+    }
     
     // FIXME: Don't flush constants!
@@ -1652 +1668 @@
                 // It's monomorphic as far as we can tell, since the method_check was linked
                 // but the slow path (i.e. the normal get_by_id) never fired.
+
+                pinCell(methodCall.cachedStructure.get());
+                pinCell(methodCall.cachedPrototypeStructure.get());
+                pinCell(methodCall.cachedFunction.get());
+                pinCell(methodCall.cachedPrototype.get());
             
                 NodeIndex checkMethod = addToGraph(CheckMethod, OpInfo(identifier), OpInfo(m_graph.m_methodCheckData.size()), base);
@@ -1762 +1783 @@
                     addToGraph(ForceOSRExit);
                 
+                for (unsigned i = 0; i < structureSet.size(); ++i)
+                    pinCell(structureSet[i]);
+                
                 addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(structureSet)), base);
                 set(currentInstruction[1].u.operand, addToGraph(GetByOffset, OpInfo(m_graph.m_storageAccessData.size()), OpInfo(prediction), addToGraph(GetPropertyStorage, base)));
@@ -1795 +1819 @@
                     
                     if (offset != notFound) {
+                        pinCell(structure);
                         addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(structure)), base);
                         addToGraph(PutByOffset, OpInfo(m_graph.m_storageAccessData.size()), base, addToGraph(GetPropertyStorage, base), value);
@@ -1821 +1846 @@
                     
                     if (offset != notFound && structureChainIsStillValid(direct, previousStructure, structureChain)) {
+                        pinCell(previousStructure);
+                        pinCell(newStructure);
                         addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure)), base);
                         if (!direct) {
-                            if (!previousStructure->storedPrototype().isNull())
+                            if (!previousStructure->storedPrototype().isNull()) {
+                                pinCell(previousStructure->storedPrototype().asCell()->structure());
+                                pinCell(previousStructure->storedPrototype().asCell());
                                 addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure->storedPrototype().asCell()->structure())), cellConstant(previousStructure->storedPrototype().asCell()));
+                            }
                             
                             for (WriteBarrier<Structure>* it = structureChain->head(); *it; ++it) {
@@ -1831 +1861 @@
                                     continue;
                                 ASSERT(prototype.isCell());
+                                pinCell(prototype.asCell());
+                                pinCell(prototype.asCell()->structure());
                                 addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(prototype.asCell()->structure())), cellConstant(prototype.asCell()));
                             }