⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 180703 in webkit


Ignore:
Timestamp:
Feb 26, 2015, 2:44:45 PM (12 years ago)
Author:
fpizlo@apple.com
Message:

Various array access corner cases should take OSR exit feedback
​https://bugs.webkit.org/show_bug.cgi?id=142056

Reviewed by Geoffrey Garen.
Source/JavaScriptCore:


Two major changes here:

  • Don't keep converting GetById into GetArrayLength if we exited due to any kind of array type check.


  • Use a generic form of GetByVal/PutByVal if we exited due to any kind of exotic checks, like the Arguments safety checks. We use the "ExoticObjectMode" for out-of-bounds on arguments for now, since it's a convenient way of forcing out-of-bounds to be handled by the Generic array mode.
  • bytecode/ExitKind.cpp:

(JSC::exitKindToString):

  • bytecode/ExitKind.h:
  • dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
(JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):

  • tests/stress/array-length-array-storage-plain-object.js: Added.

(foo):

  • tests/stress/array-length-plain-object.js: Added.

(foo):

LayoutTests:

  • js/regress/arguments-out-of-bounds-expected.txt: Added.
  • js/regress/arguments-out-of-bounds.html: Added.
  • js/regress/exit-length-on-plain-object-expected.txt: Added.
  • js/regress/exit-length-on-plain-object.html: Added.
  • js/regress/script-tests/arguments-out-of-bounds.js: Added.

(foo):
(bar):

  • js/regress/script-tests/exit-length-on-plain-object.js: Added.

(foo):

  • js/regress/script-tests/string-out-of-bounds.js: Added.

(bar):

  • js/regress/string-out-of-bounds-expected.txt: Added.
  • js/regress/string-out-of-bounds.html: Added.
Location:
trunk
Files:
11 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r180690 r180703  
     12015-02-26  Filip Pizlo  <fpizlo@apple.com>
     2
     3        Various array access corner cases should take OSR exit feedback
     4        https://bugs.webkit.org/show_bug.cgi?id=142056
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        * js/regress/arguments-out-of-bounds-expected.txt: Added.
     9        * js/regress/arguments-out-of-bounds.html: Added.
     10        * js/regress/exit-length-on-plain-object-expected.txt: Added.
     11        * js/regress/exit-length-on-plain-object.html: Added.
     12        * js/regress/script-tests/arguments-out-of-bounds.js: Added.
     13        (foo):
     14        (bar):
     15        * js/regress/script-tests/exit-length-on-plain-object.js: Added.
     16        (foo):
     17        * js/regress/script-tests/string-out-of-bounds.js: Added.
     18        (bar):
     19        * js/regress/string-out-of-bounds-expected.txt: Added.
     20        * js/regress/string-out-of-bounds.html: Added.
     21
    1222015-02-26  Mark Lam  <mark.lam@apple.com>
    223

  • trunk/Source/JavaScriptCore/ChangeLog

    r180691 r180703  
     12015-02-26  Filip Pizlo  <fpizlo@apple.com>
     2
     3        Various array access corner cases should take OSR exit feedback
     4        https://bugs.webkit.org/show_bug.cgi?id=142056
     5
     6        Reviewed by Geoffrey Garen.
     7       
     8        Two major changes here:
     9       
     10        - Don't keep converting GetById into GetArrayLength if we exited due to any kind of array
     11          type check.
     12       
     13        - Use a generic form of GetByVal/PutByVal if we exited due to any kind of exotic checks,
     14          like the Arguments safety checks. We use the "ExoticObjectMode" for out-of-bounds on
     15          arguments for now, since it's a convenient way of forcing out-of-bounds to be handled by
     16          the Generic array mode.
     17
     18        * bytecode/ExitKind.cpp:
     19        (JSC::exitKindToString):
     20        * bytecode/ExitKind.h:
     21        * dfg/DFGArrayMode.cpp:
     22        (JSC::DFG::ArrayMode::refine):
     23        * dfg/DFGFixupPhase.cpp:
     24        (JSC::DFG::FixupPhase::fixupNode):
     25        * dfg/DFGSpeculativeJIT.cpp:
     26        (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
     27        (JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):
     28        * tests/stress/array-length-array-storage-plain-object.js: Added.
     29        (foo):
     30        * tests/stress/array-length-plain-object.js: Added.
     31        (foo):
     32
    1332015-02-25  Filip Pizlo  <fpizlo@apple.com>
    234

  • trunk/Source/JavaScriptCore/bytecode/ExitKind.cpp

    r180279 r180703  
    6565    case ArgumentsEscaped:
    6666        return "ArgumentsEscaped";
     67    case ExoticObjectMode:
     68        return "ExoticObjectMode";
    6769    case NotStringObject:
    6870        return "NotStringObject";

  • trunk/Source/JavaScriptCore/bytecode/ExitKind.h

    r180279 r180703  
    4545    InadequateCoverage, // We exited because we ended up in code that didn't have profiling coverage.
    4646    ArgumentsEscaped, // We exited because arguments escaped but we didn't expect them to.
     47    ExoticObjectMode, // We exited because some exotic object that we were accessing was in an exotic mode (like Arguments with slow arguments).
    4748    NotStringObject, // We exited because we shouldn't have attempted to optimize string object access.
    4849    VarargsOverflow, // We exited because a varargs call passed more arguments than we expected.

  • trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

    r171380 r180703  
    11/*
    2  * Copyright (C) 2012, 2013, 2014 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    146146   
    147147    if (!isInt32Speculation(index))
     148        return ArrayMode(Array::Generic);
     149   
     150    // If we had exited because of an exotic object behavior, then don't try to specialize.
     151    if (graph.hasExitSite(node->origin.semantic, ExoticObjectMode))
    148152        return ArrayMode(Array::Generic);
    149153   

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r180691 r180703  
    920920            if (!node->child1()->shouldSpeculateCell())
    921921                break;
    922             StringImpl* impl = m_graph.identifiers()[node->identifierNumber()];
    923             if (impl == vm().propertyNames->length.impl()) {
    924                 attemptToMakeGetArrayLength(node);
    925                 break;
    926             }
    927             if (impl == vm().propertyNames->byteLength.impl()) {
    928                 attemptToMakeGetTypedArrayByteLength(node);
    929                 break;
    930             }
    931             if (impl == vm().propertyNames->byteOffset.impl()) {
    932                 attemptToMakeGetTypedArrayByteOffset(node);
    933                 break;
     922
     923            // If we hadn't exited because of BadCache, BadIndexingType, or ExoticObjectMode, then
     924            // leave this as a GetById.
     925            if (!m_graph.hasExitSite(node->origin.semantic, BadCache)
     926                && !m_graph.hasExitSite(node->origin.semantic, BadIndexingType)
     927                && !m_graph.hasExitSite(node->origin.semantic, ExoticObjectMode)) {
     928                StringImpl* impl = m_graph.identifiers()[node->identifierNumber()];
     929                if (impl == vm().propertyNames->length.impl()) {
     930                    attemptToMakeGetArrayLength(node);
     931                    break;
     932                }
     933                if (impl == vm().propertyNames->byteLength.impl()) {
     934                    attemptToMakeGetTypedArrayByteLength(node);
     935                    break;
     936                }
     937                if (impl == vm().propertyNames->byteOffset.impl()) {
     938                    attemptToMakeGetTypedArrayByteOffset(node);
     939                    break;
     940                }
    934941            }
    935942            fixEdge<CellUse>(node->child1());

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r180587 r180703  
    41144114    // Two really lame checks.
    41154115    speculationCheck(
    4116         Uncountable, JSValueSource(), 0,
     4116        ExoticObjectMode, JSValueSource(), 0,
    41174117        m_jit.branch32(
    41184118            MacroAssembler::AboveOrEqual, propertyReg,
    41194119            MacroAssembler::Address(baseReg, Arguments::offsetOfNumArguments())));
    41204120    speculationCheck(
    4121         Uncountable, JSValueSource(), 0,
     4121        ExoticObjectMode, JSValueSource(), 0,
    41224122        m_jit.branchTestPtr(
    41234123            MacroAssembler::NonZero,
    … …  
    41694169   
    41704170    speculationCheck(
    4171         Uncountable, JSValueSource(), 0,
     4171        ExoticObjectMode, JSValueSource(), 0,
    41724172        m_jit.branchTest8(
    41734173            MacroAssembler::NonZero,
Note: See TracChangeset for help on using the changeset viewer.