⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 201532 in webkit


Ignore:
Timestamp:
May 31, 2016, 3:35:23 PM (10 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r201363 and r201456.
​https://bugs.webkit.org/show_bug.cgi?id=158240

"40% regression on date-format-xparb" (Requested by
keith_miller on #webkit).

Reverted changesets:

"LLInt should be able to cache prototype loads for values in
GetById"
​https://bugs.webkit.org/show_bug.cgi?id=158032
​http://trac.webkit.org/changeset/201363

"get_by_id should support caching unset properties in the
LLInt"
​https://bugs.webkit.org/show_bug.cgi?id=158136
​http://trac.webkit.org/changeset/201456

Location:
trunk/Source
Files:
3 deleted
20 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r201495 r201532  
    203203    bytecode/InlineCallFrameSet.cpp
    204204    bytecode/JumpTable.cpp
    205     bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
    206205    bytecode/LazyOperandValueProfile.cpp
    207206    bytecode/MethodOfGettingAValueProfile.cpp

  • trunk/Source/JavaScriptCore/ChangeLog

    r201531 r201532  
     12016-05-31  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r201363 and r201456.
     4        https://bugs.webkit.org/show_bug.cgi?id=158240
     5
     6        "40% regression on date-format-xparb" (Requested by
     7        keith_miller on #webkit).
     8
     9        Reverted changesets:
     10
     11        "LLInt should be able to cache prototype loads for values in
     12        GetById"
     13        https://bugs.webkit.org/show_bug.cgi?id=158032
     14        http://trac.webkit.org/changeset/201363
     15
     16        "get_by_id should support caching unset properties in the
     17        LLInt"
     18        https://bugs.webkit.org/show_bug.cgi?id=158136
     19        http://trac.webkit.org/changeset/201456
     20
    1212016-05-31  Commit Queue  <commit-queue@webkit.org>
    222

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r201495 r201532  
    11881188                53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */; };
    11891189                53F6BF6D1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
    1190                 53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
    1191                 53FA2AE31CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */; };
    11921190                5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
    11931191                5DBB151B131D0B310056AD36 /* testapi.js in Copy Support Script */ = {isa = PBXBuildFile; fileRef = 14D857740A4696C80032146C /* testapi.js */; };
    … …  
    33313329                53F256E11B87E28000B4B768 /* JSTypedArrayViewPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTypedArrayViewPrototype.cpp; sourceTree = "<group>"; };
    33323330                53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InternalFunctionAllocationProfile.h; sourceTree = "<group>"; };
    3333                 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.h; sourceTree = "<group>"; };
    3334                 53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp; sourceTree = "<group>"; };
    33353331                593D43CCA0BBE06D89C59707 /* MapDataInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapDataInlines.h; sourceTree = "<group>"; };
    33363332                5BD3A0611CAE325700F84BA3 /* AsyncFunctionConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncFunctionConstructor.cpp; sourceTree = "<group>"; };
    … …  
    66026598                                0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */,
    66036599                                0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */,
    6604                                 53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */,
    6605                                 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */,
    66066600                                0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */,
    66076601                                0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */,
    … …  
    79427936                                BC18C4550E16F5CD00B34460 /* PropertySlot.h in Headers */,
    79437937                                0FB7F39C15ED8E4600F167B2 /* PropertyStorage.h in Headers */,
    7944                                 53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */,
    79457938                                BC18C4560E16F5CD00B34460 /* Protect.h in Headers */,
    79467939                                1474C33B16AA2D950062F01D /* PrototypeMap.h in Headers */,
    … …  
    86708663                                65C0285C1717966800351E35 /* ARMv7DOpcode.cpp in Sources */,
    86718664                                0F8335B71639C1E6001443B5 /* ArrayAllocationProfile.cpp in Sources */,
    8672                                 53FA2AE31CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp in Sources */,
    86738665                                A7A8AF3417ADB5F3005AB174 /* ArrayBuffer.cpp in Sources */,
    86748666                                0FFC99D4184EE318009C10AB /* ArrayBufferNeuteringWatchpoint.cpp in Sources */,

  • trunk/Source/JavaScriptCore/bytecode/BytecodeList.json

    r201487 r201532  
    5959            { "name" : "op_is_function", "length" : 3 },
    6060            { "name" : "op_in", "length" : 4 },
    61             { "name" : "op_get_array_length", "length" : 9 },
     61            { "name" : "op_try_get_by_id", "length" : 4 },
    6262            { "name" : "op_get_by_id", "length" : 9  },
    63             { "name" : "op_get_by_id_proto_load", "length" : 9 },
    64             { "name" : "op_get_by_id_unset", "length" : 9 },
    6563            { "name" : "op_get_by_id_with_this", "length" : 5 },
    6664            { "name" : "op_get_by_val_with_this", "length" : 5 },
    67             { "name" : "op_try_get_by_id", "length" : 4 },
     65            { "name" : "op_get_array_length", "length" : 9 },
    6866            { "name" : "op_put_by_id", "length" : 9 },
    6967            { "name" : "op_put_by_id_with_this", "length" : 5 },

  • trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h

    r201487 r201532  
    159159    case op_try_get_by_id:
    160160    case op_get_by_id:
    161     case op_get_by_id_proto_load:
    162     case op_get_by_id_unset:
    163161    case op_get_array_length:
    164162    case op_typeof:
    … …  
    397395    case op_try_get_by_id:
    398396    case op_get_by_id:
    399     case op_get_by_id_proto_load:
    400     case op_get_by_id_unset:
    401397    case op_get_by_id_with_this:
    402398    case op_get_by_val_with_this:

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r201531 r201532  
    5151#include "JSModuleEnvironment.h"
    5252#include "LLIntEntrypoint.h"
    53 #include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
    5453#include "LowLevelInterpreter.h"
    5554#include "JSCInlines.h"
    … …  
    347346        op = "get_by_id";
    348347        break;
    349     case op_get_by_id_proto_load:
    350         op = "get_by_id_proto_load";
    351         break;
    352     case op_get_by_id_unset:
    353         op = "get_by_id_unset";
    354         break;
    355348    case op_get_array_length:
    356349        op = "array_length";
    … …  
    413406        dumpStructure(out, "struct", structure, ident);
    414407        out.printf(")");
    415         if (exec->interpreter()->getOpcodeID(instruction[0].u.opcode) == op_get_by_id_proto_load)
    416             out.printf(" proto(%p)", instruction[6].u.pointer);
    417408    }
    418409
    … …  
    11221113        }
    11231114        case op_get_by_id:
    1124         case op_get_by_id_proto_load:
    1125         case op_get_by_id_unset:
    11261115        case op_get_array_length: {
    11271116            printGetByIdOp(out, exec, location, it);
    … …  
    27742763        Instruction* curInstruction = &instructions()[propertyAccessInstructions[i]];
    27752764        switch (interpreter->getOpcodeID(curInstruction[0].u.opcode)) {
    2776         case op_get_by_id:
    2777         case op_get_by_id_proto_load:
    2778         case op_get_by_id_unset: {
     2765        case op_get_by_id: {
    27792766            StructureID oldStructureID = curInstruction[4].u.structureID;
    27802767            if (!oldStructureID || Heap::isMarked(m_vm->heap.structureIDTable().get(oldStructureID)))
    … …  
    27822769            if (Options::verboseOSR())
    27832770                dataLogF("Clearing LLInt property access.\n");
    2784             clearLLIntGetByIdCache(curInstruction);
     2771            curInstruction[4].u.structureID = 0;
     2772            curInstruction[5].u.operand = 0;
    27852773            break;
    27862774        }
    … …  
    28552843        }
    28562844    }
    2857 
    2858     // We can't just remove all the sets when we clear the caches since we might have created a watchpoint set
    2859     // then cleared the cache without GCing in between.
    2860     m_llintGetByIdWatchpointMap.removeIf([](const StructureWatchpointMap::KeyValuePairType& pair) -> bool {
    2861         return !Heap::isMarked(pair.key);
    2862     });
    28632845
    28642846    for (unsigned i = 0; i < m_llintCallLinkInfos.size(); ++i) {

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

    r201363 r201532  
    5757#include "JumpTable.h"
    5858#include "LLIntCallLinkInfo.h"
    59 #include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
    6059#include "LazyOperandValueProfile.h"
    6160#include "ObjectAllocationProfile.h"
    … …  
    679678        return m_llintExecuteCounter;
    680679    }
    681 
    682     typedef HashMap<Structure*, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>> StructureWatchpointMap;
    683     StructureWatchpointMap& llintGetByIdWatchpointMap() { return m_llintGetByIdWatchpointMap; }
    684680
    685681    // Functions for controlling when tiered compilation kicks in. This
    … …  
    10241020    RefCountedArray<LLIntCallLinkInfo> m_llintCallLinkInfos;
    10251021    SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo>> m_incomingLLIntCalls;
    1026     StructureWatchpointMap m_llintGetByIdWatchpointMap;
    10271022    RefPtr<JITCode> m_jitCode;
    10281023#if ENABLE(JIT)
    … …  
    13151310#endif
    13161311
    1317 inline void clearLLIntGetByIdCache(Instruction* instruction)
    1318 {
    1319     instruction[0].u.opcode = LLInt::getOpcode(op_get_by_id);
    1320     instruction[4].u.pointer = nullptr;
    1321     instruction[5].u.pointer = nullptr;
    1322     instruction[6].u.pointer = nullptr;
    1323 }
    1324 
    13251312inline Register& ExecState::r(int index)
    13261313{

  • trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp

    r201456 r201532  
    7676   
    7777    Instruction* instruction = profiledBlock->instructions().begin() + bytecodeIndex;
    78 
    79     Opcode opcode = instruction[0].u.opcode;
    80 
    81     ASSERT(opcode == LLInt::getOpcode(op_get_array_length) || opcode == LLInt::getOpcode(op_try_get_by_id) || opcode == LLInt::getOpcode(op_get_by_id_proto_load) || opcode == LLInt::getOpcode(op_get_by_id) || opcode == LLInt::getOpcode(op_get_by_id_unset));
    82 
    83     // FIXME: We should not just bail if we see a try_get_by_id or a get_by_id_proto_load.
    84     // https://bugs.webkit.org/show_bug.cgi?id=158039
    85     if (opcode != LLInt::getOpcode(op_get_by_id))
     78   
     79    if (instruction[0].u.opcode == LLInt::getOpcode(op_get_array_length) || instruction[0].u.opcode == LLInt::getOpcode(op_try_get_by_id))
    8680        return GetByIdStatus(NoInformation, false);
    8781

  • trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp

    r201445 r201532  
    168168}
    169169
    170 bool ObjectPropertyConditionSet::isValidAndWatchable() const
    171 {
    172     if (!isValid())
    173         return false;
    174 
    175     for (ObjectPropertyCondition condition : m_data->vector) {
    176         if (!condition.isWatchable())
    177             return false;
    178     }
    179     return true;
    180 }
    181 
    182170namespace {
    183171
    … …  
    267255        // treated as a dictionary.
    268256        if (structure->isDictionary()) {
    269             if (concurrency == MainThread) {
    270                 if (verbose)
    271                     dataLog("Flattening ", pointerDump(structure));
     257            if (concurrency == MainThread)
    272258                structure->flattenDictionaryStructure(vm, object);
    273             } else {
     259            else {
    274260                if (verbose)
    275261                    dataLog("Cannot flatten dictionary when not on main thread, so invalid.\n");

  • trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h

    r201363 r201532  
    6868        return !m_data || !m_data->vector.isEmpty();
    6969    }
    70 
    71     bool isValidAndWatchable() const;
    7270   
    7371    bool isEmpty() const

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r201487 r201532  
    25002500    instructions().append(0);
    25012501    instructions().append(0);
    2502     instructions().append(Options::prototypeHitCountForLLIntCaching());
     2502    instructions().append(0);
    25032503    instructions().append(profile);
    25042504    return dst;

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r201487 r201532  
    40824082
    40834083        case op_get_by_id:
    4084         case op_get_by_id_proto_load:
    4085         case op_get_by_id_unset:
    40864084        case op_get_array_length: {
    40874085            SpeculatedType prediction = getPrediction();

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r201487 r201532  
    155155    case op_try_get_by_id:
    156156    case op_get_by_id:
    157     case op_get_by_id_proto_load:
    158     case op_get_by_id_unset:
    159157    case op_get_by_id_with_this:
    160158    case op_get_by_val_with_this:

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r201487 r201532  
    241241        DEFINE_OP(op_try_get_by_id)
    242242        case op_get_array_length:
    243         case op_get_by_id_proto_load:
    244         case op_get_by_id_unset:
    245243        DEFINE_OP(op_get_by_id)
    246244        DEFINE_OP(op_get_by_id_with_this)
    … …  
    426424        DEFINE_SLOWCASE_OP(op_try_get_by_id)
    427425        case op_get_array_length:
    428         case op_get_by_id_proto_load:
    429         case op_get_by_id_unset:
    430426        DEFINE_SLOWCASE_OP(op_get_by_id)
    431427        DEFINE_SLOWCASE_OP(op_get_by_val)

  • trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r201487 r201532  
    5454#include "LowLevelInterpreter.h"
    5555#include "ObjectConstructor.h"
    56 #include "ObjectPropertyConditionSet.h"
    5756#include "ProtoCallFrame.h"
    5857#include "ShadowChicken.h"
    … …  
    583582}
    584583
    585 static void setupGetByIdPrototypeCache(ExecState* exec, VM& vm, Instruction* pc, JSCell* baseCell, PropertySlot& slot, const Identifier& ident)
    586 {
    587     CodeBlock* codeBlock = exec->codeBlock();
    588     Structure* structure = baseCell->structure();
    589 
    590     if (structure->typeInfo().prohibitsPropertyCaching() || structure->isDictionary())
    591         return;
    592 
    593     ObjectPropertyConditionSet conditions;
    594     if (slot.isUnset())
    595         conditions = generateConditionsForPropertyMiss(vm, codeBlock, exec, structure, ident.impl());
    596     else
    597         conditions = generateConditionsForPrototypePropertyHit(vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
    598 
    599     if (!conditions.isValid())
    600         return;
    601 
    602     PropertyOffset offset = invalidOffset;
    603     CodeBlock::StructureWatchpointMap& watchpointMap = codeBlock->llintGetByIdWatchpointMap();
    604     auto result = watchpointMap.add(structure, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>());
    605     for (ObjectPropertyCondition condition : conditions) {
    606         if (!condition.isWatchable())
    607             return;
    608         if (condition.condition().kind() == PropertyCondition::Presence)
    609             offset = condition.condition().offset();
    610         result.iterator->value.add(condition, pc)->install();
    611     }
    612     ASSERT((offset == invalidOffset) == slot.isUnset());
    613 
    614     ConcurrentJITLocker locker(codeBlock->m_lock);
    615 
    616     if (slot.isUnset()) {
    617         pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_unset);
    618         pc[4].u.structureID = structure->id();
    619         return;
    620     }
    621     ASSERT(slot.isValue());
    622 
    623     pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_proto_load);
    624     pc[4].u.structureID = structure->id();
    625     pc[5].u.operand = offset;
    626     // We know that this pointer will remain valid because it will be cleared by either a watchpoint fire or
    627     // during GC when we clear the LLInt caches.
    628     pc[6].u.pointer = slot.slotBase();
    629 }
    630 
    631 
    632584LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
    633585{
    … …  
    644596    if (!LLINT_ALWAYS_ACCESS_SLOW
    645597        && baseValue.isCell()
    646         && slot.isCacheable()) {
    647 
     598        && slot.isCacheable()
     599        && slot.slotBase() == baseValue
     600        && slot.isCacheableValue()) {
     601       
    648602        JSCell* baseCell = baseValue.asCell();
    649603        Structure* structure = baseCell->structure();
    650         if (slot.isValue() && slot.slotBase() == baseValue) {
    651             // Start out by clearing out the old cache.
    652             pc[0].u.opcode = LLInt::getOpcode(op_get_by_id);
    653             pc[4].u.pointer = nullptr; // old structure
    654             pc[5].u.pointer = nullptr; // offset
    655 
    656             // Prevent the prototype cache from ever happening.
    657             pc[7].u.operand = 0;
    658604       
    659             if (structure->propertyAccessesAreCacheable()) {
    660                 vm.heap.writeBarrier(codeBlock);
    661                
    662                 ConcurrentJITLocker locker(codeBlock->m_lock);
    663 
    664                 pc[4].u.structureID = structure->id();
    665                 pc[5].u.operand = slot.cachedOffset();
    666             }
    667         } else if (UNLIKELY(pc[7].u.operand && (slot.isValue() || slot.isUnset()))) {
    668             ASSERT(slot.slotBase() != baseValue);
    669 
    670             if (!(--pc[7].u.operand))
    671                 setupGetByIdPrototypeCache(exec, vm, pc, baseCell, slot, ident);
     605        // Start out by clearing out the old cache.
     606        pc[0].u.opcode = LLInt::getOpcode(op_get_by_id);
     607        pc[4].u.pointer = nullptr; // old structure
     608        pc[5].u.pointer = nullptr; // offset
     609       
     610        if (!structure->isUncacheableDictionary()
     611            && !structure->typeInfo().prohibitsPropertyCaching()
     612            && !structure->typeInfo().newImpurePropertyFiresWatchpoints()) {
     613            vm.heap.writeBarrier(codeBlock);
     614           
     615            ConcurrentJITLocker locker(codeBlock->m_lock);
     616
     617            pc[4].u.structureID = structure->id();
     618            pc[5].u.operand = slot.cachedOffset();
    672619        }
    673     } else if (!LLINT_ALWAYS_ACCESS_SLOW
     620    }
     621
     622    if (!LLINT_ALWAYS_ACCESS_SLOW
    674623        && isJSArray(baseValue)
    675624        && ident == exec->propertyNames().length) {
    … …  
    678627        arrayProfile->observeStructure(baseValue.asCell()->structure());
    679628        pc[4].u.arrayProfile = arrayProfile;
    680 
    681         // Prevent the prototype cache from ever happening.
    682         pc[7].u.operand = 0;
    683629    }
    684630

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r201456 r201532  
    13351335
    13361336# We only do monomorphic get_by_id caching for now, and we do not modify the
    1337 # opcode for own properties. We also allow for the cache to change anytime it fails,
    1338 # since ping-ponging is free. At best we get lucky and the get_by_id will continue
     1337# opcode. We do, however, allow for the cache to change anytime if fails, since
     1338# ping-ponging is free. At best we get lucky and the get_by_id will continue
    13391339# to take fast path on the new cache. At worst we take slow path, which is what
    1340 # we would have been doing anyway. For prototype/unset properties, we will attempt to
    1341 # convert opcode into a get_by_id_proto_load/get_by_id_unset, respectively, after an
    1342 # execution counter hits zero.
     1340# we would have been doing anyway.
    13431341
    13441342_llint_op_get_by_id:
    … …  
    13571355
    13581356.opGetByIdSlow:
    1359     callSlowPath(_llint_slow_path_get_by_id)
    1360     dispatch(9)
    1361 
    1362 
    1363 _llint_op_get_by_id_proto_load:
    1364     traceExecution()
    1365     loadi 8[PC], t0
    1366     loadi 16[PC], t1
    1367     loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdProtoSlow)
    1368     loadi 20[PC], t2
    1369     bineq JSCell::m_structureID[t3], t1, .opGetByIdProtoSlow
    1370     loadpFromInstruction(6, t3)
    1371     loadPropertyAtVariableOffset(t2, t3, t0, t1)
    1372     loadi 4[PC], t2
    1373     storei t0, TagOffset[cfr, t2, 8]
    1374     storei t1, PayloadOffset[cfr, t2, 8]
    1375     valueProfile(t0, t1, 32, t2)
    1376     dispatch(9)
    1377 
    1378 .opGetByIdProtoSlow:
    1379     callSlowPath(_llint_slow_path_get_by_id)
    1380     dispatch(9)
    1381 
    1382 
    1383 _llint_op_get_by_id_unset:
    1384     traceExecution()
    1385     loadi 8[PC], t0
    1386     loadi 16[PC], t1
    1387     loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdUnsetSlow)
    1388     bineq JSCell::m_structureID[t3], t1, .opGetByIdUnsetSlow
    1389     loadi 4[PC], t2
    1390     storei UndefinedTag, TagOffset[cfr, t2, 8]
    1391     storei 0, PayloadOffset[cfr, t2, 8]
    1392     valueProfile(UndefinedTag, 0, 32, t2)
    1393     dispatch(9)
    1394 
    1395 .opGetByIdUnsetSlow:
    13961357    callSlowPath(_llint_slow_path_get_by_id)
    13971358    dispatch(9)

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r201456 r201532  
    12331233
    12341234
    1235 _llint_op_get_by_id_proto_load:
    1236     traceExecution()
    1237     loadisFromInstruction(2, t0)
    1238     loadConstantOrVariableCell(t0, t3, .opGetByIdProtoSlow)
    1239     loadi JSCell::m_structureID[t3], t1
    1240     loadisFromInstruction(4, t2)
    1241     bineq t2, t1, .opGetByIdProtoSlow
    1242     loadisFromInstruction(5, t1)
    1243     loadpFromInstruction(6, t3)
    1244     loadisFromInstruction(1, t2)
    1245     loadPropertyAtVariableOffset(t1, t3, t0)
    1246     storeq t0, [cfr, t2, 8]
    1247     valueProfile(t0, 8, t1)
    1248     dispatch(9)
    1249 
    1250 .opGetByIdProtoSlow:
    1251     callSlowPath(_llint_slow_path_get_by_id)
    1252     dispatch(9)
    1253 
    1254 
    1255 _llint_op_get_by_id_unset:
    1256     traceExecution()
    1257     loadisFromInstruction(2, t0)
    1258     loadConstantOrVariableCell(t0, t3, .opGetByIdUnsetSlow)
    1259     loadi JSCell::m_structureID[t3], t1
    1260     loadisFromInstruction(4, t2)
    1261     bineq t2, t1, .opGetByIdUnsetSlow
    1262     loadisFromInstruction(1, t2)
    1263     storeq ValueUndefined, [cfr, t2, 8]
    1264     valueProfile(ValueUndefined, 8, t1)
    1265     dispatch(9)
    1266 
    1267 .opGetByIdUnsetSlow:
    1268     callSlowPath(_llint_slow_path_get_by_id)
    1269     dispatch(9)
    1270 
    1271 
    12721235_llint_op_get_array_length:
    12731236    traceExecution()

  • trunk/Source/JavaScriptCore/runtime/Options.h

    r201363 r201532  
    363363    v(bool, useICStats, false, Normal, nullptr) \
    364364    \
    365     v(unsigned, prototypeHitCountForLLIntCaching, 2, Normal, "Number of prototype property hits before caching a prototype in the LLInt. A count of 0 means never cache.") \
    366     \
    367365    v(bool, dumpModuleRecord, false, Normal, nullptr) \
    368366    v(bool, dumpModuleLoadingState, false, Normal, nullptr) \

  • trunk/Source/WTF/ChangeLog

    r201518 r201532  
     12016-05-31  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r201363 and r201456.
     4        https://bugs.webkit.org/show_bug.cgi?id=158240
     5
     6        "40% regression on date-format-xparb" (Requested by
     7        keith_miller on #webkit).
     8
     9        Reverted changesets:
     10
     11        "LLInt should be able to cache prototype loads for values in
     12        GetById"
     13        https://bugs.webkit.org/show_bug.cgi?id=158032
     14        http://trac.webkit.org/changeset/201363
     15
     16        "get_by_id should support caching unset properties in the
     17        LLInt"
     18        https://bugs.webkit.org/show_bug.cgi?id=158136
     19        http://trac.webkit.org/changeset/201456
     20
    1212016-05-31  Brady Eidson  <beidson@apple.com>
    222

  • trunk/Source/WTF/wtf/Bag.h

    r201363 r201532  
    4949public:
    5050    Bag()
     51        : m_head(nullptr)
    5152    {
    52     }
    53 
    54     Bag(Bag<T>&& other)
    55     {
    56         ASSERT(!m_head);
    57         m_head = other.m_head;
    58         other.m_head = nullptr;
    59     }
    60 
    61     Bag& operator=(Bag<T>&& other)
    62     {
    63         m_head = other.m_head;
    64         other.m_head = nullptr;
    65         return *this;
    6653    }
    6754   
    … …  
    135122   
    136123private:
    137     Node* m_head { nullptr };
     124    Node* m_head;
    138125};
    139126
Note: See TracChangeset for help on using the changeset viewer.