Changeset 201573 in webkit

Timestamp:

Jun 1, 2016, 3:22:04 PM (10 years ago)

Author:

ggaren@apple.com

Message:

Unreviewed, rolling in r201436.
​https://bugs.webkit.org/show_bug.cgi?id=158143

r201562 should haved fixed the Dromaeo DOM core regression.

Restored changeset:

"REGRESSION: JSBench spends a lot of time transitioning
to/from dictionary"
​https://bugs.webkit.org/show_bug.cgi?id=158045
​http://trac.webkit.org/changeset/201436

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/ObjectPropertyConditionSet.cpp (modified) (1 diff)
• interpreter/Interpreter.cpp (modified) (3 diffs)
• runtime/BatchedTransitionOptimizer.h (modified) (1 diff)
• runtime/JSGlobalObject.cpp (modified) (1 diff)
• runtime/Operations.cpp (modified) (1 diff)
• runtime/Operations.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-06-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Unreviewed, rolling in r201436.
+        https://bugs.webkit.org/show_bug.cgi?id=158143
+
+        r201562 should haved fixed the Dromaeo DOM core regression.
+
+        Restored changeset:
+
+        "REGRESSION: JSBench spends a lot of time transitioning
+        to/from dictionary"
+        https://bugs.webkit.org/show_bug.cgi?id=158045
+        http://trac.webkit.org/changeset/201436
+
+
 2016-06-01  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp

@@ -252 +252 @@
         structure = object->structure(vm);
         
-        // Since we're accessing a prototype repeatedly, it's a good bet that it should not be
-        // treated as a dictionary.
         if (structure->isDictionary()) {
-            if (concurrency == MainThread)
+            if (concurrency == MainThread) {
+                if (structure->hasBeenFlattenedBefore()) {
+                    if (verbose)
+                        dataLog("Dictionary has been flattened before, so invalid.\n");
+                    return ObjectPropertyConditionSet::invalid();
+                }
+
+                if (verbose)
+                    dataLog("Flattening ", pointerDump(structure));
                 structure->flattenDictionaryStructure(vm, object);
-            else {
+            } else {
                 if (verbose)
                     dataLog("Cannot flatten dictionary when not on main thread, so invalid.\n");

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -942 +942 @@
         return throwTerminatedExecutionException(callFrame);
 
+    if (scope->structure()->isUncacheableDictionary())
+        scope->flattenDictionaryObject(vm);
+
     ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.
 
@@ -1190 +1193 @@
     }
 
+    if (variableObject->structure()->isUncacheableDictionary())
+        variableObject->flattenDictionaryObject(vm);
+
     if (numVariables || numFunctions) {
         BatchedTransitionOptimizer optimizer(vm, variableObject);
@@ -1246 +1252 @@
     if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
         return throwTerminatedExecutionException(callFrame);
+
+    if (scope->structure()->isUncacheableDictionary())
+        scope->flattenDictionaryObject(vm);
 
     ASSERT(codeBlock->numParameters() == 1); // 1 parameter for 'this'.

trunk/Source/JavaScriptCore/runtime/BatchedTransitionOptimizer.h

@@ -36 +36 @@
 public:
     BatchedTransitionOptimizer(VM& vm, JSObject* object)
-        : m_vm(&vm)
-        , m_object(object)
     {
-        if (!m_object->structure(vm)->isDictionary())
-            m_object->convertToDictionary(vm);
+        if (!object->structure(vm)->isDictionary())
+            object->convertToDictionary(vm);
     }
-
-    ~BatchedTransitionOptimizer()
-    {
-        if (m_object->structure()->isDictionary())
-            m_object->flattenDictionaryObject(*m_vm);
-    }
-
-private:
-    VM* m_vm;
-    JSObject* m_object;
 };
 

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

@@ -320 +320 @@
     ASSERT(vm.currentThreadIsHoldingAPILock());
 
+    Base::setStructure(vm, Structure::toCacheableDictionaryTransition(vm, structure()));
+
     JSGlobalObject::globalExec()->init(0, 0, CallFrame::noCaller(), 0, 0);
 

trunk/Source/JavaScriptCore/runtime/Operations.cpp

@@ -121 +121 @@
 }
 
+size_t normalizePrototypeChain(CallFrame* callFrame, Structure* structure)
+{
+    VM& vm = callFrame->vm();
+    size_t count = 0;
+    while (1) {
+        if (structure->isProxy())
+            return InvalidPrototypeChain;
+        JSValue v = structure->prototypeForLookup(callFrame);
+        if (v.isNull())
+            return count;
+
+        JSCell* base = v.asCell();
+        structure = base->structure(vm);
+        if (structure->isDictionary()) {
+            if (structure->hasBeenFlattenedBefore())
+                return InvalidPrototypeChain;
+            structure->flattenDictionaryStructure(vm, asObject(base));
+        }
+
+        ++count;
+    }
+}
+
 } // namespace JSC

trunk/Source/JavaScriptCore/runtime/Operations.h

@@ -28 +28 @@
 
 namespace JSC {
+
+#define InvalidPrototypeChain (std::numeric_limits<size_t>::max())
 
 NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
@@ -34 +36 @@
 bool jsIsObjectTypeOrNull(CallFrame*, JSValue);
 bool jsIsFunctionType(JSValue);
+size_t normalizePrototypeChain(CallFrame*, Structure*);
 
 ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
@@ -193 +196 @@
 }
 
-#define InvalidPrototypeChain (std::numeric_limits<size_t>::max())
-
-inline size_t normalizePrototypeChain(CallFrame* callFrame, Structure* structure)
-{
-    VM& vm = callFrame->vm();
-    size_t count = 0;
-    while (1) {
-        if (structure->isProxy())
-            return InvalidPrototypeChain;
-        JSValue v = structure->prototypeForLookup(callFrame);
-        if (v.isNull())
-            return count;
-
-        JSCell* base = v.asCell();
-        structure = base->structure(vm);
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (structure->isDictionary())
-            structure->flattenDictionaryStructure(vm, asObject(base));
-
-        ++count;
-    }
-}
-
 } // namespace JSC