Changeset 231316 in webkit


Ignore:
Timestamp:
May 3, 2018 11:18:34 AM (6 years ago)
Author:
keith_miller@apple.com
Message:

Remove the prototype caching for get_by_id in the LLInt
​https://bugs.webkit.org/show_bug.cgi?id=185226

Reviewed by Michael Saboff.

There is no evidence that this is actually a speedup and we keep
getting bugs with it. At this point it seems like we should just
remove this code.

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • bytecode/BytecodeDumper.cpp:

(JSC::BytecodeDumper<Block>::printGetByIdOp):
(JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
(JSC::BytecodeDumper<Block>::dumpBytecode):

  • bytecode/BytecodeList.json:
  • bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

  • bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finalizeLLIntInlineCaches):

  • bytecode/CodeBlock.h:

(JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.

  • bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFromLLInt):

  • bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp: Removed.
  • bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h: Removed.
  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitGetById):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

  • jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::setupGetByIdPrototypeCache): Deleted.

  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • runtime/Options.h:
Location:
trunk/Source/JavaScriptCore
Files:
2 deleted
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r231301 r231316  
    449449    bytecode/JumpTable.h
    450450    bytecode/LLIntCallLinkInfo.h
    451     bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h
    452451    bytecode/LazyOperandValueProfile.h
    453452    bytecode/ObjectAllocationProfile.h

  • trunk/Source/JavaScriptCore/ChangeLog

    r231310 r231316  
     12018-05-03  Keith Miller  <keith_miller@apple.com>
     2
     3        Remove the prototype caching for get_by_id in the LLInt
     4        https://bugs.webkit.org/show_bug.cgi?id=185226
     5
     6        Reviewed by Michael Saboff.
     7
     8        There is no evidence that this is actually a speedup and we keep
     9        getting bugs with it. At this point it seems like we should just
     10        remove this code.
     11
     12        * CMakeLists.txt:
     13        * JavaScriptCore.xcodeproj/project.pbxproj:
     14        * Sources.txt:
     15        * bytecode/BytecodeDumper.cpp:
     16        (JSC::BytecodeDumper<Block>::printGetByIdOp):
     17        (JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
     18        (JSC::BytecodeDumper<Block>::dumpBytecode):
     19        * bytecode/BytecodeList.json:
     20        * bytecode/BytecodeUseDef.h:
     21        (JSC::computeUsesForBytecodeOffset):
     22        (JSC::computeDefsForBytecodeOffset):
     23        * bytecode/CodeBlock.cpp:
     24        (JSC::CodeBlock::finalizeLLIntInlineCaches):
     25        * bytecode/CodeBlock.h:
     26        (JSC::CodeBlock::llintGetByIdWatchpointMap): Deleted.
     27        * bytecode/GetByIdStatus.cpp:
     28        (JSC::GetByIdStatus::computeFromLLInt):
     29        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp: Removed.
     30        * bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h: Removed.
     31        * bytecompiler/BytecodeGenerator.cpp:
     32        (JSC::BytecodeGenerator::emitGetById):
     33        * dfg/DFGByteCodeParser.cpp:
     34        (JSC::DFG::ByteCodeParser::parseBlock):
     35        * dfg/DFGCapabilities.cpp:
     36        (JSC::DFG::capabilityLevel):
     37        * jit/JIT.cpp:
     38        (JSC::JIT::privateCompileMainPass):
     39        (JSC::JIT::privateCompileSlowCases):
     40        * llint/LLIntSlowPaths.cpp:
     41        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
     42        (JSC::LLInt::setupGetByIdPrototypeCache): Deleted.
     43        * llint/LowLevelInterpreter32_64.asm:
     44        * llint/LowLevelInterpreter64.asm:
     45        * runtime/Options.h:
     46
    1472018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
    248

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r231194 r231316  
    10361036                53F6BF6D1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
    10371037                53F8D2001E8387D400D21116 /* WasmBBQPlanInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F8D1FF1E8387D400D21116 /* WasmBBQPlanInlines.h */; };
    1038                 53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
    10391038                53FD04D41D7AB291003287D3 /* WasmCallingConvention.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */; settings = {ATTRIBUTES = (Private, ); }; };
    10401039                53FF7F991DBFCD9000A26CCC /* WasmValidate.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FF7F981DBFCD9000A26CCC /* WasmValidate.h */; };
    … …  
    34593458                53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InternalFunctionAllocationProfile.h; sourceTree = "<group>"; };
    34603459                53F8D1FF1E8387D400D21116 /* WasmBBQPlanInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmBBQPlanInlines.h; sourceTree = "<group>"; };
    3461                 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.h; sourceTree = "<group>"; };
    3462                 53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp; sourceTree = "<group>"; };
    34633460                53FD04D11D7AB187003287D3 /* WasmCallingConvention.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmCallingConvention.cpp; sourceTree = "<group>"; };
    34643461                53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmCallingConvention.h; sourceTree = "<group>"; };
    … …  
    66716668                                FE2B0B681FD0D2970075DA5F /* JSCPoison.cpp */,
    66726669                                FE2B0B701FD8C4630075DA5F /* JSCPoison.h */,
     6670                                FE7497E5209001B00003565B /* JSCPtrTag.h */,
    66736671                                72AAF7CB1D0D318B005E60BE /* JSCustomGetterSetterFunction.cpp */,
    66746672                                72AAF7CC1D0D318B005E60BE /* JSCustomGetterSetterFunction.h */,
    … …  
    67566754                                862553CE16136AA5009F17D0 /* JSProxy.cpp */,
    67576755                                862553CF16136AA5009F17D0 /* JSProxy.h */,
    6758                                 FE7497E5209001B00003565B /* JSCPtrTag.h */,
    67596756                                534638721E70D01500F12AC1 /* JSRunLoopTimer.cpp */,
    67606757                                534638701E70CF3D00F12AC1 /* JSRunLoopTimer.h */,
    … …  
    76357632                                0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */,
    76367633                                0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */,
    7637                                 53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */,
    7638                                 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */,
    76397634                                0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */,
    76407635                                0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */,
    … …  
    90018996                                148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
    90028997                                FE2B0B731FD9EF700075DA5F /* JSCPoison.h in Headers */,
     8998                                FE7497E6209001B10003565B /* JSCPtrTag.h in Headers */,
    90038999                                A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */,
    90049000                                72AAF7CE1D0D31B3005E60BE /* JSCustomGetterSetterFunction.h in Headers */,
    … …  
    90769072                                7C184E1F17BEE22E007CB63A /* JSPromisePrototype.h in Headers */,
    90779073                                996B731F1BDA08EF00331B84 /* JSPromisePrototype.lut.h in Headers */,
    9078                                 FE7497E6209001B10003565B /* JSCPtrTag.h in Headers */,
    90799074                                2A05ABD61961DF2400341750 /* JSPropertyNameEnumerator.h in Headers */,
    90809075                                862553D216136E1A009F17D0 /* JSProxy.h in Headers */,
    … …  
    91659160                                FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */,
    91669161                                79CFC6F01C33B10000C768EA /* LLIntPCRanges.h in Headers */,
    9167                                 53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */,
    91689162                                0F4680A514BA7F8D00BFE272 /* LLIntSlowPaths.h in Headers */,
    91699163                                0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */,

  • trunk/Source/JavaScriptCore/Sources.txt

    r231047 r231316  
    226226bytecode/IntrinsicGetterAccessCase.cpp
    227227bytecode/JumpTable.cpp
    228 bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
    229228bytecode/LazyOperandValueProfile.cpp
    230229bytecode/MethodOfGettingAValueProfile.cpp

  • trunk/Source/JavaScriptCore/bytecode/BytecodeDumper.cpp

    r230376 r231316  
    378378        op = "get_by_id";
    379379        break;
    380     case op_get_by_id_proto_load:
    381         op = "get_by_id_proto_load";
    382         break;
    383     case op_get_by_id_unset:
    384         op = "get_by_id_unset";
    385         break;
    386380    case op_get_array_length:
    387381        op = "array_length";
    … …  
    398392    printLocationAndOp(out, location, it, op);
    399393    out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), idName(id0, identifier(id0)).data());
    400     it += 4; // Increment up to the value profiler.
     394    it += 3; // Increment up to the value profiler.
    401395}
    402396
    … …  
    443437        dumpStructure(out, "struct", structure, ident);
    444438        out.printf(")");
    445         if (Interpreter::getOpcodeID(instruction[0]) == op_get_by_id_proto_load)
    446             out.printf(" proto(%p)", getPointer(instruction[6]));
    447439    }
    448440
    … …  
    10391031    }
    10401032    case op_get_by_id:
    1041     case op_get_by_id_proto_load:
    1042     case op_get_by_id_unset:
    10431033    case op_get_array_length: {
    10441034        printGetByIdOp(out, location, it);

  • trunk/Source/JavaScriptCore/bytecode/BytecodeList.json

    r230376 r231316  
    8282            { "name" : "op_is_cell_with_type", "length" : 4 },
    8383            { "name" : "op_in", "length" : 5 },
    84             { "name" : "op_get_array_length", "length" : 9 },
    85             { "name" : "op_get_by_id", "length" : 9  },
    86             { "name" : "op_get_by_id_proto_load", "length" : 9 },
    87             { "name" : "op_get_by_id_unset", "length" : 9 },
     84            { "name" : "op_get_array_length", "length" : 8 },
     85            { "name" : "op_get_by_id", "length" : 8  },
    8886            { "name" : "op_get_by_id_with_this", "length" : 6 },
    8987            { "name" : "op_get_by_val_with_this", "length" : 6 },

  • trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h

    r230376 r231316  
    183183    case op_try_get_by_id:
    184184    case op_get_by_id:
    185     case op_get_by_id_proto_load:
    186     case op_get_by_id_unset:
    187185    case op_get_by_id_direct:
    188186    case op_get_array_length:
    … …  
    435433    case op_try_get_by_id:
    436434    case op_get_by_id:
    437     case op_get_by_id_proto_load:
    438     case op_get_by_id_unset:
    439435    case op_get_by_id_direct:
    440436    case op_get_by_id_with_this:

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r230748 r231316  
    6666#include "LLIntData.h"
    6767#include "LLIntEntrypoint.h"
    68 #include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
    6968#include "LowLevelInterpreter.h"
    7069#include "ModuleProgramCodeBlock.h"
    … …  
    12441243        Instruction* curInstruction = &instructions()[propertyAccessInstructions[i]];
    12451244        switch (Interpreter::getOpcodeID(curInstruction[0])) {
    1246         case op_get_by_id:
    1247         case op_get_by_id_proto_load:
    1248         case op_get_by_id_unset: {
     1245        case op_get_by_id: {
    12491246            StructureID oldStructureID = curInstruction[4].u.structureID;
    12501247            if (!oldStructureID || Heap::isMarked(vm.heap.structureIDTable().get(oldStructureID)))
    … …  
    13391336        }
    13401337    }
    1341 
    1342     // We can't just remove all the sets when we clear the caches since we might have created a watchpoint set
    1343     // then cleared the cache without GCing in between.
    1344     m_llintGetByIdWatchpointMap.removeIf([](const StructureWatchpointMap::KeyValuePairType& pair) -> bool {
    1345         return !Heap::isMarked(pair.key);
    1346     });
    13471338
    13481339    for (unsigned i = 0; i < m_llintCallLinkInfos.size(); ++i) {

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

    r230550 r231316  
    5555#include "JumpTable.h"
    5656#include "LLIntCallLinkInfo.h"
    57 #include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
    5857#include "LazyOperandValueProfile.h"
    5958#include "ModuleProgramExecutable.h"
    … …  
    628627    }
    629628
    630     typedef HashMap<Structure*, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>> StructureWatchpointMap;
    631     StructureWatchpointMap& llintGetByIdWatchpointMap() { return m_llintGetByIdWatchpointMap; }
    632 
    633629    // Functions for controlling when tiered compilation kicks in. This
    634630    // controls both when the optimizing compiler is invoked and when OSR
    … …  
    975971    RefCountedArray<LLIntCallLinkInfo> m_llintCallLinkInfos;
    976972    SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo>> m_incomingLLIntCalls;
    977     StructureWatchpointMap m_llintGetByIdWatchpointMap;
    978973    PoisonedRefPtr<CodeBlockPoison, JITCode> m_jitCode;
    979974#if ENABLE(JIT)

  • trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp

    r230748 r231316  
    105105
    106106    case op_get_array_length:
    107     case op_try_get_by_id:
    108     case op_get_by_id_proto_load:
    109     case op_get_by_id_unset: {
    110         // FIXME: We should not just bail if we see a try_get_by_id or a get_by_id_proto_load.
    111         // https://bugs.webkit.org/show_bug.cgi?id=158039
     107    case op_try_get_by_id: {
    112108        return GetByIdStatus(NoInformation, false);
    113109    }

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r230376 r231316  
    27042704    instructions().append(0);
    27052705    instructions().append(0);
    2706     instructions().append(Options::prototypeHitCountForLLIntCaching());
    27072706    instructions().append(profile);
    27082707    return dst;

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r231224 r231316  
    51395139        case op_try_get_by_id:
    51405140        case op_get_by_id:
    5141         case op_get_by_id_proto_load:
    5142         case op_get_by_id_unset:
    51435141        case op_get_array_length: {
    51445142            SpeculatedType prediction = getPrediction();

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r230376 r231316  
    165165    case op_try_get_by_id:
    166166    case op_get_by_id:
    167     case op_get_by_id_proto_load:
    168     case op_get_by_id_unset:
    169167    case op_get_by_id_with_this:
    170168    case op_get_by_id_direct:

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r231175 r231316  
    331331        DEFINE_OP(op_try_get_by_id)
    332332        case op_get_array_length:
    333         case op_get_by_id_proto_load:
    334         case op_get_by_id_unset:
    335333        DEFINE_OP(op_get_by_id)
    336334        DEFINE_OP(op_get_by_id_with_this)
    … …  
    510508        DEFINE_SLOWCASE_OP(op_try_get_by_id)
    511509        case op_get_array_length:
    512         case op_get_by_id_proto_load:
    513         case op_get_by_id_unset:
    514510        DEFINE_SLOWCASE_OP(op_get_by_id)
    515511        DEFINE_SLOWCASE_OP(op_get_by_id_with_this)

  • trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r230865 r231316  
    642642}
    643643
    644 
    645 static void setupGetByIdPrototypeCache(ExecState* exec, VM& vm, Instruction* pc, JSCell* baseCell, PropertySlot& slot, const Identifier& ident)
    646 {
    647     CodeBlock* codeBlock = exec->codeBlock();
    648     Structure* structure = baseCell->structure();
    649 
    650     if (structure->typeInfo().prohibitsPropertyCaching())
    651         return;
    652    
    653     if (structure->needImpurePropertyWatchpoint())
    654         return;
    655 
    656     if (structure->isDictionary()) {
    657         if (structure->hasBeenFlattenedBefore())
    658             return;
    659         structure->flattenDictionaryStructure(vm, jsCast<JSObject*>(baseCell));
    660     }
    661 
    662     ObjectPropertyConditionSet conditions;
    663     if (slot.isUnset())
    664         conditions = generateConditionsForPropertyMiss(vm, codeBlock, exec, structure, ident.impl());
    665     else
    666         conditions = generateConditionsForPrototypePropertyHit(vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
    667 
    668     if (!conditions.isValid())
    669         return;
    670 
    671     PropertyOffset offset = invalidOffset;
    672     CodeBlock::StructureWatchpointMap& watchpointMap = codeBlock->llintGetByIdWatchpointMap();
    673     auto result = watchpointMap.add(structure, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>());
    674     for (ObjectPropertyCondition condition : conditions) {
    675         if (!condition.isWatchable())
    676             return;
    677         if (condition.condition().kind() == PropertyCondition::Presence)
    678             offset = condition.condition().offset();
    679         result.iterator->value.add(condition, pc)->install();
    680     }
    681     ASSERT((offset == invalidOffset) == slot.isUnset());
    682 
    683     ConcurrentJSLocker locker(codeBlock->m_lock);
    684 
    685     if (slot.isUnset()) {
    686         pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_unset);
    687         pc[4].u.structureID = structure->id();
    688         return;
    689     }
    690     ASSERT(slot.isValue());
    691 
    692     pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_proto_load);
    693     pc[4].u.structureID = structure->id();
    694     pc[5].u.operand = offset;
    695     // We know that this pointer will remain valid because it will be cleared by either a watchpoint fire or
    696     // during GC when we clear the LLInt caches.
    697     pc[6].u.pointer = slot.slotBase();
    698 }
    699 
    700 
    701644LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
    702645{
    … …  
    719662            if (oldStructureID) {
    720663                auto opcode = Interpreter::getOpcodeID(pc[0]);
    721                 if (opcode == op_get_by_id
    722                     || opcode == op_get_by_id_unset
    723                     || opcode == op_get_by_id_proto_load) {
     664                if (opcode == op_get_by_id) {
    724665                    Structure* a = vm.heap.structureIDTable().get(oldStructureID);
    725666                    Structure* b = baseValue.asCell()->structure(vm);
    … …  
    740681            pc[4].u.pointer = nullptr; // old structure
    741682            pc[5].u.pointer = nullptr; // offset
    742 
    743             // Prevent the prototype cache from ever happening.
    744             pc[7].u.operand = 0;
    745683       
    746684            if (structure->propertyAccessesAreCacheable()
    … …  
    753691                pc[5].u.operand = slot.cachedOffset();
    754692            }
    755         } else if (UNLIKELY(pc[7].u.operand && (slot.isValue() || slot.isUnset()))) {
    756             ASSERT(slot.slotBase() != baseValue);
    757 
    758             if (!(--pc[7].u.operand))
    759                 setupGetByIdPrototypeCache(exec, vm, pc, baseCell, slot, ident);
    760693        }
    761694    } else if (!LLINT_ALWAYS_ACCESS_SLOW
    … …  
    766699        arrayProfile->observeStructure(baseValue.asCell()->structure());
    767700        pc[4].u.arrayProfile = arrayProfile;
    768 
    769         // Prevent the prototype cache from ever happening.
    770         pc[7].u.operand = 0;
    771701    }
    772702

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r230748 r231316  
    14271427    callSlowPath(_llint_slow_path_get_by_id)
    14281428    dispatch(constexpr op_get_by_id_length)
    1429 
    1430 
    1431 _llint_op_get_by_id_proto_load:
    1432     traceExecution()
    1433     loadi 8[PC], t0
    1434     loadi 16[PC], t1
    1435     loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdProtoSlow)
    1436     loadi 20[PC], t2
    1437     bineq JSCell::m_structureID[t3], t1, .opGetByIdProtoSlow
    1438     loadpFromInstruction(6, t3)
    1439     loadPropertyAtVariableOffset(t2, t3, t0, t1)
    1440     loadi 4[PC], t2
    1441     storei t0, TagOffset[cfr, t2, 8]
    1442     storei t1, PayloadOffset[cfr, t2, 8]
    1443     valueProfile(t0, t1, 32, t2)
    1444     dispatch(constexpr op_get_by_id_proto_load_length)
    1445 
    1446 .opGetByIdProtoSlow:
    1447     callSlowPath(_llint_slow_path_get_by_id)
    1448     dispatch(constexpr op_get_by_id_proto_load_length)
    1449 
    1450 
    1451 _llint_op_get_by_id_unset:
    1452     traceExecution()
    1453     loadi 8[PC], t0
    1454     loadi 16[PC], t1
    1455     loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdUnsetSlow)
    1456     bineq JSCell::m_structureID[t3], t1, .opGetByIdUnsetSlow
    1457     loadi 4[PC], t2
    1458     storei UndefinedTag, TagOffset[cfr, t2, 8]
    1459     storei 0, PayloadOffset[cfr, t2, 8]
    1460     valueProfile(UndefinedTag, 0, 32, t2)
    1461     dispatch(constexpr op_get_by_id_unset_length)
    1462 
    1463 .opGetByIdUnsetSlow:
    1464     callSlowPath(_llint_slow_path_get_by_id)
    1465     dispatch(constexpr op_get_by_id_unset_length)
    14661429
    14671430

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r230748 r231316  
    13431343    loadPropertyAtVariableOffset(t1, t3, t0)
    13441344    storeq t0, [cfr, t2, 8]
    1345     valueProfile(t0, 8, t1)
     1345    valueProfile(t0, constexpr (op_get_by_id_length - 1), t1)
    13461346    dispatch(constexpr op_get_by_id_length)
    13471347
    … …  
    13491349    callSlowPath(_llint_slow_path_get_by_id)
    13501350    dispatch(constexpr op_get_by_id_length)
    1351 
    1352 
    1353 _llint_op_get_by_id_proto_load:
    1354     traceExecution()
    1355     loadisFromInstruction(2, t0)
    1356     loadConstantOrVariableCell(t0, t3, .opGetByIdProtoSlow)
    1357     loadi JSCell::m_structureID[t3], t1
    1358     loadisFromInstruction(4, t2)
    1359     bineq t2, t1, .opGetByIdProtoSlow
    1360     loadisFromInstruction(5, t1)
    1361     loadpFromInstruction(6, t3)
    1362     loadisFromInstruction(1, t2)
    1363     loadPropertyAtVariableOffset(t1, t3, t0)
    1364     storeq t0, [cfr, t2, 8]
    1365     valueProfile(t0, 8, t1)
    1366     dispatch(constexpr op_get_by_id_proto_load_length)
    1367 
    1368 .opGetByIdProtoSlow:
    1369     callSlowPath(_llint_slow_path_get_by_id)
    1370     dispatch(constexpr op_get_by_id_proto_load_length)
    1371 
    1372 
    1373 _llint_op_get_by_id_unset:
    1374     traceExecution()
    1375     loadisFromInstruction(2, t0)
    1376     loadConstantOrVariableCell(t0, t3, .opGetByIdUnsetSlow)
    1377     loadi JSCell::m_structureID[t3], t1
    1378     loadisFromInstruction(4, t2)
    1379     bineq t2, t1, .opGetByIdUnsetSlow
    1380     loadisFromInstruction(1, t2)
    1381     storeq ValueUndefined, [cfr, t2, 8]
    1382     valueProfile(ValueUndefined, 8, t1)
    1383     dispatch(constexpr op_get_by_id_unset_length)
    1384 
    1385 .opGetByIdUnsetSlow:
    1386     callSlowPath(_llint_slow_path_get_by_id)
    1387     dispatch(constexpr op_get_by_id_unset_length)
    13881351
    13891352
    … …  
    14021365    bilt t0, 0, .opGetArrayLengthSlow
    14031366    orq tagTypeNumber, t0
    1404     valueProfile(t0, 8, t2)
     1367    valueProfile(t0, constexpr (op_get_array_length_length - 1), t2)
    14051368    storeq t0, [cfr, t1, 8]
    14061369    dispatch(constexpr op_get_array_length_length)

  • trunk/Source/JavaScriptCore/runtime/Options.h

    r231194 r231316  
    459459    v(bool, useICStats, false, Normal, nullptr) \
    460460    \
    461     v(unsigned, prototypeHitCountForLLIntCaching, 2, Normal, "Number of prototype property hits before caching a prototype in the LLInt. A count of 0 means never cache.") \
    462     \
    463461    v(bool, dumpCompiledRegExpPatterns, false, Normal, nullptr) \
    464462    \
Note: See TracChangeset for help on using the changeset viewer.