Changeset 231719 in webkit


Ignore:
Timestamp:
May 11, 2018 2:16:05 PM (6 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r231316 and r231332.
​https://bugs.webkit.org/show_bug.cgi?id=185564

Appears to be a Speedometer2/MotionMark regression (Requested
by keith_miller on #webkit).

Reverted changesets:

"Remove the prototype caching for get_by_id in the LLInt"
​https://bugs.webkit.org/show_bug.cgi?id=185226
​https://trac.webkit.org/changeset/231316

"Unreviewed, fix 32-bit profile offset for change in bytecode"
​https://trac.webkit.org/changeset/231332

Location:
trunk/Source/JavaScriptCore
Files:
2 added
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r231565 r231719  
    455455    bytecode/JumpTable.h
    456456    bytecode/LLIntCallLinkInfo.h
     457    bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h
    457458    bytecode/LazyOperandValueProfile.h
    458459    bytecode/ObjectAllocationProfile.h

  • trunk/Source/JavaScriptCore/ChangeLog

    r231710 r231719  
     12018-05-11  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r231316 and r231332.
     4        https://bugs.webkit.org/show_bug.cgi?id=185564
     5
     6        Appears to be a Speedometer2/MotionMark regression (Requested
     7        by keith_miller on #webkit).
     8
     9        Reverted changesets:
     10
     11        "Remove the prototype caching for get_by_id in the LLInt"
     12        https://bugs.webkit.org/show_bug.cgi?id=185226
     13        https://trac.webkit.org/changeset/231316
     14
     15        "Unreviewed, fix 32-bit profile offset for change in bytecode"
     16        https://trac.webkit.org/changeset/231332
     17
    1182018-05-11  Michael Saboff  <msaboff@apple.com>
    219

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r231589 r231719  
    10381038                53F6BF6D1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
    10391039                53F8D2001E8387D400D21116 /* WasmBBQPlanInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 53F8D1FF1E8387D400D21116 /* WasmBBQPlanInlines.h */; };
     1040                53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
    10401041                53FD04D41D7AB291003287D3 /* WasmCallingConvention.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */; settings = {ATTRIBUTES = (Private, ); }; };
    10411042                53FF7F991DBFCD9000A26CCC /* WasmValidate.h in Headers */ = {isa = PBXBuildFile; fileRef = 53FF7F981DBFCD9000A26CCC /* WasmValidate.h */; };
    … …  
    34633464                53F6BF6C1C3F060A00F41E5D /* InternalFunctionAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InternalFunctionAllocationProfile.h; sourceTree = "<group>"; };
    34643465                53F8D1FF1E8387D400D21116 /* WasmBBQPlanInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmBBQPlanInlines.h; sourceTree = "<group>"; };
     3466                53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.h; sourceTree = "<group>"; };
     3467                53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp; sourceTree = "<group>"; };
    34653468                53FD04D11D7AB187003287D3 /* WasmCallingConvention.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmCallingConvention.cpp; sourceTree = "<group>"; };
    34663469                53FD04D21D7AB187003287D3 /* WasmCallingConvention.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmCallingConvention.h; sourceTree = "<group>"; };
    … …  
    66596662                                FE2B0B681FD0D2970075DA5F /* JSCPoison.cpp */,
    66606663                                FE2B0B701FD8C4630075DA5F /* JSCPoison.h */,
    6661                                 FE7497E5209001B00003565B /* JSCPtrTag.h */,
    66626664                                72AAF7CB1D0D318B005E60BE /* JSCustomGetterSetterFunction.cpp */,
    66636665                                72AAF7CC1D0D318B005E60BE /* JSCustomGetterSetterFunction.h */,
    … …  
    67456747                                862553CE16136AA5009F17D0 /* JSProxy.cpp */,
    67466748                                862553CF16136AA5009F17D0 /* JSProxy.h */,
     6749                                FE7497E5209001B00003565B /* JSCPtrTag.h */,
    67476750                                534638721E70D01500F12AC1 /* JSRunLoopTimer.cpp */,
    67486751                                534638701E70CF3D00F12AC1 /* JSRunLoopTimer.h */,
    … …  
    76277630                                0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */,
    76287631                                0F0FC45814BD15F100B81154 /* LLIntCallLinkInfo.h */,
     7632                                53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */,
     7633                                53FA2AE01CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h */,
    76297634                                0FB5467C14F5CFD3002C2989 /* MethodOfGettingAValueProfile.cpp */,
    76307635                                0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */,
    … …  
    89938998                                148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
    89948999                                FE2B0B731FD9EF700075DA5F /* JSCPoison.h in Headers */,
    8995                                 FE7497E6209001B10003565B /* JSCPtrTag.h in Headers */,
    89969000                                A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */,
    89979001                                72AAF7CE1D0D31B3005E60BE /* JSCustomGetterSetterFunction.h in Headers */,
    … …  
    90699073                                7C184E1F17BEE22E007CB63A /* JSPromisePrototype.h in Headers */,
    90709074                                996B731F1BDA08EF00331B84 /* JSPromisePrototype.lut.h in Headers */,
     9075                                FE7497E6209001B10003565B /* JSCPtrTag.h in Headers */,
    90719076                                2A05ABD61961DF2400341750 /* JSPropertyNameEnumerator.h in Headers */,
    90729077                                862553D216136E1A009F17D0 /* JSProxy.h in Headers */,
    … …  
    91579162                                FED287B215EC9A5700DA8161 /* LLIntOpcode.h in Headers */,
    91589163                                79CFC6F01C33B10000C768EA /* LLIntPCRanges.h in Headers */,
     9164                                53FA2AE11CF37F3F0022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.h in Headers */,
    91599165                                0F4680A514BA7F8D00BFE272 /* LLIntSlowPaths.h in Headers */,
    91609166                                0F0B839D14BCF46600885B4F /* LLIntThunks.h in Headers */,

  • trunk/Source/JavaScriptCore/Sources.txt

    r231560 r231719  
    225225bytecode/IntrinsicGetterAccessCase.cpp
    226226bytecode/JumpTable.cpp
     227bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp
    227228bytecode/LazyOperandValueProfile.cpp
    228229bytecode/MethodOfGettingAValueProfile.cpp

  • trunk/Source/JavaScriptCore/bytecode/BytecodeDumper.cpp

    r231316 r231719  
    378378        op = "get_by_id";
    379379        break;
     380    case op_get_by_id_proto_load:
     381        op = "get_by_id_proto_load";
     382        break;
     383    case op_get_by_id_unset:
     384        op = "get_by_id_unset";
     385        break;
    380386    case op_get_array_length:
    381387        op = "array_length";
    … …  
    392398    printLocationAndOp(out, location, it, op);
    393399    out.printf("%s, %s, %s", registerName(r0).data(), registerName(r1).data(), idName(id0, identifier(id0)).data());
    394     it += 3; // Increment up to the value profiler.
     400    it += 4; // Increment up to the value profiler.
    395401}
    396402
    … …  
    437443        dumpStructure(out, "struct", structure, ident);
    438444        out.printf(")");
     445        if (Interpreter::getOpcodeID(instruction[0]) == op_get_by_id_proto_load)
     446            out.printf(" proto(%p)", getPointer(instruction[6]));
    439447    }
    440448
    … …  
    10311039    }
    10321040    case op_get_by_id:
     1041    case op_get_by_id_proto_load:
     1042    case op_get_by_id_unset:
    10331043    case op_get_array_length: {
    10341044        printGetByIdOp(out, location, it);

  • trunk/Source/JavaScriptCore/bytecode/BytecodeList.json

    r231316 r231719  
    8282            { "name" : "op_is_cell_with_type", "length" : 4 },
    8383            { "name" : "op_in", "length" : 5 },
    84             { "name" : "op_get_array_length", "length" : 8 },
    85             { "name" : "op_get_by_id", "length" : 8  },
     84            { "name" : "op_get_array_length", "length" : 9 },
     85            { "name" : "op_get_by_id", "length" : 9  },
     86            { "name" : "op_get_by_id_proto_load", "length" : 9 },
     87            { "name" : "op_get_by_id_unset", "length" : 9 },
    8688            { "name" : "op_get_by_id_with_this", "length" : 6 },
    8789            { "name" : "op_get_by_val_with_this", "length" : 6 },

  • trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h

    r231316 r231719  
    183183    case op_try_get_by_id:
    184184    case op_get_by_id:
     185    case op_get_by_id_proto_load:
     186    case op_get_by_id_unset:
    185187    case op_get_by_id_direct:
    186188    case op_get_array_length:
    … …  
    433435    case op_try_get_by_id:
    434436    case op_get_by_id:
     437    case op_get_by_id_proto_load:
     438    case op_get_by_id_unset:
    435439    case op_get_by_id_direct:
    436440    case op_get_by_id_with_this:

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

    r231695 r231719  
    6666#include "LLIntData.h"
    6767#include "LLIntEntrypoint.h"
     68#include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
    6869#include "LowLevelInterpreter.h"
    6970#include "ModuleProgramCodeBlock.h"
    … …  
    12511252        Instruction* curInstruction = &instructions()[propertyAccessInstructions[i]];
    12521253        switch (Interpreter::getOpcodeID(curInstruction[0])) {
    1253         case op_get_by_id: {
     1254        case op_get_by_id:
     1255        case op_get_by_id_proto_load:
     1256        case op_get_by_id_unset: {
    12541257            StructureID oldStructureID = curInstruction[4].u.structureID;
    12551258            if (!oldStructureID || Heap::isMarked(vm.heap.structureIDTable().get(oldStructureID)))
    … …  
    13441347        }
    13451348    }
     1349
     1350    // We can't just remove all the sets when we clear the caches since we might have created a watchpoint set
     1351    // then cleared the cache without GCing in between.
     1352    m_llintGetByIdWatchpointMap.removeIf([](const StructureWatchpointMap::KeyValuePairType& pair) -> bool {
     1353        return !Heap::isMarked(pair.key);
     1354    });
    13461355
    13471356    for (unsigned i = 0; i < m_llintCallLinkInfos.size(); ++i) {

  • trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

    r231695 r231719  
    5555#include "JumpTable.h"
    5656#include "LLIntCallLinkInfo.h"
     57#include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"
    5758#include "LazyOperandValueProfile.h"
    5859#include "ModuleProgramExecutable.h"
    … …  
    628629    }
    629630
     631    typedef HashMap<Structure*, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>> StructureWatchpointMap;
     632    StructureWatchpointMap& llintGetByIdWatchpointMap() { return m_llintGetByIdWatchpointMap; }
     633
    630634    // Functions for controlling when tiered compilation kicks in. This
    631635    // controls both when the optimizing compiler is invoked and when OSR
    … …  
    972976    RefCountedArray<LLIntCallLinkInfo> m_llintCallLinkInfos;
    973977    SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo>> m_incomingLLIntCalls;
     978    StructureWatchpointMap m_llintGetByIdWatchpointMap;
    974979    PoisonedRefPtr<CodeBlockPoison, JITCode> m_jitCode;
    975980#if ENABLE(JIT)

  • trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp

    r231316 r231719  
    105105
    106106    case op_get_array_length:
    107     case op_try_get_by_id: {
     107    case op_try_get_by_id:
     108    case op_get_by_id_proto_load:
     109    case op_get_by_id_unset: {
     110        // FIXME: We should not just bail if we see a try_get_by_id or a get_by_id_proto_load.
     111        // https://bugs.webkit.org/show_bug.cgi?id=158039
    108112        return GetByIdStatus(NoInformation, false);
    109113    }

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r231695 r231719  
    27042704    instructions().append(0);
    27052705    instructions().append(0);
     2706    instructions().append(Options::prototypeHitCountForLLIntCaching());
    27062707    instructions().append(profile);
    27072708    return dst;

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r231472 r231719  
    51545154        case op_try_get_by_id:
    51555155        case op_get_by_id:
     5156        case op_get_by_id_proto_load:
     5157        case op_get_by_id_unset:
    51565158        case op_get_array_length: {
    51575159            SpeculatedType prediction = getPrediction();

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r231316 r231719  
    165165    case op_try_get_by_id:
    166166    case op_get_by_id:
     167    case op_get_by_id_proto_load:
     168    case op_get_by_id_unset:
    167169    case op_get_by_id_with_this:
    168170    case op_get_by_id_direct:

  • trunk/Source/JavaScriptCore/jit/JIT.cpp

    r231514 r231719  
    343343        DEFINE_OP(op_try_get_by_id)
    344344        case op_get_array_length:
     345        case op_get_by_id_proto_load:
     346        case op_get_by_id_unset:
    345347        DEFINE_OP(op_get_by_id)
    346348        DEFINE_OP(op_get_by_id_with_this)
    … …  
    520522        DEFINE_SLOWCASE_OP(op_try_get_by_id)
    521523        case op_get_array_length:
     524        case op_get_by_id_proto_load:
     525        case op_get_by_id_unset:
    522526        DEFINE_SLOWCASE_OP(op_get_by_id)
    523527        DEFINE_SLOWCASE_OP(op_get_by_id_with_this)

  • trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r231316 r231719  
    642642}
    643643
     644
     645static void setupGetByIdPrototypeCache(ExecState* exec, VM& vm, Instruction* pc, JSCell* baseCell, PropertySlot& slot, const Identifier& ident)
     646{
     647    CodeBlock* codeBlock = exec->codeBlock();
     648    Structure* structure = baseCell->structure();
     649
     650    if (structure->typeInfo().prohibitsPropertyCaching())
     651        return;
     652   
     653    if (structure->needImpurePropertyWatchpoint())
     654        return;
     655
     656    if (structure->isDictionary()) {
     657        if (structure->hasBeenFlattenedBefore())
     658            return;
     659        structure->flattenDictionaryStructure(vm, jsCast<JSObject*>(baseCell));
     660    }
     661
     662    ObjectPropertyConditionSet conditions;
     663    if (slot.isUnset())
     664        conditions = generateConditionsForPropertyMiss(vm, codeBlock, exec, structure, ident.impl());
     665    else
     666        conditions = generateConditionsForPrototypePropertyHit(vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
     667
     668    if (!conditions.isValid())
     669        return;
     670
     671    PropertyOffset offset = invalidOffset;
     672    CodeBlock::StructureWatchpointMap& watchpointMap = codeBlock->llintGetByIdWatchpointMap();
     673    auto result = watchpointMap.add(structure, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>());
     674    for (ObjectPropertyCondition condition : conditions) {
     675        if (!condition.isWatchable())
     676            return;
     677        if (condition.condition().kind() == PropertyCondition::Presence)
     678            offset = condition.condition().offset();
     679        result.iterator->value.add(condition, pc)->install();
     680    }
     681    ASSERT((offset == invalidOffset) == slot.isUnset());
     682
     683    ConcurrentJSLocker locker(codeBlock->m_lock);
     684
     685    if (slot.isUnset()) {
     686        pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_unset);
     687        pc[4].u.structureID = structure->id();
     688        return;
     689    }
     690    ASSERT(slot.isValue());
     691
     692    pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_proto_load);
     693    pc[4].u.structureID = structure->id();
     694    pc[5].u.operand = offset;
     695    // We know that this pointer will remain valid because it will be cleared by either a watchpoint fire or
     696    // during GC when we clear the LLInt caches.
     697    pc[6].u.pointer = slot.slotBase();
     698}
     699
     700
    644701LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
    645702{
    … …  
    662719            if (oldStructureID) {
    663720                auto opcode = Interpreter::getOpcodeID(pc[0]);
    664                 if (opcode == op_get_by_id) {
     721                if (opcode == op_get_by_id
     722                    || opcode == op_get_by_id_unset
     723                    || opcode == op_get_by_id_proto_load) {
    665724                    Structure* a = vm.heap.structureIDTable().get(oldStructureID);
    666725                    Structure* b = baseValue.asCell()->structure(vm);
    … …  
    681740            pc[4].u.pointer = nullptr; // old structure
    682741            pc[5].u.pointer = nullptr; // offset
     742
     743            // Prevent the prototype cache from ever happening.
     744            pc[7].u.operand = 0;
    683745       
    684746            if (structure->propertyAccessesAreCacheable()
    … …  
    691753                pc[5].u.operand = slot.cachedOffset();
    692754            }
     755        } else if (UNLIKELY(pc[7].u.operand && (slot.isValue() || slot.isUnset()))) {
     756            ASSERT(slot.slotBase() != baseValue);
     757
     758            if (!(--pc[7].u.operand))
     759                setupGetByIdPrototypeCache(exec, vm, pc, baseCell, slot, ident);
    693760        }
    694761    } else if (!LLINT_ALWAYS_ACCESS_SLOW
    … …  
    699766        arrayProfile->observeStructure(baseValue.asCell()->structure());
    700767        pc[4].u.arrayProfile = arrayProfile;
     768
     769        // Prevent the prototype cache from ever happening.
     770        pc[7].u.operand = 0;
    701771    }
    702772

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r231332 r231719  
    14211421    storei t0, TagOffset[cfr, t2, 8]
    14221422    storei t1, PayloadOffset[cfr, t2, 8]
    1423     valueProfile(t0, t1, 28, t2)
     1423    valueProfile(t0, t1, 32, t2)
    14241424    dispatch(constexpr op_get_by_id_length)
    14251425
    … …  
    14271427    callSlowPath(_llint_slow_path_get_by_id)
    14281428    dispatch(constexpr op_get_by_id_length)
     1429
     1430
     1431_llint_op_get_by_id_proto_load:
     1432    traceExecution()
     1433    loadi 8[PC], t0
     1434    loadi 16[PC], t1
     1435    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdProtoSlow)
     1436    loadi 20[PC], t2
     1437    bineq JSCell::m_structureID[t3], t1, .opGetByIdProtoSlow
     1438    loadpFromInstruction(6, t3)
     1439    loadPropertyAtVariableOffset(t2, t3, t0, t1)
     1440    loadi 4[PC], t2
     1441    storei t0, TagOffset[cfr, t2, 8]
     1442    storei t1, PayloadOffset[cfr, t2, 8]
     1443    valueProfile(t0, t1, 32, t2)
     1444    dispatch(constexpr op_get_by_id_proto_load_length)
     1445
     1446.opGetByIdProtoSlow:
     1447    callSlowPath(_llint_slow_path_get_by_id)
     1448    dispatch(constexpr op_get_by_id_proto_load_length)
     1449
     1450
     1451_llint_op_get_by_id_unset:
     1452    traceExecution()
     1453    loadi 8[PC], t0
     1454    loadi 16[PC], t1
     1455    loadConstantOrVariablePayload(t0, CellTag, t3, .opGetByIdUnsetSlow)
     1456    bineq JSCell::m_structureID[t3], t1, .opGetByIdUnsetSlow
     1457    loadi 4[PC], t2
     1458    storei UndefinedTag, TagOffset[cfr, t2, 8]
     1459    storei 0, PayloadOffset[cfr, t2, 8]
     1460    valueProfile(UndefinedTag, 0, 32, t2)
     1461    dispatch(constexpr op_get_by_id_unset_length)
     1462
     1463.opGetByIdUnsetSlow:
     1464    callSlowPath(_llint_slow_path_get_by_id)
     1465    dispatch(constexpr op_get_by_id_unset_length)
    14291466
    14301467
    … …  
    14421479    loadi -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], t0
    14431480    bilt t0, 0, .opGetArrayLengthSlow
    1444     valueProfile(Int32Tag, t0, 28, t2)
     1481    valueProfile(Int32Tag, t0, 32, t2)
    14451482    storep t0, PayloadOffset[cfr, t1, 8]
    14461483    storep Int32Tag, TagOffset[cfr, t1, 8]

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r231316 r231719  
    13431343    loadPropertyAtVariableOffset(t1, t3, t0)
    13441344    storeq t0, [cfr, t2, 8]
    1345     valueProfile(t0, constexpr (op_get_by_id_length - 1), t1)
     1345    valueProfile(t0, 8, t1)
    13461346    dispatch(constexpr op_get_by_id_length)
    13471347
    … …  
    13491349    callSlowPath(_llint_slow_path_get_by_id)
    13501350    dispatch(constexpr op_get_by_id_length)
     1351
     1352
     1353_llint_op_get_by_id_proto_load:
     1354    traceExecution()
     1355    loadisFromInstruction(2, t0)
     1356    loadConstantOrVariableCell(t0, t3, .opGetByIdProtoSlow)
     1357    loadi JSCell::m_structureID[t3], t1
     1358    loadisFromInstruction(4, t2)
     1359    bineq t2, t1, .opGetByIdProtoSlow
     1360    loadisFromInstruction(5, t1)
     1361    loadpFromInstruction(6, t3)
     1362    loadisFromInstruction(1, t2)
     1363    loadPropertyAtVariableOffset(t1, t3, t0)
     1364    storeq t0, [cfr, t2, 8]
     1365    valueProfile(t0, 8, t1)
     1366    dispatch(constexpr op_get_by_id_proto_load_length)
     1367
     1368.opGetByIdProtoSlow:
     1369    callSlowPath(_llint_slow_path_get_by_id)
     1370    dispatch(constexpr op_get_by_id_proto_load_length)
     1371
     1372
     1373_llint_op_get_by_id_unset:
     1374    traceExecution()
     1375    loadisFromInstruction(2, t0)
     1376    loadConstantOrVariableCell(t0, t3, .opGetByIdUnsetSlow)
     1377    loadi JSCell::m_structureID[t3], t1
     1378    loadisFromInstruction(4, t2)
     1379    bineq t2, t1, .opGetByIdUnsetSlow
     1380    loadisFromInstruction(1, t2)
     1381    storeq ValueUndefined, [cfr, t2, 8]
     1382    valueProfile(ValueUndefined, 8, t1)
     1383    dispatch(constexpr op_get_by_id_unset_length)
     1384
     1385.opGetByIdUnsetSlow:
     1386    callSlowPath(_llint_slow_path_get_by_id)
     1387    dispatch(constexpr op_get_by_id_unset_length)
    13511388
    13521389
    … …  
    13651402    bilt t0, 0, .opGetArrayLengthSlow
    13661403    orq tagTypeNumber, t0
    1367     valueProfile(t0, constexpr (op_get_array_length_length - 1), t2)
     1404    valueProfile(t0, 8, t2)
    13681405    storeq t0, [cfr, t1, 8]
    13691406    dispatch(constexpr op_get_array_length_length)

  • trunk/Source/JavaScriptCore/runtime/Options.h

    r231338 r231719  
    458458    v(bool, useICStats, false, Normal, nullptr) \
    459459    \
     460    v(unsigned, prototypeHitCountForLLIntCaching, 2, Normal, "Number of prototype property hits before caching a prototype in the LLInt. A count of 0 means never cache.") \
     461    \
    460462    v(bool, dumpCompiledRegExpPatterns, false, Normal, nullptr) \
    461463    \
Note: See TracChangeset for help on using the changeset viewer.