Changeset 237447 in webkit

Timestamp:

Oct 26, 2018, 12:56:56 AM (8 years ago)

Author:

yusukesuzuki@slowstart.org

Message:

[JSC] havingABadTimeWatchpoint is not required in Array#indexOf optimization
​https://bugs.webkit.org/show_bug.cgi?id=190941

Reviewed by Saam Barati.

While "Rest" operation fast path requires havingABadTimeWatchpoint since it allocates
JSArray, Array#{indexOf,lastIndexOf} do not require it when we use the fast path for them.
This patch removes watching on havingABadTimeWatchpoint in Array#indexOf. The test causing
"havingABadTime" is already included in our test suites (e.g. array-indexof-have-a-bad-time.js).

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

• runtime/JSArrayInlines.h:

(JSC::JSArray::canDoFastIndexedAccess):

• runtime/JSGlobalObject.h:
• runtime/JSGlobalObjectInlines.h:

(JSC::JSGlobalObject::isArrayPrototypeIteratorProtocolFastAndNonObservable):
(JSC::JSGlobalObject::isArrayPrototypeIndexedAccessFastAndNonObservable): Deleted.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGByteCodeParser.cpp (modified) (1 diff)
• runtime/JSArrayInlines.h (modified) (1 diff)
• runtime/JSGlobalObject.h (modified) (1 diff)
• runtime/JSGlobalObjectInlines.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-10-25  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
+
+        [JSC] havingABadTimeWatchpoint is not required in Array#indexOf optimization
+        https://bugs.webkit.org/show_bug.cgi?id=190941
+
+        Reviewed by Saam Barati.
+
+        While "Rest" operation fast path requires havingABadTimeWatchpoint since it allocates
+        JSArray, Array#{indexOf,lastIndexOf} do not require it when we use the fast path for them.
+        This patch removes watching on havingABadTimeWatchpoint in Array#indexOf. The test causing
+        "havingABadTime" is already included in our test suites (e.g. array-indexof-have-a-bad-time.js).
+
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+        * runtime/JSArrayInlines.h:
+        (JSC::JSArray::canDoFastIndexedAccess):
+        * runtime/JSGlobalObject.h:
+        * runtime/JSGlobalObjectInlines.h:
+        (JSC::JSGlobalObject::isArrayPrototypeIteratorProtocolFastAndNonObservable):
+        (JSC::JSGlobalObject::isArrayPrototypeIndexedAccessFastAndNonObservable): Deleted.
+
 2018-10-25  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -2363 +2363 @@
             // FIXME: We could easily relax the Array/Object.prototype transition as long as we OSR exitted if we saw a hole.
             // https://bugs.webkit.org/show_bug.cgi?id=173171
-            if (globalObject->havingABadTimeWatchpoint()->isStillValid()
-                && arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
+            if (arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
                 && objectPrototypeStructure->transitionWatchpointSetIsStillValid()
                 && globalObject->arrayPrototypeChainIsSane()) {
 
-                m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
                 m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
                 m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);

trunk/Source/JavaScriptCore/runtime/JSArrayInlines.h

@@ -75 +75 @@
 {
     JSGlobalObject* globalObject = this->globalObject();
-    if (!globalObject->isArrayPrototypeIndexedAccessFastAndNonObservable())
+    if (!globalObject->arrayPrototypeChainIsSane())
         return false;
 

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

@@ -477 +477 @@
     PoisonedUniquePtr<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>> m_numberPrototypeToStringWatchpoint;
 
-    bool isArrayPrototypeIndexedAccessFastAndNonObservable();
     bool isArrayPrototypeIteratorProtocolFastAndNonObservable();
     bool isMapPrototypeIteratorProtocolFastAndNonObservable();

trunk/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h

@@ -53 +53 @@
 }
 
-ALWAYS_INLINE bool JSGlobalObject::isArrayPrototypeIndexedAccessFastAndNonObservable()
-{
-    // We're fast if we don't have any indexed properties on the prototype.
-    return !isHavingABadTime() && arrayPrototypeChainIsSane();
-}
-
 ALWAYS_INLINE bool JSGlobalObject::isArrayPrototypeIteratorProtocolFastAndNonObservable()
 {
@@ -69 +63 @@
     // executing concurrently.
 
-    return arrayIteratorProtocolWatchpoint().isStillValid() && isArrayPrototypeIndexedAccessFastAndNonObservable();
+    return arrayIteratorProtocolWatchpoint().isStillValid() && !isHavingABadTime() && arrayPrototypeChainIsSane();
 }