Changeset 245813 in webkit

Timestamp:

May 28, 2019, 9:03:02 AM (7 years ago)

Author:

Tadeu Zagallo

Message:

JITOperations putByVal should mark negative array indices as out-of-bounds
​https://bugs.webkit.org/show_bug.cgi?id=198271

Reviewed by Saam Barati.

JSTests:

• microbenchmarks/get-by-val-negative-array-index.js:

(foo):
Update the getByVal microbenchmark added in r245769. This now shows that r245769
is 4.2x faster than the previous commit.

• microbenchmarks/put-by-val-negative-array-index.js: Added.

(foo):

Source/JavaScriptCore:

Similar to what was done to getByVal in r245769, we should also mark put_by_val as out-of-bounds
when we exit from DFG for putting to a negative index. This avoids the same scenario where we keep
recompiling a CodeBlock with DFG and exiting at the same bytecode.

This is a 3.7x improvement in the microbenchmark being added: put-by-val-negative-array-index.js.

• jit/JITOperations.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/microbenchmarks/get-by-val-negative-array-index.js (modified) (1 diff)
• JSTests/microbenchmarks/put-by-val-negative-array-index.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jit/JITOperations.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-05-28  Tadeu Zagallo  <tzagallo@apple.com>
+
+        JITOperations putByVal should mark negative array indices as out-of-bounds
+        https://bugs.webkit.org/show_bug.cgi?id=198271
+
+        Reviewed by Saam Barati.
+
+        * microbenchmarks/get-by-val-negative-array-index.js:
+        (foo):
+        Update the getByVal microbenchmark added in r245769. This now shows that r245769
+        is 4.2x faster than the previous commit.
+
+        * microbenchmarks/put-by-val-negative-array-index.js: Added.
+        (foo):
+
 2019-05-25  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/JSTests/microbenchmarks/get-by-val-negative-array-index.js

@@ -1 +1 @@
 function foo(arr, index) {
+    for (let i = 0; i < 1e2; i++) {
+        let x = {};
+        x.x = arr;
+    }
+
     return arr[index];
 }
 noInline(foo);
 
-const arr = new Array(1000).fill({});
-for (let i = 0; i < 1e7; i++) {
+const arr = new Array(10).fill({});
+for (let i = 0; i < 1e6; i++) {
     foo(arr, i % arr.length);
-    if (!(i % 1e3))
+}
+for (let i = 0; i < 1e6; i++) {
+    foo(arr, i % arr.length);
+    if (!(i % arr.length))
         foo(arr, -1);
 }

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-28  Tadeu Zagallo  <tzagallo@apple.com>
+
+        JITOperations putByVal should mark negative array indices as out-of-bounds
+        https://bugs.webkit.org/show_bug.cgi?id=198271
+
+        Reviewed by Saam Barati.
+
+        Similar to what was done to getByVal in r245769, we should also mark put_by_val as out-of-bounds
+        when we exit from DFG for putting to a negative index. This avoids the same scenario where we keep
+        recompiling a CodeBlock with DFG and exiting at the same bytecode.
+
+        This is a 3.7x improvement in the microbenchmark being added: put-by-val-negative-array-index.js.
+
+        * jit/JITOperations.cpp:
+
 2019-05-28  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -654 +654 @@
         baseValue.putByIndex(callFrame, i, value, callFrame->codeBlock()->isStrictMode());
         return;
+    } else if (subscript.isInt32()) {
+        byValInfo->tookSlowPath = true;
+        if (baseValue.isObject())
+            byValInfo->arrayProfile->setOutOfBounds();
     }