⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 267635 in webkit


Ignore:
Timestamp:
Sep 26, 2020, 2:08:52 PM (6 years ago)
Author:
Alan Coon
Message:

Cherry-pick r267113. rdar://problem/69586723

CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
​https://bugs.webkit.org/show_bug.cgi?id=216575
<rdar://problem/68286930>

Reviewed by Yusuke Suzuki.

JSTests:

  • stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js: Added. (foo):

Source/JavaScriptCore:

The CustomFunctionEquivalence PropertyCondition would only return false to
isStillValidAssumingImpurePropertyWatchpoint if the Structure's static
property table was reified or if the static property table did not contain the
property. However, this missed the obvious case of where we store to this
property in normal object storage without reifying the static property table.
The fix here is simple: we first check if the Structure's property table
has this property, and if so, return false.

This patch also renames CustomFunctionEquivalence to HasStaticProperty to
better capture what we're doing.

  • bytecode/ObjectPropertyCondition.h: (JSC::ObjectPropertyCondition::hasStaticProperty): (JSC::ObjectPropertyCondition::customFunctionEquivalence): Deleted.
  • bytecode/ObjectPropertyConditionSet.cpp: (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition const): (JSC::ObjectPropertyConditionSet::slotBaseCondition const): (JSC::generateConditionsForPrototypePropertyHitCustom):
  • bytecode/PropertyCondition.cpp: (JSC::PropertyCondition::dumpInContext const): (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const): (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const): (JSC::PropertyCondition::isStillValid const): (JSC::PropertyCondition::isWatchableWhenValid const): (WTF::printInternal):
  • bytecode/PropertyCondition.h: (JSC::PropertyCondition::hasStaticProperty): (JSC::PropertyCondition::hash const): (JSC::PropertyCondition::operator== const): (JSC::PropertyCondition::customFunctionEquivalence): Deleted.
  • tools/JSDollarVM.cpp: (JSC::functionCreateStaticCustomValue): (JSC::JSDollarVM::finishCreation):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@267113 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-610-branch
Files:
1 added
7 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-610-branch/JSTests/ChangeLog

    r267585 r267635  
     12020-09-25  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r267113. rdar://problem/69586723
     4
     5    CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
     6    https://bugs.webkit.org/show_bug.cgi?id=216575
     7    <rdar://problem/68286930>
     8   
     9    Reviewed by Yusuke Suzuki.
     10   
     11    JSTests:
     12   
     13    * stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js: Added.
     14    (foo):
     15   
     16    Source/JavaScriptCore:
     17   
     18    The CustomFunctionEquivalence PropertyCondition would only return false to
     19    isStillValidAssumingImpurePropertyWatchpoint if the Structure's static
     20    property table was reified or if the static property table did not contain the
     21    property. However, this missed the obvious case of where we store to this
     22    property in normal object storage without reifying the static property table.
     23    The fix here is simple: we first check if the Structure's property table
     24    has this property, and if so, return false.
     25   
     26    This patch also renames CustomFunctionEquivalence to HasStaticProperty to
     27    better capture what we're doing.
     28   
     29    * bytecode/ObjectPropertyCondition.h:
     30    (JSC::ObjectPropertyCondition::hasStaticProperty):
     31    (JSC::ObjectPropertyCondition::customFunctionEquivalence): Deleted.
     32    * bytecode/ObjectPropertyConditionSet.cpp:
     33    (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition const):
     34    (JSC::ObjectPropertyConditionSet::slotBaseCondition const):
     35    (JSC::generateConditionsForPrototypePropertyHitCustom):
     36    * bytecode/PropertyCondition.cpp:
     37    (JSC::PropertyCondition::dumpInContext const):
     38    (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
     39    (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
     40    (JSC::PropertyCondition::isStillValid const):
     41    (JSC::PropertyCondition::isWatchableWhenValid const):
     42    (WTF::printInternal):
     43    * bytecode/PropertyCondition.h:
     44    (JSC::PropertyCondition::hasStaticProperty):
     45    (JSC::PropertyCondition::hash const):
     46    (JSC::PropertyCondition::operator== const):
     47    (JSC::PropertyCondition::customFunctionEquivalence): Deleted.
     48    * tools/JSDollarVM.cpp:
     49    (JSC::functionCreateStaticCustomValue):
     50    (JSC::JSDollarVM::finishCreation):
     51   
     52   
     53    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267113 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     54
     55    2020-09-15  Saam Barati  <sbarati@apple.com>
     56
     57            CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
     58            https://bugs.webkit.org/show_bug.cgi?id=216575
     59            <rdar://problem/68286930>
     60
     61            Reviewed by Yusuke Suzuki.
     62
     63            * stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js: Added.
     64            (foo):
     65
    1662020-09-25  Alan Coon  <alancoon@apple.com>
    267

  • branches/safari-610-branch/Source/JavaScriptCore/ChangeLog

    r267585 r267635  
     12020-09-25  Alan Coon  <alancoon@apple.com>
     2
     3        Cherry-pick r267113. rdar://problem/69586723
     4
     5    CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
     6    https://bugs.webkit.org/show_bug.cgi?id=216575
     7    <rdar://problem/68286930>
     8   
     9    Reviewed by Yusuke Suzuki.
     10   
     11    JSTests:
     12   
     13    * stress/has-static-property-property-condition-needs-to-check-if-structure-has-property.js: Added.
     14    (foo):
     15   
     16    Source/JavaScriptCore:
     17   
     18    The CustomFunctionEquivalence PropertyCondition would only return false to
     19    isStillValidAssumingImpurePropertyWatchpoint if the Structure's static
     20    property table was reified or if the static property table did not contain the
     21    property. However, this missed the obvious case of where we store to this
     22    property in normal object storage without reifying the static property table.
     23    The fix here is simple: we first check if the Structure's property table
     24    has this property, and if so, return false.
     25   
     26    This patch also renames CustomFunctionEquivalence to HasStaticProperty to
     27    better capture what we're doing.
     28   
     29    * bytecode/ObjectPropertyCondition.h:
     30    (JSC::ObjectPropertyCondition::hasStaticProperty):
     31    (JSC::ObjectPropertyCondition::customFunctionEquivalence): Deleted.
     32    * bytecode/ObjectPropertyConditionSet.cpp:
     33    (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition const):
     34    (JSC::ObjectPropertyConditionSet::slotBaseCondition const):
     35    (JSC::generateConditionsForPrototypePropertyHitCustom):
     36    * bytecode/PropertyCondition.cpp:
     37    (JSC::PropertyCondition::dumpInContext const):
     38    (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
     39    (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
     40    (JSC::PropertyCondition::isStillValid const):
     41    (JSC::PropertyCondition::isWatchableWhenValid const):
     42    (WTF::printInternal):
     43    * bytecode/PropertyCondition.h:
     44    (JSC::PropertyCondition::hasStaticProperty):
     45    (JSC::PropertyCondition::hash const):
     46    (JSC::PropertyCondition::operator== const):
     47    (JSC::PropertyCondition::customFunctionEquivalence): Deleted.
     48    * tools/JSDollarVM.cpp:
     49    (JSC::functionCreateStaticCustomValue):
     50    (JSC::JSDollarVM::finishCreation):
     51   
     52   
     53    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@267113 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     54
     55    2020-09-15  Saam Barati  <sbarati@apple.com>
     56
     57            CustomFunctionEquivalence PropertyCondition needs to check if the structure has the property
     58            https://bugs.webkit.org/show_bug.cgi?id=216575
     59            <rdar://problem/68286930>
     60
     61            Reviewed by Yusuke Suzuki.
     62
     63            The CustomFunctionEquivalence PropertyCondition would only return false to
     64            isStillValidAssumingImpurePropertyWatchpoint if the Structure's static
     65            property table was reified or if the static property table did not contain the
     66            property. However, this missed the obvious case of where we store to this
     67            property in normal object storage without reifying the static property table.
     68            The fix here is simple: we first check if the Structure's property table
     69            has this property, and if so, return false.
     70
     71            This patch also renames CustomFunctionEquivalence to HasStaticProperty to
     72            better capture what we're doing.
     73
     74            * bytecode/ObjectPropertyCondition.h:
     75            (JSC::ObjectPropertyCondition::hasStaticProperty):
     76            (JSC::ObjectPropertyCondition::customFunctionEquivalence): Deleted.
     77            * bytecode/ObjectPropertyConditionSet.cpp:
     78            (JSC::ObjectPropertyConditionSet::hasOneSlotBaseCondition const):
     79            (JSC::ObjectPropertyConditionSet::slotBaseCondition const):
     80            (JSC::generateConditionsForPrototypePropertyHitCustom):
     81            * bytecode/PropertyCondition.cpp:
     82            (JSC::PropertyCondition::dumpInContext const):
     83            (JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
     84            (JSC::PropertyCondition::validityRequiresImpurePropertyWatchpoint const):
     85            (JSC::PropertyCondition::isStillValid const):
     86            (JSC::PropertyCondition::isWatchableWhenValid const):
     87            (WTF::printInternal):
     88            * bytecode/PropertyCondition.h:
     89            (JSC::PropertyCondition::hasStaticProperty):
     90            (JSC::PropertyCondition::hash const):
     91            (JSC::PropertyCondition::operator== const):
     92            (JSC::PropertyCondition::customFunctionEquivalence): Deleted.
     93            * tools/JSDollarVM.cpp:
     94            (JSC::functionCreateStaticCustomValue):
     95            (JSC::JSDollarVM::finishCreation):
     96
    1972020-09-25  Alan Coon  <alancoon@apple.com>
    298

  • branches/safari-610-branch/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h

    r264488 r267635  
    123123    }
    124124
    125     static ObjectPropertyCondition customFunctionEquivalence(
     125    static ObjectPropertyCondition hasStaticProperty(
    126126        VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid)
    127127    {
    128128        ObjectPropertyCondition result;
    129129        result.m_object = object;
    130         result.m_condition = PropertyCondition::customFunctionEquivalence(uid);
     130        result.m_condition = PropertyCondition::hasStaticProperty(uid);
    131131        if (owner)
    132132            vm.heap.writeBarrier(owner);

  • branches/safari-610-branch/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp

    r266866 r267635  
    6868        case PropertyCondition::Presence:
    6969        case PropertyCondition::Equivalence:
    70         case PropertyCondition::CustomFunctionEquivalence:
     70        case PropertyCondition::HasStaticProperty:
    7171            if (sawBase)
    7272                return false;
    … …  
    8888        if (condition.kind() == PropertyCondition::Presence
    8989            || condition.kind() == PropertyCondition::Equivalence
    90             || condition.kind() == PropertyCondition::CustomFunctionEquivalence) {
     90            || condition.kind() == PropertyCondition::HasStaticProperty) {
    9191            result = condition;
    9292            numFound++;
    … …  
    245245        break;
    246246    }
    247     case PropertyCondition::CustomFunctionEquivalence: {
     247    case PropertyCondition::HasStaticProperty: {
    248248        auto entry = object->findPropertyHashEntry(vm, uid);
    249249        if (!entry)
    250250            return ObjectPropertyCondition();
    251         result = ObjectPropertyCondition::customFunctionEquivalence(vm, owner, object, uid);
     251        result = ObjectPropertyCondition::hasStaticProperty(vm, owner, object, uid);
    252252        break;
    253253    }
    … …  
    410410                    kind = PropertyCondition::Equivalence;
    411411                } else if (structure->findPropertyHashEntry(uid))
    412                     kind = PropertyCondition::CustomFunctionEquivalence;
     412                    kind = PropertyCondition::HasStaticProperty;
    413413                else if (attributes & PropertyAttribute::DontDelete) {
    414414                    // This can't change, so we can blindly cache it.

  • branches/safari-610-branch/Source/JavaScriptCore/bytecode/PropertyCondition.cpp

    r261895 r267635  
    5555        out.print(m_header.type(), " of ", m_header.pointer(), " with ", inContext(requiredValue(), context));
    5656        return;
    57     case CustomFunctionEquivalence:
     57    case HasStaticProperty:
    5858        out.print(m_header.type(), " of ", m_header.pointer());
    5959        return;
    … …  
    9090    case AbsenceOfSetEffect:
    9191    case Equivalence:
    92     case CustomFunctionEquivalence:
     92    case HasStaticProperty:
    9393        if (!structure->propertyAccessesAreCacheable()) {
    9494            if (PropertyConditionInternal::verbose)
    … …  
    254254        return true;
    255255    }
    256     case CustomFunctionEquivalence: {
     256    case HasStaticProperty: {
     257        if (isValidOffset(structure->getConcurrently(uid())))
     258            return false;
    257259        if (structure->staticPropertiesReified())
    258260            return false;
    … …  
    274276    case Absence:
    275277    case Equivalence:
    276     case CustomFunctionEquivalence:
     278    case HasStaticProperty:
    277279        return structure->needImpurePropertyWatchpoint();
    278280    case AbsenceOfSetEffect:
    … …  
    300302    case Presence:
    301303    case Equivalence:
    302     case CustomFunctionEquivalence:
     304    case HasStaticProperty:
    303305        if (structure->typeInfo().getOwnPropertySlotIsImpure())
    304306            return false;
    … …  
    343345    }
    344346
    345     case CustomFunctionEquivalence: {
     347    case HasStaticProperty: {
    346348        // We just use the structure transition watchpoint for this. A structure S starts
    347349        // off with a property P in the static property hash table. If S transitions to
    … …  
    431433        out.print("Equivalence");
    432434        return;
    433     case JSC::PropertyCondition::CustomFunctionEquivalence:
    434         out.print("CustomFunctionEquivalence");
     435    case JSC::PropertyCondition::HasStaticProperty:
     436        out.print("HasStaticProperty");
    435437        return;
    436438    case JSC::PropertyCondition::HasPrototype:

  • branches/safari-610-branch/Source/JavaScriptCore/bytecode/PropertyCondition.h

    r264488 r267635  
    4141        AbsenceOfSetEffect,
    4242        Equivalence, // An adaptive watchpoint on this will be a pair of watchpoints, and when the structure transitions, we will set the replacement watchpoint on the new structure.
    43         CustomFunctionEquivalence, // Custom value or accessor.
     43        HasStaticProperty, // Custom value or accessor.
    4444        HasPrototype
    4545    };
    … …  
    125125    }
    126126
    127     static PropertyCondition customFunctionEquivalence(UniquedStringImpl* uid)
    128     {
    129         PropertyCondition result;
    130         result.m_header = Header(uid, CustomFunctionEquivalence);
     127    static PropertyCondition hasStaticProperty(UniquedStringImpl* uid)
     128    {
     129        PropertyCondition result;
     130        result.m_header = Header(uid, HasStaticProperty);
    131131        return result;
    132132    }
    … …  
    202202            result ^= EncodedJSValueHash::hash(u.equivalence.value);
    203203            break;
    204         case CustomFunctionEquivalence:
     204        case HasStaticProperty:
    205205            break;
    206206        }
    … …  
    224224        case Equivalence:
    225225            return u.equivalence.value == other.u.equivalence.value;
    226         case CustomFunctionEquivalence:
     226        case HasStaticProperty:
    227227            return true;
    228228        }

  • branches/safari-610-branch/Source/JavaScriptCore/tools/JSDollarVM.cpp

    r266879 r267635  
    739739};
    740740
     741static EncodedJSValue testStaticValueGetter(JSGlobalObject*, EncodedJSValue, PropertyName)
     742{
     743    DollarVMAssertScope assertScope;
     744    return JSValue::encode(jsUndefined());
     745}
     746
     747static bool testStaticValuePutter(JSGlobalObject* globalObject, EncodedJSValue thisValue, EncodedJSValue value)
     748{
     749    DollarVMAssertScope assertScope;
     750    VM& vm = globalObject->vm();
     751   
     752    JSObject* thisObject = jsDynamicCast<JSObject*>(vm, JSValue::decode(thisValue));
     753    RELEASE_ASSERT(thisObject);
     754
     755    return thisObject->putDirect(vm, PropertyName(Identifier::fromString(vm, "testStaticValue")), JSValue::decode(value));
     756}
     757
     758static const struct CompactHashIndex staticCustomValueTableIndex[2] = {
     759    { 0, -1 },
     760    { -1, -1 },
     761};
     762
     763static const struct HashTableValue staticCustomValueTableValues[1] = {
     764    { "testStaticValue", static_cast<unsigned>(PropertyAttribute::CustomAccessor), NoIntrinsic, { (intptr_t)static_cast<PropertySlot::GetValueFunc>(testStaticValueGetter), (intptr_t)static_cast<PutPropertySlot::PutValueFunc>(testStaticValuePutter) } },
     765};
     766
     767static const struct HashTable staticCustomValueTable =
     768    { 1, 1, true, nullptr, staticCustomValueTableValues, staticCustomValueTableIndex };
     769
     770class StaticCustomValue : public JSNonFinalObject {
     771    using Base = JSNonFinalObject;
     772public:
     773    StaticCustomValue(VM& vm, Structure* structure)
     774        : Base(vm, structure)
     775    {
     776        DollarVMAssertScope assertScope;
     777    }
     778
     779    DECLARE_INFO;
     780
     781    static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
     782
     783    template<typename CellType, SubspaceAccess>
     784    static CompleteSubspace* subspaceFor(VM& vm)
     785    {
     786        return &vm.cellSpace;
     787    }
     788
     789    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
     790    {
     791        DollarVMAssertScope assertScope;
     792        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
     793    }
     794
     795    static StaticCustomValue* create(VM& vm, Structure* structure)
     796    {
     797        DollarVMAssertScope assertScope;
     798        StaticCustomValue* accessor = new (NotNull, allocateCell<StaticCustomValue>(vm.heap)) StaticCustomValue(vm, structure);
     799        accessor->finishCreation(vm);
     800        return accessor;
     801    }
     802};
     803
    741804class ObjectDoingSideEffectPutWithoutCorrectSlotStatus : public JSNonFinalObject {
    742805    using Base = JSNonFinalObject;
    … …  
    15451608
    15461609const ClassInfo StaticCustomAccessor::s_info = { "StaticCustomAccessor", &Base::s_info, &staticCustomAccessorTable, nullptr, CREATE_METHOD_TABLE(StaticCustomAccessor) };
     1610const ClassInfo StaticCustomValue::s_info = { "StaticCustomValue", &Base::s_info, &staticCustomValueTable, nullptr, CREATE_METHOD_TABLE(StaticCustomValue) };
    15471611const ClassInfo ObjectDoingSideEffectPutWithoutCorrectSlotStatus::s_info = { "ObjectDoingSideEffectPutWithoutCorrectSlotStatus", &Base::s_info, &staticCustomAccessorTable, nullptr, CREATE_METHOD_TABLE(ObjectDoingSideEffectPutWithoutCorrectSlotStatus) };
    15481612
    … …  
    25322596}
    25332597
     2598static EncodedJSValue JSC_HOST_CALL functionCreateStaticCustomValue(JSGlobalObject* globalObject, CallFrame*)
     2599{
     2600    DollarVMAssertScope assertScope;
     2601    VM& vm = globalObject->vm();
     2602    JSLockHolder lock(vm);
     2603    Structure* structure = StaticCustomValue::createStructure(vm, globalObject, jsNull());
     2604    auto* result = StaticCustomValue::create(vm, structure);
     2605    return JSValue::encode(result);
     2606}
     2607
    25342608static EncodedJSValue JSC_HOST_CALL functionCreateObjectDoingSideEffectPutWithoutCorrectSlotStatus(JSGlobalObject* globalObject, CallFrame* callFrame)
    25352609{
    … …  
    32333307#endif
    32343308    addFunction(vm, "createStaticCustomAccessor", functionCreateStaticCustomAccessor, 0);
     3309    addFunction(vm, "createStaticCustomValue", functionCreateStaticCustomValue, 0);
    32353310    addFunction(vm, "createObjectDoingSideEffectPutWithoutCorrectSlotStatus", functionCreateObjectDoingSideEffectPutWithoutCorrectSlotStatus, 0);
    32363311    addFunction(vm, "createEmptyFunctionWithName", functionCreateEmptyFunctionWithName, 1);
Note: See TracChangeset for help on using the changeset viewer.