Changeset 172742 in webkit

Timestamp:

Aug 18, 2014, 9:41:34 PM (11 years ago)

Author:

commit-queue@webkit.org

Message:

Unreviewed, rolling out r172741.
​https://bugs.webkit.org/show_bug.cgi?id=136058

This change is breaking PLT. (Requested by mlam on #webkit).

Reverted changeset:

"REGRESSION(r172401): for-in optimization no longer works at
all"
​https://bugs.webkit.org/show_bug.cgi?id=136056
​http://trac.webkit.org/changeset/172741

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecompiler/BytecodeGenerator.cpp (modified) (3 diffs)
• bytecompiler/BytecodeGenerator.h (modified) (5 diffs)
• bytecompiler/NodesCodegen.cpp (modified) (2 diffs)
• tests/stress/for-in-base-reassigned-later-and-change-structure.js (deleted)
• tests/stress/for-in-base-reassigned-later.js (deleted)
• tests/stress/for-in-base-reassigned.js (deleted)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-08-18  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r172741.
+        https://bugs.webkit.org/show_bug.cgi?id=136058
+
+        This change is breaking PLT. (Requested by mlam on #webkit).
+
+        Reverted changeset:
+
+        "REGRESSION(r172401): for-in optimization no longer works at
+        all"
+        https://bugs.webkit.org/show_bug.cgi?id=136056
+        http://trac.webkit.org/changeset/172741
+
 2014-08-18  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -1423 +1423 @@
     for (size_t i = m_forInContextStack.size(); i > 0; i--) {
         ForInContext* context = m_forInContextStack[i - 1].get();
+        if (context->base() != base)
+            continue;
+
         if (context->local() != property)
             continue;
@@ -2584 +2587 @@
 }
 
-void BytecodeGenerator::pushIndexedForInScope(RegisterID* localRegister, RegisterID* indexRegister)
+void BytecodeGenerator::pushIndexedForInScope(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister)
 {
     if (!localRegister)
         return;
-    m_forInContextStack.append(std::make_unique<IndexedForInContext>(localRegister, indexRegister));
+    m_forInContextStack.append(std::make_unique<IndexedForInContext>(baseRegister, localRegister, indexRegister));
 }
 
@@ -2598 +2601 @@
 }
 
-void BytecodeGenerator::pushStructureForInScope(RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
+void BytecodeGenerator::pushStructureForInScope(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
 {
     if (!localRegister)
         return;
-    m_forInContextStack.append(std::make_unique<StructureForInContext>(localRegister, indexRegister, propertyRegister, enumeratorRegister));
+    m_forInContextStack.append(std::make_unique<StructureForInContext>(baseRegister, localRegister, indexRegister, propertyRegister, enumeratorRegister));
 }
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

@@ -100 +100 @@
     class ForInContext {
     public:
-        ForInContext(RegisterID* localRegister)
-            : m_localRegister(localRegister)
+        ForInContext(RegisterID* baseRegister, RegisterID* localRegister)
+            : m_baseRegister(baseRegister)
+            , m_localRegister(localRegister)
             , m_isValid(true)
         {
@@ -119 +120 @@
         virtual ForInContextType type() const = 0;
 
+        RegisterID* base() const { return m_baseRegister.get(); }
         RegisterID* local() const { return m_localRegister.get(); }
 
     private:
+        RefPtr<RegisterID> m_baseRegister;
         RefPtr<RegisterID> m_localRegister;
         bool m_isValid;
@@ -128 +131 @@
     class StructureForInContext : public ForInContext {
     public:
-        StructureForInContext(RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
-            : ForInContext(localRegister)
+        StructureForInContext(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister, RegisterID* propertyRegister, RegisterID* enumeratorRegister)
+            : ForInContext(baseRegister, localRegister)
             , m_indexRegister(indexRegister)
             , m_propertyRegister(propertyRegister)
@@ -153 +156 @@
     class IndexedForInContext : public ForInContext {
     public:
-        IndexedForInContext(RegisterID* localRegister, RegisterID* indexRegister)
-            : ForInContext(localRegister)
+        IndexedForInContext(RegisterID* baseRegister, RegisterID* localRegister, RegisterID* indexRegister)
+            : ForInContext(baseRegister, localRegister)
             , m_indexRegister(indexRegister)
         {
@@ -525 +528 @@
         void popFinallyContext();
 
-        void pushIndexedForInScope(RegisterID* local, RegisterID* index);
+        void pushIndexedForInScope(RegisterID* base, RegisterID* local, RegisterID* index);
         void popIndexedForInScope(RegisterID* local);
-        void pushStructureForInScope(RegisterID* local, RegisterID* index, RegisterID* property, RegisterID* enumerator);
+        void pushStructureForInScope(RegisterID* base, RegisterID* local, RegisterID* index, RegisterID* property, RegisterID* enumerator);
         void popStructureForInScope(RegisterID* local);
         void invalidateForInContextForLocal(RegisterID* local);

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -2071 +2071 @@
         this->emitLoopHeader(generator, propertyName.get());
 
-        generator.pushIndexedForInScope(local.get(), i.get());
+        generator.pushIndexedForInScope(base.get(), local.get(), i.get());
         generator.emitNode(dst, m_statement);
         generator.popIndexedForInScope(local.get());
@@ -2105 +2105 @@
         this->emitLoopHeader(generator, propertyName.get());
 
-        generator.pushStructureForInScope(local.get(), i.get(), propertyName.get(), structureEnumerator.get());
+        generator.pushStructureForInScope(base.get(), local.get(), i.get(), propertyName.get(), structureEnumerator.get());
         generator.emitNode(dst, m_statement);
         generator.popStructureForInScope(local.get());