Changeset 223614 in webkit


Ignore:
Timestamp:
Oct 18, 2017 10:41:55 AM (7 years ago)
Author:
mark.lam@apple.com
Message:

The compiler should always register a structure when it adds its transitionWatchPointSet.
​https://bugs.webkit.org/show_bug.cgi?id=178420
<rdar://problem/34814024>

Reviewed by Saam Barati and Filip Pizlo.

JSTests:

  • stress/regress-178420.js: Added.

(new.Array.10000.map):

Source/JavaScriptCore:

Instead of invoking addLazily() to add a structure's transitionWatchpointSet, we
now invoke Graph::registerAndWatchStructureTransition() on the structure.
registerAndWatchStructureTransition() both registers the structure and add its
transitionWatchpointSet to the plan desired watchpoints.

Graph::registerAndWatchStructureTransition() is based on Graph::registerStructure()
except registerAndWatchStructureTransition() adds the structure's
transitionWatchpointSet unconditionally.

  • dfg/DFGArgumentsEliminationPhase.cpp:
  • dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine const):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGGraph.cpp:

(JSC::DFG::Graph::registerAndWatchStructureTransition):

  • dfg/DFGGraph.h:
  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnString):

  • The second set of addLazily()s is redundant. This set is executed only when prototypeChainIsSane is true, and prototypeChainIsSane can only be true if and only if we've executed the if statement above it. That preceding if statement already registerAndWatchStructureTransition() the same 2 structures. Hence, this second set can be deleted.
  • dfg/DFGWatchpointCollectionPhase.cpp:

(JSC::DFG::WatchpointCollectionPhase::addLazily):

  • Deleted an unused function.
  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):

Location:
trunk
Files:
1 added
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r223594 r223614  
     12017-10-18  Mark Lam  <mark.lam@apple.com>
     2
     3        The compiler should always register a structure when it adds its transitionWatchPointSet.
     4        https://bugs.webkit.org/show_bug.cgi?id=178420
     5        <rdar://problem/34814024>
     6
     7        Reviewed by Saam Barati and Filip Pizlo.
     8
     9        * stress/regress-178420.js: Added.
     10        (new.Array.10000.map):
     11
    1122017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
    213

  • trunk/Source/JavaScriptCore/ChangeLog

    r223603 r223614  
     12017-10-18  Mark Lam  <mark.lam@apple.com>
     2
     3        The compiler should always register a structure when it adds its transitionWatchPointSet.
     4        https://bugs.webkit.org/show_bug.cgi?id=178420
     5        <rdar://problem/34814024>
     6
     7        Reviewed by Saam Barati and Filip Pizlo.
     8
     9        Instead of invoking addLazily() to add a structure's transitionWatchpointSet, we
     10        now invoke Graph::registerAndWatchStructureTransition() on the structure.
     11        registerAndWatchStructureTransition() both registers the structure and add its
     12        transitionWatchpointSet to the plan desired watchpoints.
     13
     14        Graph::registerAndWatchStructureTransition() is based on Graph::registerStructure()
     15        except registerAndWatchStructureTransition() adds the structure's
     16        transitionWatchpointSet unconditionally.
     17
     18        * dfg/DFGArgumentsEliminationPhase.cpp:
     19        * dfg/DFGArrayMode.cpp:
     20        (JSC::DFG::ArrayMode::refine const):
     21        * dfg/DFGByteCodeParser.cpp:
     22        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
     23        * dfg/DFGFixupPhase.cpp:
     24        (JSC::DFG::FixupPhase::fixupNode):
     25
     26        * dfg/DFGGraph.cpp:
     27        (JSC::DFG::Graph::registerAndWatchStructureTransition):
     28        * dfg/DFGGraph.h:
     29
     30        * dfg/DFGSpeculativeJIT.cpp:
     31        (JSC::DFG::SpeculativeJIT::compileGetByValOnString):
     32        - The second set of addLazily()s is redundant.  This set is executed only when
     33          prototypeChainIsSane is true, and prototypeChainIsSane can only be true if and
     34          only if we've executed the if statement above it.  That preceding if statement
     35          already registerAndWatchStructureTransition() the same 2 structures.  Hence,
     36          this second set can be deleted.
     37
     38        * dfg/DFGWatchpointCollectionPhase.cpp:
     39        (JSC::DFG::WatchpointCollectionPhase::addLazily):
     40        - Deleted an unused function.
     41
     42        * ftl/FTLLowerDFGToB3.cpp:
     43        (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
     44
    1452017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
    246

  • trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp

    r221954 r223614  
    11/*
    2  * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    249249                // for the allocation is sane (i.e. doesn't have indexed properties).
    250250                JSGlobalObject* globalObject = m_graph.globalObjectFor(edge->origin.semantic);
    251                 InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
     251                Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure();
    252252                if (edge->op() == CreateRest) {
    253                     InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
    254                     if (arrayPrototypeTransition.isStillValid()
    255                         && objectPrototypeTransition.isStillValid()
     253                    Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure();
     254                    if (arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
     255                        && objectPrototypeStructure->transitionWatchpointSetIsStillValid()
    256256                        && globalObject->arrayPrototypeChainIsSane()) {
    257                         m_graph.watchpoints().addLazily(arrayPrototypeTransition);
    258                         m_graph.watchpoints().addLazily(objectPrototypeTransition);
     257                        m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
     258                        m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
    259259                        break;
    260260                    }
    261261                } else {
    262                     if (objectPrototypeTransition.isStillValid()
     262                    if (objectPrototypeStructure->transitionWatchpointSetIsStillValid()
    263263                        && globalObject->objectPrototypeIsSane()) {
    264                         m_graph.watchpoints().addLazily(objectPrototypeTransition);
     264                        m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
    265265                        break;
    266266                    }

  • trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

    r217202 r223614  
    11/*
    2  * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    215215            && globalObject->arrayPrototypeChainIsSane()
    216216            && !graph.hasExitSite(node->origin.semantic, OutOfBounds)) {
    217             graph.watchpoints().addLazily(globalObject->arrayPrototype()->structure()->transitionWatchpointSet());
    218             graph.watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
     217            graph.registerAndWatchStructureTransition(globalObject->arrayPrototype()->structure());
     218            graph.registerAndWatchStructureTransition(globalObject->objectPrototype()->structure());
    219219            if (globalObject->arrayPrototypeChainIsSane())
    220220                return withSpeculation(Array::SaneChain);

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r223594 r223614  
    22302230            JSGlobalObject* globalObject = m_graph.globalObjectFor(currentNodeOrigin().semantic);
    22312231
    2232             InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
    2233             InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
     2232            Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure();
     2233            Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure();
    22342234
    22352235            // FIXME: We could easily relax the Array/Object.prototype transition as long as we OSR exitted if we saw a hole.
    … …  
    22372237            if (globalObject->arraySpeciesWatchpoint().state() == IsWatched
    22382238                && globalObject->havingABadTimeWatchpoint()->isStillValid()
    2239                 && arrayPrototypeTransition.isStillValid()
    2240                 && objectPrototypeTransition.isStillValid()
     2239                && arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
     2240                && objectPrototypeStructure->transitionWatchpointSetIsStillValid()
    22412241                && globalObject->arrayPrototypeChainIsSane()) {
    22422242
    22432243                m_graph.watchpoints().addLazily(globalObject->arraySpeciesWatchpoint());
    22442244                m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
    2245                 m_graph.watchpoints().addLazily(arrayPrototypeTransition);
    2246                 m_graph.watchpoints().addLazily(objectPrototypeTransition);
     2245                m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
     2246                m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
    22472247
    22482248                insertChecks();
    … …  
    23192319            JSGlobalObject* globalObject = m_graph.globalObjectFor(currentNodeOrigin().semantic);
    23202320
    2321             InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
    2322             InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
     2321            Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure();
     2322            Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure();
    23232323
    23242324            // FIXME: We could easily relax the Array/Object.prototype transition as long as we OSR exitted if we saw a hole.
    23252325            // https://bugs.webkit.org/show_bug.cgi?id=173171
    23262326            if (globalObject->havingABadTimeWatchpoint()->isStillValid()
    2327                 && arrayPrototypeTransition.isStillValid()
    2328                 && objectPrototypeTransition.isStillValid()
     2327                && arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
     2328                && objectPrototypeStructure->transitionWatchpointSetIsStillValid()
    23292329                && globalObject->arrayPrototypeChainIsSane()) {
    23302330
    23312331                m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
    2332                 m_graph.watchpoints().addLazily(arrayPrototypeTransition);
    2333                 m_graph.watchpoints().addLazily(objectPrototypeTransition);
     2332                m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
     2333                m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
    23342334
    23352335                insertChecks();

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r223594 r223614  
    760760                       
    761761                        if (canDoSaneChain) {
    762                             m_graph.watchpoints().addLazily(
    763                                 globalObject->arrayPrototype()->structure()->transitionWatchpointSet());
    764                             m_graph.watchpoints().addLazily(
    765                                 globalObject->objectPrototype()->structure()->transitionWatchpointSet());
     762                            m_graph.registerAndWatchStructureTransition(globalObject->arrayPrototype()->structure());
     763                            m_graph.registerAndWatchStructureTransition(globalObject->objectPrototype()->structure());
    766764                            if (globalObject->arrayPrototypeChainIsSane())
    767765                                node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain));
    … …  
    12191217            // that it doesn't contain any indexed properties, and that any holes will result in
    12201218            // jsUndefined().
    1221             InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
    1222             InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
    1223             if (node->child1()->shouldSpeculateArray() 
    1224                 && arrayPrototypeTransition.isStillValid()
    1225                 && objectPrototypeTransition.isStillValid()
     1219            Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure();
     1220            Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure();
     1221            if (node->child1()->shouldSpeculateArray()
     1222                && arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
     1223                && objectPrototypeStructure->transitionWatchpointSetIsStillValid()
    12261224                && globalObject->arrayPrototypeChainIsSane()
    12271225                && m_graph.isWatchingArrayIteratorProtocolWatchpoint(node->child1().node())
    12281226                && m_graph.isWatchingHavingABadTimeWatchpoint(node->child1().node())) {
    1229                 m_graph.watchpoints().addLazily(objectPrototypeTransition);
    1230                 m_graph.watchpoints().addLazily(arrayPrototypeTransition);
     1227                m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
     1228                m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
    12311229                fixEdge<ArrayUse>(node->child1());
    12321230            } else

  • trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp

    r223086 r223614  
    15031503}
    15041504
     1505void Graph::registerAndWatchStructureTransition(Structure* structure)
     1506{
     1507    m_plan.weakReferences.addLazily(structure);
     1508    m_plan.watchpoints.addLazily(structure->transitionWatchpointSet());
     1509}
     1510
    15051511void Graph::assertIsRegistered(Structure* structure)
    15061512{

  • trunk/Source/JavaScriptCore/dfg/DFGGraph.h

    r221822 r223614  
    229229    }
    230230    RegisteredStructure registerStructure(Structure*, StructureRegistrationResult&);
     231    void registerAndWatchStructureTransition(Structure*);
    231232    void assertIsRegistered(Structure* structure);
    232233   

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r223594 r223614  
    21382138            // indexed properties either.
    21392139            // https://bugs.webkit.org/show_bug.cgi?id=144668
    2140             m_jit.graph().watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
    2141             m_jit.graph().watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
     2140            m_jit.graph().registerAndWatchStructureTransition(globalObject->stringPrototype()->structure());
     2141            m_jit.graph().registerAndWatchStructureTransition(globalObject->objectPrototype()->structure());
    21422142            prototypeChainIsSane = globalObject->stringPrototypeChainIsSane();
    21432143        }
    21442144        if (prototypeChainIsSane) {
    2145             m_jit.graph().watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
    2146             m_jit.graph().watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
    2147            
    21482145#if USE(JSVALUE64)
    21492146            addSlowPathGenerator(std::make_unique<SaneStringGetByValSlowPathGenerator>(

  • trunk/Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp

    r203364 r223614  
    113113        m_graph.watchpoints().addLazily(set);
    114114    }
    115     void addLazily(InlineWatchpointSet& set)
    116     {
    117         m_graph.watchpoints().addLazily(set);
    118     }
    119115   
    120116    JSGlobalObject* globalObject()

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r223594 r223614  
    57605760                // https://bugs.webkit.org/show_bug.cgi?id=144668
    57615761               
    5762                 m_graph.watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());
    5763                 m_graph.watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());
    5764                
     5762                m_graph.registerAndWatchStructureTransition(globalObject->stringPrototype()->structure());
     5763                m_graph.registerAndWatchStructureTransition(globalObject->objectPrototype()->structure());
     5764
    57655765                prototypeChainIsSane = globalObject->stringPrototypeChainIsSane();
    57665766            }
Note: See TracChangeset for help on using the changeset viewer.