Changeset 240991 in webkit


Ignore:
Timestamp:
Feb 5, 2019, 1:59:52 PM (6 years ago)
Author:
mark.lam@apple.com
Message:

Move DFG nodes that clobberize() says will write(Heap) to the doesGC() list that returns true.
​https://bugs.webkit.org/show_bug.cgi?id=194298
<rdar://problem/47827555>

Reviewed by Saam Barati.

We do this for 3 reasons:

  1. It's clearer when reading doesGC()'s code that these nodes will return true.
  2. If things change in the future where clobberize() no longer reports these nodes as write(Heap), each node should be vetted first to make sure that it can never GC before being moved back to the doesGC() list that returns false.
  3. This reduces the list of nodes that we need to audit to make sure doesGC() is correct in its claims about the nodes' GCing possibility.

The list of nodes moved are:

ArrayPush
ArrayPop
Call
CallEval
CallForwardVarargs
CallVarargs
Construct
ConstructForwardVarargs
ConstructVarargs
DefineDataProperty
DefineAccessorProperty
DeleteById
DeleteByVal
DirectCall
DirectConstruct
DirectTailCallInlinedCaller
GetById
GetByIdDirect
GetByIdDirectFlush
GetByIdFlush
GetByIdWithThis
GetByValWithThis
GetDirectPname
GetDynamicVar
HasGenericProperty
HasOwnProperty
HasStructureProperty
InById
InByVal
InstanceOf
InstanceOfCustom
LoadVarargs
NumberToStringWithRadix
PutById
PutByIdDirect
PutByIdFlush
PutByIdWithThis
PutByOffset
PutByValWithThis
PutDynamicVar
PutGetterById
PutGetterByVal
PutGetterSetterById
PutSetterById
PutSetterByVal
PutStack
PutToArguments
RegExpExec
RegExpTest
ResolveScope
ResolveScopeForHoistingFuncDeclInEval
TailCall
TailCallForwardVarargsInlinedCaller
TailCallInlinedCaller
TailCallVarargsInlinedCaller
ToNumber
ToPrimitive
ValueNegate

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

Location:
trunk/Source/JavaScriptCore
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r240981 r240991  
     12019-02-05  Mark Lam  <mark.lam@apple.com>
     2
     3        Move DFG nodes that clobberize() says will write(Heap) to the doesGC() list that returns true.
     4        https://bugs.webkit.org/show_bug.cgi?id=194298
     5        <rdar://problem/47827555>
     6
     7        Reviewed by Saam Barati.
     8
     9        We do this for 3 reasons:
     10        1. It's clearer when reading doesGC()'s code that these nodes will return true.
     11        2. If things change in the future where clobberize() no longer reports these nodes
     12           as write(Heap), each node should be vetted first to make sure that it can never
     13           GC before being moved back to the doesGC() list that returns false.
     14        3. This reduces the list of nodes that we need to audit to make sure doesGC() is
     15           correct in its claims about the nodes' GCing possibility.
     16
     17        The list of nodes moved are:
     18
     19            ArrayPush
     20            ArrayPop
     21            Call
     22            CallEval
     23            CallForwardVarargs
     24            CallVarargs
     25            Construct
     26            ConstructForwardVarargs
     27            ConstructVarargs
     28            DefineDataProperty
     29            DefineAccessorProperty
     30            DeleteById
     31            DeleteByVal
     32            DirectCall
     33            DirectConstruct
     34            DirectTailCallInlinedCaller
     35            GetById
     36            GetByIdDirect
     37            GetByIdDirectFlush
     38            GetByIdFlush
     39            GetByIdWithThis
     40            GetByValWithThis
     41            GetDirectPname
     42            GetDynamicVar
     43            HasGenericProperty
     44            HasOwnProperty
     45            HasStructureProperty
     46            InById
     47            InByVal
     48            InstanceOf
     49            InstanceOfCustom
     50            LoadVarargs
     51            NumberToStringWithRadix
     52            PutById
     53            PutByIdDirect
     54            PutByIdFlush
     55            PutByIdWithThis
     56            PutByOffset
     57            PutByValWithThis
     58            PutDynamicVar
     59            PutGetterById
     60            PutGetterByVal
     61            PutGetterSetterById
     62            PutSetterById
     63            PutSetterByVal
     64            PutStack
     65            PutToArguments
     66            RegExpExec
     67            RegExpTest
     68            ResolveScope
     69            ResolveScopeForHoistingFuncDeclInEval
     70            TailCall
     71            TailCallForwardVarargsInlinedCaller
     72            TailCallInlinedCaller
     73            TailCallVarargsInlinedCaller
     74            ToNumber
     75            ToPrimitive
     76            ValueNegate
     77
     78        * dfg/DFGDoesGC.cpp:
     79        (JSC::DFG::doesGC):
     80
    1812019-02-05  Yusuke Suzuki  <ysuzuki@apple.com>
    282

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r240917 r240991  
    9898    case ArithFRound:
    9999    case ArithUnary:
    100     case ValueNegate:
    101100    case TryGetById:
    102     case GetById:
    103     case GetByIdFlush:
    104     case GetByIdWithThis:
    105     case GetByIdDirect:
    106     case GetByIdDirectFlush:
    107     case PutById:
    108     case PutByIdFlush:
    109     case PutByIdWithThis:
    110     case PutByValWithThis:
    111     case PutByIdDirect:
    112     case PutGetterById:
    113     case PutSetterById:
    114     case PutGetterSetterById:
    115     case PutGetterByVal:
    116     case PutSetterByVal:
    117     case DefineDataProperty:
    118     case DefineAccessorProperty:
    119     case DeleteById:
    120     case DeleteByVal:
    121101    case CheckStructure:
    122102    case CheckStructureOrEmpty:
    … …  
    142122    case AssertNotEmpty:
    143123    case CheckStringIdent:
    144     case RegExpExec:
    145124    case RegExpExecNonGlobalOrSticky:
    146     case RegExpTest:
    147125    case RegExpMatchFast:
    148126    case RegExpMatchFastGlobal:
    … …  
    156134    case CompareStrictEq:
    157135    case CompareEqPtr:
    158     case Call:
    159     case DirectCall:
    160     case TailCallInlinedCaller:
    161     case DirectTailCallInlinedCaller:
    162     case Construct:
    163     case DirectConstruct:
    164     case CallVarargs:
    165     case CallEval:
    166     case TailCallVarargsInlinedCaller:
    167     case ConstructVarargs:
    168     case LoadVarargs:
    169     case CallForwardVarargs:
    170     case ConstructForwardVarargs:
    171136    case TailCallForwardVarargs:
    172     case TailCallForwardVarargsInlinedCaller:
    173137    case ProfileType:
    174138    case ProfileControlFlow:
    175139    case OverridesHasInstance:
    176     case InstanceOf:
    177     case InstanceOfCustom:
    178140    case IsEmpty:
    179141    case IsUndefined:
    … …  
    189151    case TypeOf:
    190152    case LogicalNot:
    191     case ToPrimitive:
    192     case ToNumber:
    193     case NumberToStringWithRadix:
    194153    case NumberToStringWithValidRadixConstant:
    195     case InByVal:
    196     case InById:
    197     case HasOwnProperty:
    198154    case Jump:
    199155    case Branch:
    … …  
    201157    case EntrySwitch:
    202158    case Return:
    203     case TailCall:
    204159    case DirectTailCall:
    205160    case TailCallVarargs:
    … …  
    246201    case GetSetter:
    247202    case GetByVal:
    248     case GetByValWithThis:
    249203    case GetArrayLength:
    250204    case GetVectorLength:
    251     case ArrayPush:
    252     case ArrayPop:
    253205    case StringCharAt:
    254206    case StringCharCodeAt:
    … …  
    261213    case GetByOffset:
    262214    case GetGetterSetterByOffset:
    263     case PutByOffset:
    264215    case GetEnumerableLength:
    265     case HasGenericProperty:
    266     case HasStructureProperty:
    267216    case HasIndexedProperty:
    268     case GetDirectPname:
    269217    case FiatInt52:
    270218    case BooleanToNumber:
    … …  
    288236    case ForwardVarargs:
    289237    case PutHint:
    290     case PutStack:
    291238    case KillStack:
    292239    case GetStack:
    293240    case GetFromArguments:
    294     case PutToArguments:
    295241    case GetArgument:
    296242    case LogShadowChickenPrologue:
    297243    case LogShadowChickenTail:
    298     case GetDynamicVar:
    299     case PutDynamicVar:
    300     case ResolveScopeForHoistingFuncDeclInEval:
    301     case ResolveScope:
    302244    case NukeStructureAndSetButterfly:
    303245    case AtomicsAdd:
    … …  
    321263        return false;
    322264
     265    case ArrayPush:
     266    case ArrayPop:
    323267    case PushWithScope:
    324268    case CreateActivation:
    … …  
    326270    case CreateScopedArguments:
    327271    case CreateClonedArguments:
     272    case Call:
     273    case CallEval:
     274    case CallForwardVarargs:
    328275    case CallObjectConstructor:
     276    case CallVarargs:
     277    case Construct:
     278    case ConstructForwardVarargs:
     279    case ConstructVarargs:
     280    case DefineDataProperty:
     281    case DefineAccessorProperty:
     282    case DeleteById:
     283    case DeleteByVal:
     284    case DirectCall:
     285    case DirectConstruct:
     286    case DirectTailCallInlinedCaller:
     287    case GetById:
     288    case GetByIdDirect:
     289    case GetByIdDirectFlush:
     290    case GetByIdFlush:
     291    case GetByIdWithThis:
     292    case GetByValWithThis:
     293    case GetDirectPname:
     294    case GetDynamicVar:
     295    case HasGenericProperty:
     296    case HasOwnProperty:
     297    case HasStructureProperty:
     298    case InById:
     299    case InByVal:
     300    case InstanceOf:
     301    case InstanceOfCustom:
     302    case LoadVarargs:
     303    case NumberToStringWithRadix:
     304    case PutById:
     305    case PutByIdDirect:
     306    case PutByIdFlush:
     307    case PutByIdWithThis:
     308    case PutByOffset:
     309    case PutByValWithThis:
     310    case PutDynamicVar:
     311    case PutGetterById:
     312    case PutGetterByVal:
     313    case PutGetterSetterById:
     314    case PutSetterById:
     315    case PutSetterByVal:
     316    case PutStack:
     317    case PutToArguments:
     318    case RegExpExec:
     319    case RegExpTest:
     320    case ResolveScope:
     321    case ResolveScopeForHoistingFuncDeclInEval:
     322    case TailCall:
     323    case TailCallForwardVarargsInlinedCaller:
     324    case TailCallInlinedCaller:
     325    case TailCallVarargsInlinedCaller:
     326    case ToNumber:
    329327    case ToObject:
     328    case ToPrimitive:
    330329    case ToThis:
    331330    case CreateThis:
    … …  
    380379    case ValueMul:
    381380    case ValueDiv:
     381    case ValueNegate:
    382382        return true;
    383383
Note: See TracChangeset for help on using the changeset viewer.