Changeset 167564 in webkit


Ignore:
Timestamp:
Apr 20, 2014 4:45:32 AM (10 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r167501.
​https://bugs.webkit.org/show_bug.cgi?id=131913

It broke DYEBench (Requested by mhahnenberg on #webkit).

Reverted changeset:

"Deleting properties poisons objects"
​https://bugs.webkit.org/show_bug.cgi?id=131551
​http://trac.webkit.org/changeset/167501

Location:
trunk
Files:
3 deleted
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r167562 r167564  
     12014-04-20  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r167501.
     4        https://bugs.webkit.org/show_bug.cgi?id=131913
     5
     6        It broke DYEBench (Requested by mhahnenberg on #webkit).
     7
     8        Reverted changeset:
     9
     10        "Deleting properties poisons objects"
     11        https://bugs.webkit.org/show_bug.cgi?id=131551
     12        http://trac.webkit.org/changeset/167501
     13
    1142014-04-19  Zalan Bujtas  <zalan@apple.com>
    215

  • trunk/Source/JavaScriptCore/ChangeLog

    r167563 r167564  
     12014-04-20  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r167501.
     4        https://bugs.webkit.org/show_bug.cgi?id=131913
     5
     6        It broke DYEBench (Requested by mhahnenberg on #webkit).
     7
     8        Reverted changeset:
     9
     10        "Deleting properties poisons objects"
     11        https://bugs.webkit.org/show_bug.cgi?id=131551
     12        http://trac.webkit.org/changeset/167501
     13
    1142014-04-19  Filip Pizlo  <fpizlo@apple.com>
    215

  • trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp

    r167501 r167564  
    6464    jsPropertyNameIterator->finishCreation(vm, propertyNames.data(), o);
    6565
    66     // JSPropertyNameIterator doesn't know how to skip deleted buckets, so just give up.
    67     if (o->structure()->isDictionary() || o->structure()->hasDeletedOffsets())
     66    if (o->structure()->isDictionary())
    6867        return jsPropertyNameIterator;
    6968

  • trunk/Source/JavaScriptCore/runtime/Structure.cpp

    r167501 r167564  
    166166    , m_offset(invalidOffset)
    167167    , m_inlineCapacity(inlineCapacity)
    168     , m_forgivenDeletes(0)
    169168    , m_dictionaryKind(NoneDictionaryKind)
    170169    , m_isPinnedPropertyTable(false)
    … …  
    194193    , m_offset(invalidOffset)
    195194    , m_inlineCapacity(0)
    196     , m_forgivenDeletes(0)
    197195    , m_dictionaryKind(NoneDictionaryKind)
    198196    , m_isPinnedPropertyTable(false)
    … …  
    221219    , m_offset(invalidOffset)
    222220    , m_inlineCapacity(previous->m_inlineCapacity)
    223     , m_forgivenDeletes(previous->m_forgivenDeletes)
    224221    , m_dictionaryKind(previous->m_dictionaryKind)
    225222    , m_isPinnedPropertyTable(false)
    … …  
    314311        if (!structure->m_nameInPrevious)
    315312            continue;
    316 
    317         PropertyMapEntry entry(vm, this,
    318             structure->m_nameInPrevious.get(),
    319             propertyTable()->nextOffset(m_inlineCapacity),
    320             structure->m_attributesInPrevious,
    321             structure->m_specificValueInPrevious.get());
     313        PropertyMapEntry entry(vm, this, structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious.get());
    322314        propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
    323315    }
    … …  
    467459    ASSERT(!structure->isUncacheableDictionary());
    468460
    469     if (structure->m_forgivenDeletes < s_maxForgivenDeletes) {
    470         Structure* transition = create(vm, structure);
    471 
    472         DeferGC deferGC(vm.heap);
    473         structure->materializePropertyMapIfNecessary(vm, deferGC);
    474         transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
    475         transition->m_offset = structure->m_offset;
    476         transition->pinAndPreventTransitions();
    477 
    478         offset = transition->remove(propertyName);
    479         ASSERT(offset != invalidOffset);
    480         transition->m_forgivenDeletes = structure->m_forgivenDeletes + 1;
    481 
    482         transition->checkOffsetConsistency();
    483         return transition;
    484     }
    485 
    486461    Structure* transition = toUncacheableDictionaryTransition(vm, structure);
     462
    487463    offset = transition->remove(propertyName);
     464
    488465    transition->checkOffsetConsistency();
    489466    return transition;
    … …  
    500477    transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
    501478    transition->m_offset = structure->m_offset;
    502     transition->pinAndPreventTransitions();
     479    transition->pin();
    503480
    504481    transition->checkOffsetConsistency();
    … …  
    517494    transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
    518495    transition->m_offset = structure->m_offset;
    519     transition->pinAndPreventTransitions();
     496    transition->pin();
    520497
    521498    if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
    … …  
    539516        transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
    540517        transition->m_offset = structure->m_offset;
    541         transition->pinAndPreventTransitions();
     518        transition->pin();
    542519       
    543520        structure = transition;
    … …  
    564541    transition->m_offset = structure->m_offset;
    565542    transition->m_dictionaryKind = kind;
    566     transition->pinAndPreventTransitions();
     543    transition->pin();
    567544
    568545    transition->checkOffsetConsistency();
    … …  
    627604    transition->m_offset = structure->m_offset;
    628605    transition->m_preventExtensions = true;
    629     transition->pinAndPreventTransitions();
     606    transition->pin();
    630607
    631608    transition->checkOffsetConsistency();
    … …  
    776753    materializePropertyMapIfNecessaryForPinning(vm, deferGC);
    777754   
    778     pinAndPreventTransitions();
     755    pin();
    779756
    780757    return putSpecificValue(vm, propertyName, attributes, specificValue);
    … …  
    789766    materializePropertyMapIfNecessaryForPinning(vm, deferGC);
    790767
    791     pinAndPreventTransitions();
     768    pin();
    792769    return remove(propertyName);
    793770}
    … …  
    797774    ASSERT(propertyTable());
    798775    m_isPinnedPropertyTable = true;
    799 }
    800 
    801 void Structure::pinAndPreventTransitions()
    802 {
    803     pin();
    804776    clearPreviousID();
    805777    m_nameInPrevious.clear();

  • trunk/Source/JavaScriptCore/runtime/Structure.h

    r167501 r167564  
    138138    void setPrototypeWithoutTransition(VM& vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }
    139139       
    140     bool hasDeletedOffsets() const;
    141 
    142140    bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
    143141    bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
    … …  
    414412
    415413    WriteBarrier<PropertyTable>& propertyTable();
    416     const WriteBarrier<PropertyTable>& propertyTable() const;
    417414    PropertyTable* takePropertyTableOrCloneIfPinned(VM&, Structure* owner);
    418415    PropertyTable* copyPropertyTable(VM&, Structure* owner);
    … …  
    461458       
    462459    void pin();
    463     void pinAndPreventTransitions();
    464460
    465461    Structure* previous() const
    … …  
    517513    ConcurrentJITLock m_lock;
    518514   
    519     static const unsigned s_maxForgivenDeletes = 5;
    520     unsigned m_forgivenDeletes;
    521 
    522515    unsigned m_dictionaryKind : 2;
    523516    bool m_isPinnedPropertyTable : 1;

  • trunk/Source/JavaScriptCore/runtime/StructureInlines.h

    r167501 r167564  
    218218}
    219219
    220 inline bool Structure::hasDeletedOffsets() const
    221 {
    222     // If we had deleted anything then we would have pinned our property table.
    223     if (!propertyTable())
    224         return false;
    225     return propertyTable()->hasDeletedOffset();
    226 }
    227 
    228 inline WriteBarrier<PropertyTable>& Structure::propertyTable()
    229 {
    230     return const_cast<WriteBarrier<PropertyTable>&>(static_cast<const Structure*>(this)->propertyTable());
    231 }
    232 
    233 inline const WriteBarrier<PropertyTable>& Structure::propertyTable() const
     220ALWAYS_INLINE WriteBarrier<PropertyTable>& Structure::propertyTable()
    234221{
    235222    ASSERT(!globalObject() || !globalObject()->vm().heap.isCollecting());
    … …  
    253240        return true;
    254241   
     242    RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize());
    255243    unsigned totalSize = propertyTable->propertyStorageSize();
    256     RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == totalSize);
    257244    RELEASE_ASSERT((totalSize < inlineCapacity() ? 0 : totalSize - inlineCapacity()) == numberOfOutOfLineSlotsForLastOffset(m_offset));
    258245
Note: See TracChangeset for help on using the changeset viewer.