Changeset 190682 in webkit

Timestamp:

Oct 7, 2015 1:27:46 PM (9 years ago)

Author:

fpizlo@apple.com

Message:

Don't setOutOfBounds in JIT code for PutByVal, since the C++ slow path already does it
​https://bugs.webkit.org/show_bug.cgi?id=149885

Reviewed by Geoffrey Garen.

This simplifies the slow path code, which will make it easier to put read barriers on all of
the butterflies.

• jit/JITOperations.cpp:

(JSC::getByVal):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::emitSlow_op_put_by_val):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITOperations.cpp (modified) (5 diffs)
• jit/JITPropertyAccess.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-10-07  Filip Pizlo  <fpizlo@apple.com>
+
+        Don't setOutOfBounds in JIT code for PutByVal, since the C++ slow path already does it
+        https://bugs.webkit.org/show_bug.cgi?id=149885
+
+        Reviewed by Geoffrey Garen.
+
+        This simplifies the slow path code, which will make it easier to put read barriers on all of
+        the butterflies.
+
+        * jit/JITOperations.cpp:
+        (JSC::getByVal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitSlow_op_put_by_val):
+
 2015-10-07  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -402 +402 @@
                 object->setIndexQuickly(callFrame->vm(), i, value);
             else {
+                // FIXME: This will make us think that in-bounds typed array accesses are actually
+                // out-of-bounds.
+                // https://bugs.webkit.org/show_bug.cgi?id=149886
                 byValInfo->arrayProfile->setOutOfBounds();
                 object->methodTable(vm)->putByIndex(object, callFrame, i, value, callFrame->codeBlock()->isStrictMode());
@@ -435 +438 @@
         }
 
+        // FIXME: This will make us think that in-bounds typed array accesses are actually
+        // out-of-bounds.
+        // https://bugs.webkit.org/show_bug.cgi?id=149886
         byValInfo->arrayProfile->setOutOfBounds();
         baseObject->putDirectIndex(callFrame, index, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
@@ -1589 +1595 @@
                 return object->getIndexQuickly(i);
 
-            if (!canAccessArgumentIndexQuickly(*object, i))
+            if (!canAccessArgumentIndexQuickly(*object, i)) {
+                // FIXME: This will make us think that in-bounds typed array accesses are actually
+                // out-of-bounds.
+                // https://bugs.webkit.org/show_bug.cgi?id=149886
                 byValInfo->arrayProfile->setOutOfBounds();
+            }
         }
 
@@ -1751 +1761 @@
         return JSValue::encode(JSValue(JSValue::JSTrue));
 
-    if (!canAccessArgumentIndexQuickly(*object, index))
+    if (!canAccessArgumentIndexQuickly(*object, index)) {
+        // FIXME: This will make us think that in-bounds typed array accesses are actually
+        // out-of-bounds.
+        // https://bugs.webkit.org/show_bug.cgi?id=149886
         byValInfo->arrayProfile->setOutOfBounds();
+    }
     return JSValue::encode(jsBoolean(object->hasProperty(exec, index)));
 }
@@ -1771 +1785 @@
         return JSValue::encode(JSValue(JSValue::JSTrue));
 
-    if (!canAccessArgumentIndexQuickly(*object, index))
+    if (!canAccessArgumentIndexQuickly(*object, index)) {
+        // FIXME: This will make us think that in-bounds typed array accesses are actually
+        // out-of-bounds.
+        // https://bugs.webkit.org/show_bug.cgi?id=149886
         byValInfo->arrayProfile->setOutOfBounds();
+    }
     return JSValue::encode(jsBoolean(object->hasProperty(exec, subscript.asUInt32())));
 }

trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -449 +449 @@
     linkSlowCase(iter); // base not array check
     
+    linkSlowCase(iter); // out of bounds
+
     JITArrayMode mode = chooseArrayMode(profile);
     switch (mode) {
@@ -458 +460 @@
         break;
     }
-    
-    Jump skipProfiling = jump();
-    linkSlowCase(iter); // out of bounds
-    emitArrayProfileOutOfBoundsSpecialCase(profile);
-    skipProfiling.link(this);
     
     Label slowPath = label();