Changeset 194141 in webkit


Ignore:
Timestamp:
Dec 16, 2015 4:47:55 AM (8 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r194135.
​https://bugs.webkit.org/show_bug.cgi?id=152333

due to missing OSR exit materialization support in FTL
(Requested by yusukesuzuki on #webkit).

Reverted changeset:

"[ES6] Handle new_generator_func / new_generator_func_exp in
DFG / FTL"
​https://bugs.webkit.org/show_bug.cgi?id=152227
​http://trac.webkit.org/changeset/194135

Location:
trunk
Files:
7 deleted
23 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r194136 r194141  
     12015-12-16  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r194135.
     4        https://bugs.webkit.org/show_bug.cgi?id=152333
     5
     6        due to missing OSR exit materialization support in FTL
     7        (Requested by yusukesuzuki on #webkit).
     8
     9        Reverted changeset:
     10
     11        "[ES6] Handle new_generator_func / new_generator_func_exp in
     12        DFG / FTL"
     13        https://bugs.webkit.org/show_bug.cgi?id=152227
     14        http://trac.webkit.org/changeset/194135
     15
    1162015-12-16  Youenn Fablet  <youenn.fablet@crf.canon.fr>
    217

  • trunk/LayoutTests/js/regress/script-tests/generator-function-create.js

    r194135 r194141  
    88    return gen;
    99}
    10 function test()
    11 {
    12     for (var i = 0; i < 500; ++i)
    13         createGeneratorFunction();
    14 }
    15 noInline(test);
    16 
     10noInline(createGeneratorFunction);
    1711for (var i = 0; i < 1e4; ++i)
    18     test();
     12    createGeneratorFunction();

  • trunk/Source/JavaScriptCore/ChangeLog

    r194140 r194141  
     12015-12-16  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r194135.
     4        https://bugs.webkit.org/show_bug.cgi?id=152333
     5
     6        due to missing OSR exit materialization support in FTL
     7        (Requested by yusukesuzuki on #webkit).
     8
     9        Reverted changeset:
     10
     11        "[ES6] Handle new_generator_func / new_generator_func_exp in
     12        DFG / FTL"
     13        https://bugs.webkit.org/show_bug.cgi?id=152227
     14        http://trac.webkit.org/changeset/194135
     15
    1162015-12-16  Youenn Fablet  <youenn.fablet@crf.canon.fr>
    217

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r194135 r194141  
    17611761            m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->arrowFunctionStructure());
    17621762        break;
    1763 
    1764     case NewGeneratorFunction:
    1765         forNode(node).set(
    1766             m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->generatorFunctionStructure());
    1767         break;
    1768 
     1763           
    17691764    case NewFunction:
    17701765        forNode(node).set(

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r194135 r194141  
    45584558        }
    45594559           
    4560         case op_new_func:
    4561         case op_new_generator_func: {
     4560        case op_new_func: {
    45624561            FunctionExecutable* decl = m_inlineStackTop->m_profiledBlock->functionDecl(currentInstruction[3].u.operand);
    45634562            FrozenValue* frozen = m_graph.freezeStrong(decl);
    4564             NodeType op = (opcodeID == op_new_generator_func) ? NewGeneratorFunction : NewFunction;
    4565             set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
    4566             static_assert(OPCODE_LENGTH(op_new_func) == OPCODE_LENGTH(op_new_generator_func), "The length of op_new_func should eqaual to one of op_new_generator_func");
     4563            set(VirtualRegister(currentInstruction[1].u.operand),
     4564                addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
    45674565            NEXT_OPCODE(op_new_func);
    45684566        }
    45694567
    45704568        case op_new_func_exp:
    4571         case op_new_generator_func_exp:
    45724569        case op_new_arrow_func_exp: {
    45734570            FunctionExecutable* expr = m_inlineStackTop->m_profiledBlock->functionExpr(currentInstruction[3].u.operand);
    45744571            FrozenValue* frozen = m_graph.freezeStrong(expr);
    4575             NodeType op = (opcodeID == op_new_generator_func_exp) ? NewGeneratorFunction : NewFunction;
    4576             set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(op, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
    4577            
    4578             if (opcodeID == op_new_func_exp || opcodeID == op_new_generator_func_exp) {
     4572            set(VirtualRegister(currentInstruction[1].u.operand),
     4573                addToGraph(NewFunction, OpInfo(frozen), get(VirtualRegister(currentInstruction[2].u.operand))));
     4574           
     4575            if (opcodeID == op_new_func_exp) {
    45794576                // Curly braces are necessary
    4580                 static_assert(OPCODE_LENGTH(op_new_func_exp) == OPCODE_LENGTH(op_new_generator_func_exp), "The length of op_new_func_exp should eqaual to one of op_new_generator_func_exp");
    45814577                NEXT_OPCODE(op_new_func_exp);
    45824578            } else {

  • trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp

    r194135 r194141  
    216216    case op_new_func:
    217217    case op_new_func_exp:
    218     case op_new_generator_func:
    219     case op_new_generator_func_exp:
    220218    case op_new_arrow_func_exp:
    221219    case op_create_lexical_environment:

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r194135 r194141  
    10341034    case NewArrowFunction:
    10351035    case NewFunction:
    1036     case NewGeneratorFunction:
    10371036        if (node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid())
    10381037            write(Watchpoint_fire);

  • trunk/Source/JavaScriptCore/dfg/DFGClobbersExitState.cpp

    r194135 r194141  
    7878    case NewArrowFunction:
    7979    case NewFunction:
    80     case NewGeneratorFunction:
    8180        // Like above, but with the JSFunction allocation caveat.
    8281        return node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid();

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r194135 r194141  
    248248    case NewArrowFunction:
    249249    case NewFunction:
    250     case NewGeneratorFunction:
    251250    case NewTypedArray:
    252251    case ThrowReferenceError:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r194135 r194141  
    13881388        case CreateScopedArguments:
    13891389        case CreateActivation:
    1390         case NewFunction:
    1391         case NewGeneratorFunction: {
     1390        case NewFunction: {
    13921391            fixEdge<CellUse>(node->child1());
    13931392            break;

  • trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp

    r194135 r194141  
    144144    case NewFunction:
    145145    case NewArrowFunction:
    146     case NewGeneratorFunction:
    147146    case NewStringObject:
    148147    case CreateActivation:

  • trunk/Source/JavaScriptCore/dfg/DFGNode.h

    r194135 r194141  
    586586    void convertToPhantomNewFunction()
    587587    {
    588         ASSERT(m_op == NewFunction || m_op == NewArrowFunction || m_op == NewGeneratorFunction);
     588        ASSERT(m_op == NewFunction || m_op == NewArrowFunction);
    589589        m_op = PhantomNewFunction;
    590590        m_flags |= NodeMustGenerate;
    … …  
    13571357        case NewFunction:
    13581358        case NewArrowFunction:
    1359         case NewGeneratorFunction:
    13601359        case CreateActivation:
    13611360        case MaterializeCreateActivation:
    … …  
    15761575        case NewArrowFunction:
    15771576        case NewFunction:
    1578         case NewGeneratorFunction:
    15791577            return true;
    15801578        default:

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r194135 r194141  
    313313    \
    314314    macro(NewArrowFunction, NodeResultJS) \
    315     macro(NewGeneratorFunction, NodeResultJS) \
    316315    \
    317316    /* These aren't terminals but always exit */ \

  • trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp

    r194135 r194141  
    140140    // replace any use of those pointers by the corresponding
    141141    // materialization
    142     enum class Kind { Escaped, Object, Activation, Function, ArrowFunction, GeneratorFunction };
     142    enum class Kind { Escaped, Object, Activation, Function, NewArrowFunction };
    143143
    144144    explicit Allocation(Node* identifier = nullptr, Kind kind = Kind::Escaped)
    … …  
    234234    bool isFunctionAllocation() const
    235235    {
    236         return m_kind == Kind::Function || m_kind == Kind::ArrowFunction || m_kind == Kind::GeneratorFunction;
     236        return m_kind == Kind::Function || m_kind == Kind::NewArrowFunction;
     237    }
     238   
     239    bool isArrowFunctionAllocation() const
     240    {
     241        return m_kind == Kind::NewArrowFunction;
    237242    }
    238243
    … …  
    270275            break;
    271276               
    272         case Kind::ArrowFunction:
    273             out.print("ArrowFunction");
    274             break;
    275 
    276         case Kind::GeneratorFunction:
    277             out.print("GeneratorFunction");
     277        case Kind::NewArrowFunction:
     278            out.print("NewArrowFunction");
    278279            break;
    279280
    … …  
    837838
    838839        case NewFunction:
    839         case NewArrowFunction:
    840         case NewGeneratorFunction: {
     840        case NewArrowFunction: {
    841841            if (node->castOperand<FunctionExecutable*>()->singletonFunction()->isStillValid()) {
    842842                m_heap.escape(node->child1().node());
    … …  
    844844            }
    845845           
    846             if (node->op() == NewGeneratorFunction)
    847                 target = &m_heap.newAllocation(node, Allocation::Kind::GeneratorFunction);
    848             else if (node->op() == NewArrowFunction)
    849                 target = &m_heap.newAllocation(node, Allocation::Kind::ArrowFunction);
    850             else
    851                 target = &m_heap.newAllocation(node, Allocation::Kind::Function);
     846            target = &m_heap.newAllocation(node, Allocation::Kind::Function);
    852847            writes.add(FunctionExecutablePLoc, LazyNode(node->cellOperand()));
    853848            writes.add(FunctionActivationPLoc, LazyNode(node->child1().node()));
    … …  
    14521447        }
    14531448
    1454         case Allocation::Kind::ArrowFunction:
    1455         case Allocation::Kind::GeneratorFunction:
     1449        case Allocation::Kind::NewArrowFunction:
    14561450        case Allocation::Kind::Function: {
    14571451            FrozenValue* executable = allocation.identifier()->cellOperand();
    14581452           
    1459             NodeType nodeType =
    1460                 allocation.kind() == Allocation::Kind::ArrowFunction ? NewArrowFunction :
    1461                 allocation.kind() == Allocation::Kind::GeneratorFunction ? NewGeneratorFunction : NewFunction;
     1453            NodeType nodeType = allocation.kind() == Allocation::Kind::NewArrowFunction ? NewArrowFunction : NewFunction;
    14621454           
    14631455            return m_graph.addNode(
    … …  
    17911783                    case NewArrowFunction:
    17921784                    case NewFunction:
    1793                     case NewGeneratorFunction:
    17941785                        node->convertToPhantomNewFunction();
    17951786                        break;
    … …  
    20432034       
    20442035        case NewFunction:
    2045         case NewArrowFunction:
    2046         case NewGeneratorFunction: {
     2036        case NewArrowFunction: {
    20472037            Vector<PromotedHeapLocation> locations = m_locationsForAllocation.get(escapee);
    20482038            ASSERT(locations.size() == 2);

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r194135 r194141  
    210210        case GetCallee:
    211211        case NewArrowFunction:
    212         case NewFunction:
    213         case NewGeneratorFunction: {
     212        case NewFunction: {
    214213            changed |= setPrediction(SpecFunction);
    215214            break;

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r194135 r194141  
    269269    case NewArrowFunction:
    270270    case NewFunction:
    271     case NewGeneratorFunction:
    272271    case Jump:
    273272    case Branch:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r194135 r194141  
    5151#include "JSCInlines.h"
    5252#include "JSEnvironmentRecord.h"
    53 #include "JSGeneratorFunction.h"
    5453#include "JSLexicalEnvironment.h"
    5554#include "LinkBuffer.h"
    … …  
    53745373{
    53755374    NodeType nodeType = node->op();
    5376     ASSERT(nodeType == NewFunction || nodeType == NewArrowFunction || nodeType == NewGeneratorFunction);
     5375    ASSERT(nodeType == NewFunction || nodeType == NewArrowFunction);
    53775376   
    53785377    SpeculateCellOperand scope(this, node->child1());
    … …  
    54125411            callOperation(operationNewArrowFunction, resultGPR, scopeGPR, executable, thisValueTagGPR, thisValuePayloadGPR);
    54135412#endif
    5414         else if (nodeType == NewGeneratorFunction)
    5415             callOperation(operationNewGeneratorFunction, resultGPR, scopeGPR, executable);
    54165413        else
    54175414            callOperation(operationNewFunction, resultGPR, scopeGPR, executable);
    … …  
    54215418    }
    54225419
    5423     Structure* structure =
    5424         nodeType == NewArrowFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->arrowFunctionStructure() :
    5425         nodeType == NewGeneratorFunction ? m_jit.graph().globalObjectFor(node->origin.semantic)->generatorFunctionStructure() :
    5426         m_jit.graph().globalObjectFor(node->origin.semantic)->functionStructure();
     5420    Structure* structure = nodeType == NewArrowFunction
     5421        ? m_jit.graph().globalObjectFor(node->origin.semantic)->arrowFunctionStructure()
     5422        : m_jit.graph().globalObjectFor(node->origin.semantic)->functionStructure();
    54275423   
    54285424    GPRTemporary result(this);
    … …  
    54405436           
    54415437        addSlowPathGenerator(slowPathCall(slowPath, this, operationNewFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
    5442     }
    5443 
    5444     if (nodeType == NewGeneratorFunction) {
    5445         compileNewFunctionCommon<JSGeneratorFunction>(resultGPR, structure, scratch1GPR, scratch2GPR, scopeGPR, slowPath, JSGeneratorFunction::allocationSize(0), executable, JSGeneratorFunction::offsetOfScopeChain(), JSGeneratorFunction::offsetOfExecutable(), JSGeneratorFunction::offsetOfRareData());
    5446 
    5447         addSlowPathGenerator(slowPathCall(slowPath, this, operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, resultGPR, scopeGPR, executable));
    54485438    }
    54495439   

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r194135 r194141  
    44094409    case NewFunction:
    44104410    case NewArrowFunction:
    4411     case NewGeneratorFunction:
    44124411        compileNewFunction(node);
    44134412        break;

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r194135 r194141  
    43984398    case NewFunction:
    43994399    case NewArrowFunction:
    4400     case NewGeneratorFunction:
    44014400        compileNewFunction(node);
    44024401        break;

  • trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp

    r194135 r194141  
    307307            case NewArrowFunction:
    308308            case NewFunction:
    309             case NewGeneratorFunction:
    310309                // Nodes that allocate get to set their epoch because for those nodes we know
    311310                // that they will be the newest object in the heap.

  • trunk/Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp

    r194135 r194141  
    147147                    registerStructure(m_graph.globalObjectFor(node->origin.semantic)->functionStructure());
    148148                    break;
    149                 case NewGeneratorFunction:
    150                     registerStructure(m_graph.globalObjectFor(node->origin.semantic)->generatorFunctionStructure());
    151                     break;
    152149                   
    153150                default:

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r194135 r194141  
    112112    case NewArrowFunction:
    113113    case NewFunction:
    114     case NewGeneratorFunction:
    115114    case GetClosureVar:
    116115    case PutClosureVar:

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

    r194135 r194141  
    5353#include "JSArrowFunction.h"
    5454#include "JSCInlines.h"
    55 #include "JSGeneratorFunction.h"
    5655#include "JSLexicalEnvironment.h"
    5756#include "OperandsInlines.h"
    … …  
    756755        case NewFunction:
    757756        case NewArrowFunction:
    758         case NewGeneratorFunction:
    759757            compileNewFunction();
    760758            break;
    … …  
    35633561    void compileNewFunction()
    35643562    {
    3565         ASSERT(m_node->op() == NewFunction || m_node->op() == NewArrowFunction || m_node->op() == NewGeneratorFunction);
     3563        ASSERT(m_node->op() == NewFunction || m_node->op() == NewArrowFunction);
     3564       
    35663565        bool isArrowFunction = m_node->op() == NewArrowFunction;
    3567         bool isGeneratorFunction = m_node->op() == NewGeneratorFunction;
    35683566       
    35693567        LValue scope = lowCell(m_node->child1());
    … …  
    35723570        FunctionExecutable* executable = m_node->castOperand<FunctionExecutable*>();
    35733571        if (executable->singletonFunction()->isStillValid()) {
    3574             LValue callResult =
    3575                 isArrowFunction ? vmCall(m_out.int64, m_out.operation(operationNewArrowFunction), m_callFrame, scope, weakPointer(executable), thisValue) :
    3576                 isGeneratorFunction ? vmCall(m_out.int64, m_out.operation(operationNewGeneratorFunction), m_callFrame, scope, weakPointer(executable)) :
    3577                 vmCall(m_out.int64, m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable));
     3572            LValue callResult = isArrowFunction
     3573                ? vmCall(m_out.int64, m_out.operation(operationNewArrowFunction), m_callFrame, scope, weakPointer(executable), thisValue)
     3574                : vmCall(m_out.int64, m_out.operation(operationNewFunction), m_callFrame, scope, weakPointer(executable));
    35783575            setJSValue(callResult);
    35793576            return;
    35803577        }
    35813578       
    3582         Structure* structure =
    3583             isArrowFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->arrowFunctionStructure() :
    3584             isGeneratorFunction ? m_graph.globalObjectFor(m_node->origin.semantic)->generatorFunctionStructure() :
    3585             m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure();
     3579        Structure* structure = isArrowFunction
     3580            ? m_graph.globalObjectFor(m_node->origin.semantic)->arrowFunctionStructure()
     3581            : m_graph.globalObjectFor(m_node->origin.semantic)->functionStructure();
    35863582       
    35873583        LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("NewFunction slow path"));
    … …  
    35903586        LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
    35913587       
    3592         LValue fastObject =
    3593             isArrowFunction ? allocateObject<JSArrowFunction>(structure, m_out.intPtrZero, slowPath) :
    3594             isGeneratorFunction ? allocateObject<JSGeneratorFunction>(structure, m_out.intPtrZero, slowPath) :
    3595             allocateObject<JSFunction>(structure, m_out.intPtrZero, slowPath);
     3588        LValue fastObject = isArrowFunction
     3589            ? allocateObject<JSArrowFunction>(structure, m_out.intPtrZero, slowPath)
     3590            : allocateObject<JSFunction>(structure, m_out.intPtrZero, slowPath);
    35963591       
    35973592       
    … …  
    36223617                        locations[0].directGPR(), locations[1].directGPR(),
    36233618                        CCallHelpers::TrustedImmPtr(executable), locations[2].directGPR());
    3624                 }
    3625                 if (isGeneratorFunction) {
    3626                     return createLazyCallGenerator(
    3627                         operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint,
    3628                         locations[0].directGPR(), locations[1].directGPR(),
    3629                         CCallHelpers::TrustedImmPtr(executable));
    36303619                }
    36313620                return createLazyCallGenerator(
Note: See TracChangeset for help on using the changeset viewer.