Changeset 209146 in webkit


Ignore:
Timestamp:
Nov 30, 2016 12:30:16 PM (7 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r209112.
https://bugs.webkit.org/show_bug.cgi?id=165208

"It regressed Octane/Raytrace and JetStream" (Requested by
saamyjoon on #webkit).

Reverted changeset:

"We should support CreateThis in the FTL"
https://bugs.webkit.org/show_bug.cgi?id=164904
http://trac.webkit.org/changeset/209112

Location:
trunk/Source/JavaScriptCore
Files:
5 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/ChangeLog

    r209129 r209146  
     12016-11-30  Commit Queue  <commit-queue@webkit.org>
     2
     3        Unreviewed, rolling out r209112.
     4        https://bugs.webkit.org/show_bug.cgi?id=165208
     5
     6        "It regressed Octane/Raytrace and JetStream" (Requested by
     7        saamyjoon on #webkit).
     8
     9        Reverted changeset:
     10
     11        "We should support CreateThis in the FTL"
     12        https://bugs.webkit.org/show_bug.cgi?id=164904
     13        http://trac.webkit.org/changeset/209112
     14
    1152016-11-30  Darin Adler  <darin@apple.com>
    216
  • trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h

    r209112 r209146  
    6868    macro(JSFunction_scope, JSFunction::offsetOfScopeChain()) \
    6969    macro(JSFunction_rareData, JSFunction::offsetOfRareData()) \
    70     macro(FunctionRareData_allocator, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()) \
    71     macro(FunctionRareData_structure, FunctionRareData::offsetOfObjectAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()) \
    7270    macro(JSObject_butterfly, JSObject::butterflyOffset()) \
    7371    macro(JSPropertyNameEnumerator_cachedInlineCapacity, JSPropertyNameEnumerator::cachedInlineCapacityOffset()) \
     
    110108    macro(Structure_prototype, Structure::prototypeOffset()) \
    111109    macro(Structure_structureID, Structure::structureIDOffset()) \
    112     macro(Structure_inlineCapacity, Structure::inlineCapacityOffset()) \
    113     macro(Structure_initializationBlob, Structure::indexingTypeIncludingHistoryOffset()) \
    114110    macro(JSMap_hashMapImpl, JSMap::offsetOfHashMapImpl()) \
    115111    macro(JSSet_hashMapImpl, JSSet::offsetOfHashMapImpl()) \
  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r209121 r209146  
    282282    case CallDOM:
    283283    case CallDOMGetter:
    284     case CreateThis:
    285284        // These are OK.
    286285        break;
  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r209121 r209146  
    10751075            compileCallDOMGetter();
    10761076            break;
    1077         case CreateThis:
    1078             compileCreateThis();
    1079             break;
    10801077
    10811078        case PhantomLocal:
     
    49224919       
    49234920        LValue result = allocateCell(
    4924             m_out.constIntPtr(allocator), m_out.constIntPtr(vm().stringStructure.get()), slowPath);
     4921            m_out.constIntPtr(allocator), vm().stringStructure.get(), slowPath);
    49254922       
    49264923        m_out.storePtr(m_out.intPtrZero, result, m_heaps.JSString_value);
     
    86188615               
    86198616                LValue fastObjectValue = allocateObject(
    8620                     m_out.constIntPtr(cellAllocator), m_out.constIntPtr(structure), fastButterflyValue, slowPath);
     8617                    m_out.constIntPtr(cellAllocator), structure, fastButterflyValue, slowPath);
    86218618
    86228619                ValueFromBlock fastObject = m_out.anchor(fastObjectValue);
     
    99659962        setJSValue(patchpoint);
    99669963    }
    9967 
    9968     void compileCreateThis()
    9969     {
    9970         LValue callee = lowCell(m_node->child1());
    9971 
    9972         LBasicBlock isFunctionBlock = m_out.newBlock();
    9973         LBasicBlock hasRareData = m_out.newBlock();
    9974         LBasicBlock slowPath = m_out.newBlock();
    9975         LBasicBlock continuation = m_out.newBlock();
    9976 
    9977         m_out.branch(isFunction(callee, provenType(m_node->child1())), usually(isFunctionBlock), rarely(slowPath));
    9978 
    9979         LBasicBlock lastNext = m_out.appendTo(isFunctionBlock, hasRareData);
    9980         LValue rareData = m_out.loadPtr(callee, m_heaps.JSFunction_rareData);
    9981         m_out.branch(m_out.isZero64(rareData), rarely(slowPath), usually(hasRareData));
    9982 
    9983         m_out.appendTo(hasRareData, slowPath);
    9984         LValue allocator = m_out.loadPtr(rareData, m_heaps.FunctionRareData_allocator);
    9985         LValue structure = m_out.loadPtr(rareData, m_heaps.FunctionRareData_structure);
    9986         LValue butterfly = m_out.constIntPtr(0);
    9987         ValueFromBlock fastResult = m_out.anchor(allocateObject(allocator, structure, butterfly, slowPath));
    9988         m_out.jump(continuation);
    9989 
    9990         m_out.appendTo(slowPath, continuation);
    9991         ValueFromBlock slowResult = m_out.anchor(vmCall(
    9992             Int64, m_out.operation(operationCreateThis), m_callFrame, callee, m_out.constInt32(m_node->inlineCapacity())));
    9993         m_out.jump(continuation);
    9994 
    9995         m_out.appendTo(continuation, lastNext);
    9996         LValue result = m_out.phi(Int64, fastResult, slowResult);
    9997 
    9998         mutatorFence();
    9999         setJSValue(result);
    10000     }
    100019964   
    100029965    void compareEqObjectOrOtherToObject(Edge leftChild, Edge rightChild)
     
    1041910382        return patchpoint;
    1042010383    }
    10421 
    10422     void storeStructure(LValue object, LValue structure)
    10423     {
    10424         LValue id;
    10425         LValue blob;
    10426         if (structure->hasIntPtr()) {
    10427             Structure* actualStructure = bitwise_cast<Structure*>(structure->asIntPtr());
    10428             id = m_out.constInt32(actualStructure->id());
    10429             blob = m_out.constInt32(actualStructure->objectInitializationBlob());
    10430         } else {
    10431             id = m_out.load32(structure, m_heaps.Structure_structureID);
    10432             blob = m_out.load32(structure, m_heaps.Structure_initializationBlob);
    10433         }
    10434         m_out.store32(id, object, m_heaps.JSCell_structureID);
    10435         m_out.store32(blob, object, m_heaps.JSCell_usefulBytes);
    10436     }
    10437 
    10438     LValue allocateCell(LValue allocator, LValue structure, LBasicBlock slowPath)
     10384   
     10385    void storeStructure(LValue object, Structure* structure)
     10386    {
     10387        m_out.store32(m_out.constInt32(structure->id()), object, m_heaps.JSCell_structureID);
     10388        m_out.store32(
     10389            m_out.constInt32(structure->objectInitializationBlob()),
     10390            object, m_heaps.JSCell_usefulBytes);
     10391    }
     10392
     10393    LValue allocateCell(LValue allocator, Structure* structure, LBasicBlock slowPath)
    1043910394    {
    1044010395        LValue result = allocateHeapCell(allocator, slowPath);
     
    1044410399
    1044510400    LValue allocateObject(
    10446         LValue allocator, LValue structure, LValue butterfly, LBasicBlock slowPath)
     10401        LValue allocator, Structure* structure, LValue butterfly, LBasicBlock slowPath)
    1044710402    {
    1044810403        LValue result = allocateCell(allocator, structure, slowPath);
    1044910404        if (useGCFences()) {
    10450             LValue start = m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8);
    10451             LValue end;
    10452             if (structure->hasIntPtr()) {
    10453                 Structure* actualStructure = bitwise_cast<Structure*>(structure->asIntPtr());
    10454                 end = m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8 + actualStructure->inlineCapacity());
    10455             } else
    10456                 end = m_out.add(start, m_out.load8ZeroExt32(structure, m_heaps.Structure_inlineCapacity));
    10457 
    1045810405            splatWords(
    1045910406                result,
    10460                 start,
    10461                 end,
     10407                m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
     10408                m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8 + structure->inlineCapacity()),
    1046210409                m_out.int64Zero,
    1046310410                m_heaps.properties.atAnyNumber());
     
    1047210419    {
    1047310420        MarkedAllocator* allocator = vm().heap.allocatorForObjectOfType<ClassType>(size);
    10474         return allocateObject(m_out.constIntPtr(allocator), m_out.constIntPtr(structure), butterfly, slowPath);
     10421        return allocateObject(m_out.constIntPtr(allocator), structure, butterfly, slowPath);
    1047510422    }
    1047610423   
     
    1053610483        LValue allocator = allocatorForSize(
    1053710484            vm().heap.subspaceForObjectOfType<ClassType>(), size, slowPath);
    10538         return allocateObject(allocator, m_out.constIntPtr(structure), butterfly, slowPath);
     10485        return allocateObject(allocator, structure, butterfly, slowPath);
    1053910486    }
    1054010487
     
    1054510492        LValue allocator = allocatorForSize(
    1054610493            vm().heap.subspaceForObjectOfType<ClassType>(), size, slowPath);
    10547         return allocateCell(allocator, m_out.constIntPtr(structure), slowPath);
     10494        return allocateCell(allocator, structure, slowPath);
    1054810495    }
    1054910496   
     
    1056310510       
    1056410511        ValueFromBlock fastResult = m_out.anchor(allocateObject(
    10565             m_out.constIntPtr(allocator), m_out.constIntPtr(structure), m_out.intPtrZero, slowPath));
     10512            m_out.constIntPtr(allocator), structure, m_out.intPtrZero, slowPath));
    1056610513       
    1056710514        m_out.jump(continuation);
  • trunk/Source/JavaScriptCore/runtime/Structure.h

    r209112 r209146  
    406406    }
    407407
    408     static ptrdiff_t inlineCapacityOffset()
    409     {
    410         return OBJECT_OFFSETOF(Structure, m_inlineCapacity);
    411     }
    412 
    413408    static ptrdiff_t prototypeOffset()
    414409    {
Note: See TracChangeset for help on using the changeset viewer.