Changeset 217944 in webkit

Timestamp:

Jun 8, 2017 1:08:24 PM (7 years ago)

Author:

fpizlo@apple.com

Message:

REGRESSION: js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html has a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=161156

Reviewed by Saam Barati.

Source/JavaScriptCore:

Since LLInt does not register impure property watchpoints for self property accesses, it
shouldn't try to cache accesses that require a watchpoint.

This manifested as a flaky failure because the test would fire the watchpoint after we had
usually already tiered up. Without concurrent JIT, we would have always tiered up before
getting to the bad case. With concurrent JIT, we would sometimes not tier up by that time. This
also adds a test that deterministically failed in LLInt without this change; it does so by just
running a lot shorter.

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

LayoutTests:

Add a version of the test that's guaranteed to fail if the problem it's testing for manifests
in the LLInt.

• js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-short.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-short.html (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-06-08  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html has a flaky failure
+        https://bugs.webkit.org/show_bug.cgi?id=161156
+
+        Reviewed by Saam Barati.
+        
+        Add a version of the test that's guaranteed to fail if the problem it's testing for manifests
+        in the LLInt.
+
+        * js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5-short.html: Added.
+
 2017-06-07  Dave Hyatt  <hyatt@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-06-08  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: js/dom/prototype-chain-caching-with-impure-get-own-property-slot-traps-5.html has a flaky failure
+        https://bugs.webkit.org/show_bug.cgi?id=161156
+
+        Reviewed by Saam Barati.
+        
+        Since LLInt does not register impure property watchpoints for self property accesses, it
+        shouldn't try to cache accesses that require a watchpoint.
+        
+        This manifested as a flaky failure because the test would fire the watchpoint after we had
+        usually already tiered up. Without concurrent JIT, we would have always tiered up before
+        getting to the bad case. With concurrent JIT, we would sometimes not tier up by that time. This
+        also adds a test that deterministically failed in LLInt without this change; it does so by just
+        running a lot shorter.
+
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
 2017-06-08  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

@@ -674 +674 @@
             pc[7].u.operand = 0;
         
-            if (structure->propertyAccessesAreCacheable()) {
+            if (structure->propertyAccessesAreCacheable()
+                && !structure->needImpurePropertyWatchpoint()) {
                 vm.heap.writeBarrier(codeBlock);