Changeset 220783 in webkit

Timestamp:

Aug 15, 2017 7:49:04 PM (7 years ago)

Author:

commit-queue@webkit.org

Message:

We are too conservative about the effects of PushWithScope
​https://bugs.webkit.org/show_bug.cgi?id=175584

Patch by Robin Morisset <​rmorisset@apple.com> on 2017-08-15
Reviewed by Saam Barati.

PushWithScope converts its argument to an object (this can throw a type error,
but has no other observable effect), and allocates a new scope, that it then
makes the new current scope. We were a bit too
conservative in saying that it clobbers the world.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

• dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

• dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)
• dfg/DFGClobberize.h (modified) (2 diffs)
• dfg/DFGDoesGC.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-08-15  Robin Morisset  <rmorisset@apple.com>
+
+        We are too conservative about the effects of PushWithScope
+        https://bugs.webkit.org/show_bug.cgi?id=175584
+
+        Reviewed by Saam Barati.
+
+        PushWithScope converts its argument to an object (this can throw a type error,
+        but has no other observable effect), and allocates a new scope, that it then
+        makes the new current scope. We were a bit too
+        conservative in saying that it clobbers the world.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+
 2017-08-15  Ryosuke Niwa  <rniwa@webkit.org>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -2065 +2065 @@
 
     case PushWithScope:
-        clobberWorld(node->origin.semantic, clobberLimit);
-
         // We don't use the more precise withScopeStructure() here because it is a LazyProperty and may not yet be allocated.
         forNode(node).setType(m_graph, SpecObjectOther);

trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

@@ -472 +472 @@
         return;
 
+    case PushWithScope: {
+        read(World);
+        write(HeapObjectCount);
+        return;
+    }
+
     case CreateActivation: {
         SymbolTable* table = node->castOperand<SymbolTable*>();
@@ -606 +612 @@
     case ResolveScopeForHoistingFuncDeclInEval:
     case ResolveScope:
-    case PushWithScope:
         read(World);
         write(Heap);

trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

@@ -281 +281 @@
     case AtomicsXor:
     case AtomicsIsLockFree:
+        return false;
+
     case PushWithScope:
-        return false;
-
     case CreateActivation:
     case CreateDirectArguments: