Changeset 223614 in webkit
- Timestamp:
- Oct 18, 2017 10:41:55 AM (7 years ago)
- Location:
- trunk
- Files:
-
- 1 added
- 11 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r223594 r223614 1 2017-10-18 Mark Lam <mark.lam@apple.com> 2 3 The compiler should always register a structure when it adds its transitionWatchPointSet. 4 https://bugs.webkit.org/show_bug.cgi?id=178420 5 <rdar://problem/34814024> 6 7 Reviewed by Saam Barati and Filip Pizlo. 8 9 * stress/regress-178420.js: Added. 10 (new.Array.10000.map): 11 1 12 2017-10-18 Yusuke Suzuki <utatane.tea@gmail.com> 2 13 -
trunk/Source/JavaScriptCore/ChangeLog
r223603 r223614 1 2017-10-18 Mark Lam <mark.lam@apple.com> 2 3 The compiler should always register a structure when it adds its transitionWatchPointSet. 4 https://bugs.webkit.org/show_bug.cgi?id=178420 5 <rdar://problem/34814024> 6 7 Reviewed by Saam Barati and Filip Pizlo. 8 9 Instead of invoking addLazily() to add a structure's transitionWatchpointSet, we 10 now invoke Graph::registerAndWatchStructureTransition() on the structure. 11 registerAndWatchStructureTransition() both registers the structure and add its 12 transitionWatchpointSet to the plan desired watchpoints. 13 14 Graph::registerAndWatchStructureTransition() is based on Graph::registerStructure() 15 except registerAndWatchStructureTransition() adds the structure's 16 transitionWatchpointSet unconditionally. 17 18 * dfg/DFGArgumentsEliminationPhase.cpp: 19 * dfg/DFGArrayMode.cpp: 20 (JSC::DFG::ArrayMode::refine const): 21 * dfg/DFGByteCodeParser.cpp: 22 (JSC::DFG::ByteCodeParser::handleIntrinsicCall): 23 * dfg/DFGFixupPhase.cpp: 24 (JSC::DFG::FixupPhase::fixupNode): 25 26 * dfg/DFGGraph.cpp: 27 (JSC::DFG::Graph::registerAndWatchStructureTransition): 28 * dfg/DFGGraph.h: 29 30 * dfg/DFGSpeculativeJIT.cpp: 31 (JSC::DFG::SpeculativeJIT::compileGetByValOnString): 32 - The second set of addLazily()s is redundant. This set is executed only when 33 prototypeChainIsSane is true, and prototypeChainIsSane can only be true if and 34 only if we've executed the if statement above it. That preceding if statement 35 already registerAndWatchStructureTransition() the same 2 structures. Hence, 36 this second set can be deleted. 37 38 * dfg/DFGWatchpointCollectionPhase.cpp: 39 (JSC::DFG::WatchpointCollectionPhase::addLazily): 40 - Deleted an unused function. 41 42 * ftl/FTLLowerDFGToB3.cpp: 43 (JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt): 44 1 45 2017-10-18 Yusuke Suzuki <utatane.tea@gmail.com> 2 46 -
trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
r221954 r223614 1 1 /* 2 * Copyright (C) 2015-201 6Apple Inc. All rights reserved.2 * Copyright (C) 2015-2017 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 249 249 // for the allocation is sane (i.e. doesn't have indexed properties). 250 250 JSGlobalObject* globalObject = m_graph.globalObjectFor(edge->origin.semantic); 251 InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();251 Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure(); 252 252 if (edge->op() == CreateRest) { 253 InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();254 if (arrayPrototype Transition.isStillValid()255 && objectPrototype Transition.isStillValid()253 Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure(); 254 if (arrayPrototypeStructure->transitionWatchpointSetIsStillValid() 255 && objectPrototypeStructure->transitionWatchpointSetIsStillValid() 256 256 && globalObject->arrayPrototypeChainIsSane()) { 257 m_graph. watchpoints().addLazily(arrayPrototypeTransition);258 m_graph. watchpoints().addLazily(objectPrototypeTransition);257 m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure); 258 m_graph.registerAndWatchStructureTransition(objectPrototypeStructure); 259 259 break; 260 260 } 261 261 } else { 262 if (objectPrototype Transition.isStillValid()262 if (objectPrototypeStructure->transitionWatchpointSetIsStillValid() 263 263 && globalObject->objectPrototypeIsSane()) { 264 m_graph. watchpoints().addLazily(objectPrototypeTransition);264 m_graph.registerAndWatchStructureTransition(objectPrototypeStructure); 265 265 break; 266 266 } -
trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp
r217202 r223614 1 1 /* 2 * Copyright (C) 2012-201 6Apple Inc. All rights reserved.2 * Copyright (C) 2012-2017 Apple Inc. All rights reserved. 3 3 * 4 4 * Redistribution and use in source and binary forms, with or without … … 215 215 && globalObject->arrayPrototypeChainIsSane() 216 216 && !graph.hasExitSite(node->origin.semantic, OutOfBounds)) { 217 graph. watchpoints().addLazily(globalObject->arrayPrototype()->structure()->transitionWatchpointSet());218 graph. watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());217 graph.registerAndWatchStructureTransition(globalObject->arrayPrototype()->structure()); 218 graph.registerAndWatchStructureTransition(globalObject->objectPrototype()->structure()); 219 219 if (globalObject->arrayPrototypeChainIsSane()) 220 220 return withSpeculation(Array::SaneChain); -
trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
r223594 r223614 2230 2230 JSGlobalObject* globalObject = m_graph.globalObjectFor(currentNodeOrigin().semantic); 2231 2231 2232 InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();2233 InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();2232 Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure(); 2233 Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure(); 2234 2234 2235 2235 // FIXME: We could easily relax the Array/Object.prototype transition as long as we OSR exitted if we saw a hole. … … 2237 2237 if (globalObject->arraySpeciesWatchpoint().state() == IsWatched 2238 2238 && globalObject->havingABadTimeWatchpoint()->isStillValid() 2239 && arrayPrototype Transition.isStillValid()2240 && objectPrototype Transition.isStillValid()2239 && arrayPrototypeStructure->transitionWatchpointSetIsStillValid() 2240 && objectPrototypeStructure->transitionWatchpointSetIsStillValid() 2241 2241 && globalObject->arrayPrototypeChainIsSane()) { 2242 2242 2243 2243 m_graph.watchpoints().addLazily(globalObject->arraySpeciesWatchpoint()); 2244 2244 m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint()); 2245 m_graph. watchpoints().addLazily(arrayPrototypeTransition);2246 m_graph. watchpoints().addLazily(objectPrototypeTransition);2245 m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure); 2246 m_graph.registerAndWatchStructureTransition(objectPrototypeStructure); 2247 2247 2248 2248 insertChecks(); … … 2319 2319 JSGlobalObject* globalObject = m_graph.globalObjectFor(currentNodeOrigin().semantic); 2320 2320 2321 InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();2322 InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();2321 Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure(); 2322 Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure(); 2323 2323 2324 2324 // FIXME: We could easily relax the Array/Object.prototype transition as long as we OSR exitted if we saw a hole. 2325 2325 // https://bugs.webkit.org/show_bug.cgi?id=173171 2326 2326 if (globalObject->havingABadTimeWatchpoint()->isStillValid() 2327 && arrayPrototype Transition.isStillValid()2328 && objectPrototype Transition.isStillValid()2327 && arrayPrototypeStructure->transitionWatchpointSetIsStillValid() 2328 && objectPrototypeStructure->transitionWatchpointSetIsStillValid() 2329 2329 && globalObject->arrayPrototypeChainIsSane()) { 2330 2330 2331 2331 m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint()); 2332 m_graph. watchpoints().addLazily(arrayPrototypeTransition);2333 m_graph. watchpoints().addLazily(objectPrototypeTransition);2332 m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure); 2333 m_graph.registerAndWatchStructureTransition(objectPrototypeStructure); 2334 2334 2335 2335 insertChecks(); -
trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
r223594 r223614 760 760 761 761 if (canDoSaneChain) { 762 m_graph.watchpoints().addLazily( 763 globalObject->arrayPrototype()->structure()->transitionWatchpointSet()); 764 m_graph.watchpoints().addLazily( 765 globalObject->objectPrototype()->structure()->transitionWatchpointSet()); 762 m_graph.registerAndWatchStructureTransition(globalObject->arrayPrototype()->structure()); 763 m_graph.registerAndWatchStructureTransition(globalObject->objectPrototype()->structure()); 766 764 if (globalObject->arrayPrototypeChainIsSane()) 767 765 node->setArrayMode(arrayMode.withSpeculation(Array::SaneChain)); … … 1219 1217 // that it doesn't contain any indexed properties, and that any holes will result in 1220 1218 // jsUndefined(). 1221 InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();1222 InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();1223 if (node->child1()->shouldSpeculateArray() 1224 && arrayPrototype Transition.isStillValid()1225 && objectPrototype Transition.isStillValid()1219 Structure* arrayPrototypeStructure = globalObject->arrayPrototype()->structure(); 1220 Structure* objectPrototypeStructure = globalObject->objectPrototype()->structure(); 1221 if (node->child1()->shouldSpeculateArray() 1222 && arrayPrototypeStructure->transitionWatchpointSetIsStillValid() 1223 && objectPrototypeStructure->transitionWatchpointSetIsStillValid() 1226 1224 && globalObject->arrayPrototypeChainIsSane() 1227 1225 && m_graph.isWatchingArrayIteratorProtocolWatchpoint(node->child1().node()) 1228 1226 && m_graph.isWatchingHavingABadTimeWatchpoint(node->child1().node())) { 1229 m_graph. watchpoints().addLazily(objectPrototypeTransition);1230 m_graph. watchpoints().addLazily(arrayPrototypeTransition);1227 m_graph.registerAndWatchStructureTransition(objectPrototypeStructure); 1228 m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure); 1231 1229 fixEdge<ArrayUse>(node->child1()); 1232 1230 } else -
trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp
r223086 r223614 1503 1503 } 1504 1504 1505 void Graph::registerAndWatchStructureTransition(Structure* structure) 1506 { 1507 m_plan.weakReferences.addLazily(structure); 1508 m_plan.watchpoints.addLazily(structure->transitionWatchpointSet()); 1509 } 1510 1505 1511 void Graph::assertIsRegistered(Structure* structure) 1506 1512 { -
trunk/Source/JavaScriptCore/dfg/DFGGraph.h
r221822 r223614 229 229 } 230 230 RegisteredStructure registerStructure(Structure*, StructureRegistrationResult&); 231 void registerAndWatchStructureTransition(Structure*); 231 232 void assertIsRegistered(Structure* structure); 232 233 -
trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
r223594 r223614 2138 2138 // indexed properties either. 2139 2139 // https://bugs.webkit.org/show_bug.cgi?id=144668 2140 m_jit.graph(). watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());2141 m_jit.graph(). watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());2140 m_jit.graph().registerAndWatchStructureTransition(globalObject->stringPrototype()->structure()); 2141 m_jit.graph().registerAndWatchStructureTransition(globalObject->objectPrototype()->structure()); 2142 2142 prototypeChainIsSane = globalObject->stringPrototypeChainIsSane(); 2143 2143 } 2144 2144 if (prototypeChainIsSane) { 2145 m_jit.graph().watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());2146 m_jit.graph().watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());2147 2148 2145 #if USE(JSVALUE64) 2149 2146 addSlowPathGenerator(std::make_unique<SaneStringGetByValSlowPathGenerator>( -
trunk/Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp
r203364 r223614 113 113 m_graph.watchpoints().addLazily(set); 114 114 } 115 void addLazily(InlineWatchpointSet& set)116 {117 m_graph.watchpoints().addLazily(set);118 }119 115 120 116 JSGlobalObject* globalObject() -
trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
r223594 r223614 5760 5760 // https://bugs.webkit.org/show_bug.cgi?id=144668 5761 5761 5762 m_graph. watchpoints().addLazily(globalObject->stringPrototype()->structure()->transitionWatchpointSet());5763 m_graph. watchpoints().addLazily(globalObject->objectPrototype()->structure()->transitionWatchpointSet());5764 5762 m_graph.registerAndWatchStructureTransition(globalObject->stringPrototype()->structure()); 5763 m_graph.registerAndWatchStructureTransition(globalObject->objectPrototype()->structure()); 5764 5765 5765 prototypeChainIsSane = globalObject->stringPrototypeChainIsSane(); 5766 5766 }
Note: See TracChangeset
for help on using the changeset viewer.