Changeset 232461 in webkit


Ignore:
Timestamp:
Jun 3, 2018 9:13:42 PM (6 years ago)
Author:
Yusuke Suzuki
Message:

LayoutTests/fast/css/parsing-css-matches-7.html always abandons its Document (disabling JIT fixes it)
​https://bugs.webkit.org/show_bug.cgi?id=186223

Reviewed by Keith Miller.

After preparing catchOSREntryBuffer, we do not clear the active length of this scratch buffer.
It makes this buffer conservative GC root, and allows it to hold GC objects unnecessarily long.

This patch introduces DFG ClearCatchLocals node, which clears catchOSREntryBuffer's active length.
We model ExtractCatchLocal and ClearCatchLocals appropriately in DFG clobberize too to make
this ClearCatchLocals valid.

The existing tests for ExtractCatchLocal just pass.

  • dfg/DFGAbstractHeap.h:
  • dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

  • dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

  • dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

  • dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

  • dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

  • dfg/DFGMayExit.cpp:
  • dfg/DFGNodeType.h:
  • dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareCatchOSREntry):

  • dfg/DFGPredictionPropagationPhase.cpp:
  • dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

  • dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileClearCatchLocals):

  • dfg/DFGSpeculativeJIT.h:
  • dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

  • ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

  • ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileClearCatchLocals):

Location:
trunk/Source/JavaScriptCore
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r232452 r232461  
     12018-06-03  Yusuke Suzuki  <utatane.tea@gmail.com>
     2
     3        LayoutTests/fast/css/parsing-css-matches-7.html always abandons its Document (disabling JIT fixes it)
     4        https://bugs.webkit.org/show_bug.cgi?id=186223
     5
     6        Reviewed by Keith Miller.
     7
     8        After preparing catchOSREntryBuffer, we do not clear the active length of this scratch buffer.
     9        It makes this buffer conservative GC root, and allows it to hold GC objects unnecessarily long.
     10
     11        This patch introduces DFG ClearCatchLocals node, which clears catchOSREntryBuffer's active length.
     12        We model ExtractCatchLocal and ClearCatchLocals appropriately in DFG clobberize too to make
     13        this ClearCatchLocals valid.
     14
     15        The existing tests for ExtractCatchLocal just pass.
     16
     17        * dfg/DFGAbstractHeap.h:
     18        * dfg/DFGAbstractInterpreterInlines.h:
     19        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
     20        * dfg/DFGByteCodeParser.cpp:
     21        (JSC::DFG::ByteCodeParser::parseBlock):
     22        * dfg/DFGClobberize.h:
     23        (JSC::DFG::clobberize):
     24        * dfg/DFGDoesGC.cpp:
     25        (JSC::DFG::doesGC):
     26        * dfg/DFGFixupPhase.cpp:
     27        (JSC::DFG::FixupPhase::fixupNode):
     28        * dfg/DFGMayExit.cpp:
     29        * dfg/DFGNodeType.h:
     30        * dfg/DFGOSREntry.cpp:
     31        (JSC::DFG::prepareCatchOSREntry):
     32        * dfg/DFGPredictionPropagationPhase.cpp:
     33        * dfg/DFGSafeToExecute.h:
     34        (JSC::DFG::safeToExecute):
     35        * dfg/DFGSpeculativeJIT.cpp:
     36        (JSC::DFG::SpeculativeJIT::compileClearCatchLocals):
     37        * dfg/DFGSpeculativeJIT.h:
     38        * dfg/DFGSpeculativeJIT32_64.cpp:
     39        (JSC::DFG::SpeculativeJIT::compile):
     40        * dfg/DFGSpeculativeJIT64.cpp:
     41        (JSC::DFG::SpeculativeJIT::compile):
     42        * ftl/FTLCapabilities.cpp:
     43        (JSC::FTL::canCompile):
     44        * ftl/FTLLowerDFGToB3.cpp:
     45        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
     46        (JSC::FTL::DFG::LowerDFGToB3::compileClearCatchLocals):
     47
    1482018-06-02  Darin Adler  <darin@apple.com>
    249

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractHeap.h

    r231787 r232461  
    7878    macro(JSWeakSetFields) \
    7979    macro(InternalState) \
     80    macro(CatchLocals) \
    8081    macro(Absolute) \
    8182    /* DOMJIT tells the heap range with the pair of integers. */\

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r232442 r232461  
    35303530    case ZombieHint:
    35313531    case ExitOK:
     3532    case ClearCatchLocals:
    35323533        break;
    35333534

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r232442 r232461  
    56815681                localsToSet.uncheckedAppend(std::make_pair(operand, value));
    56825682            });
     5683            if (numberOfLocals)
     5684                addToGraph(ClearCatchLocals);
    56835685
    56845686            if (!m_graph.m_maxLocalsForCatchOSREntry)

  • trunk/Source/JavaScriptCore/dfg/DFGClobberize.h

    r232442 r232461  
    145145    case CheckVarargs:
    146146    case ExtractOSREntryLocal:
     147    case CheckStructureImmediate:
     148        return;
     149
    147150    case ExtractCatchLocal:
    148     case CheckStructureImmediate:
     151        read(AbstractHeap(CatchLocals, node->catchOSREntryIndex()));
     152        return;
     153
     154    case ClearCatchLocals:
     155        write(CatchLocals);
    149156        return;
    150157       

  • trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp

    r232442 r232461  
    225225    case WeakMapSet:
    226226    case Unreachable:
     227    case ExtractOSREntryLocal:
    227228    case ExtractCatchLocal:
    228     case ExtractOSREntryLocal:
     229    case ClearCatchLocals:
    229230    case CheckTierUpInLoop:
    230231    case CheckTierUpAtReturn:

  • trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

    r232442 r232461  
    21682168        case ExtractOSREntryLocal:
    21692169        case ExtractCatchLocal:
     2170        case ClearCatchLocals:
    21702171        case LoopHint:
    21712172        case MovHint:

  • trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp

    r231195 r232461  
    9393    case ExtractOSREntryLocal:
    9494    case ExtractCatchLocal:
     95    case ClearCatchLocals:
    9596    case LogicalNot:
    9697    case NotifyWrite:

  • trunk/Source/JavaScriptCore/dfg/DFGNodeType.h

    r232442 r232461  
    9797    macro(ExtractOSREntryLocal, NodeResultJS) \
    9898    macro(ExtractCatchLocal, NodeResultJS) \
     99    macro(ClearCatchLocals, NodeMustGenerate) \
    99100    \
    100101    /* Tier-up checks from the DFG to the FTL. */\

  • trunk/Source/JavaScriptCore/dfg/DFGOSREntry.cpp

    r230748 r232461  
    401401    });
    402402
     403    // The active length of catchOSREntryBuffer will be zeroed by ClearCatchLocals node.
    403404    dfgCommon->catchOSREntryBuffer->setActiveLength(sizeof(JSValue) * index);
    404405    return catchEntrypoint->machineCode;

  • trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp

    r232442 r232461  
    12151215        case WeakSetAdd:
    12161216        case WeakMapSet:
     1217        case ClearCatchLocals:
    12171218            break;
    12181219           

  • trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h

    r232442 r232461  
    374374    case ExtractOSREntryLocal:
    375375    case ExtractCatchLocal:
     376    case ClearCatchLocals:
    376377    case CheckTierUpInLoop:
    377378    case CheckTierUpAtReturn:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r232442 r232461  
    1294012940}
    1294112941
     12942void SpeculativeJIT::compileClearCatchLocals(Node* node)
     12943{
     12944    ScratchBuffer* scratchBuffer = m_jit.jitCode()->common.catchOSREntryBuffer;
     12945    ASSERT(scratchBuffer);
     12946    GPRTemporary scratch(this);
     12947    GPRReg scratchGPR = scratch.gpr();
     12948    m_jit.move(TrustedImmPtr(scratchBuffer->addressOfActiveLength()), scratchGPR);
     12949    m_jit.storePtr(TrustedImmPtr(nullptr), scratchGPR);
     12950    noResult(node);
     12951}
     12952
    1294212953void SpeculativeJIT::compileProfileType(Node* node)
    1294312954{

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h

    r232442 r232461  
    14811481    void compileHasIndexedProperty(Node*);
    14821482    void compileExtractCatchLocal(Node*);
     1483    void compileClearCatchLocals(Node*);
    14831484    void compileProfileType(Node*);
    14841485

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r232444 r232461  
    40394039        break;
    40404040    }
     4041
     4042    case ClearCatchLocals:
     4043        compileClearCatchLocals(node);
     4044        break;
    40414045
    40424046    case CheckStructureOrEmpty:

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r232444 r232461  
    45484548        break;
    45494549    }
     4550
     4551    case ClearCatchLocals:
     4552        compileClearCatchLocals(node);
     4553        break;
    45504554
    45514555#if ENABLE(FTL_JIT)       

  • trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

    r232442 r232461  
    116116    case ExtractOSREntryLocal:
    117117    case ExtractCatchLocal:
     118    case ClearCatchLocals:
    118119    case LoopHint:
    119120    case SkipScope:

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r232442 r232461  
    568568            compileExtractCatchLocal();
    569569            break;
     570        case ClearCatchLocals:
     571            compileClearCatchLocals();
     572            break;
    570573        case GetStack:
    571574            compileGetStack();
    … …  
    16941697        EncodedJSValue* buffer = static_cast<EncodedJSValue*>(m_ftlState.jitCode->common.catchOSREntryBuffer->dataBuffer());
    16951698        setJSValue(m_out.load64(m_out.absolute(buffer + m_node->catchOSREntryIndex())));
     1699    }
     1700
     1701    void compileClearCatchLocals()
     1702    {
     1703        ScratchBuffer* scratchBuffer = m_ftlState.jitCode->common.catchOSREntryBuffer;
     1704        ASSERT(scratchBuffer);
     1705        m_out.storePtr(m_out.constIntPtr(0), m_out.absolute(scratchBuffer->addressOfActiveLength()));
    16961706    }
    16971707   
Note: See TracChangeset for help on using the changeset viewer.