Changeset 249075 in webkit
- Timestamp:
- Aug 23, 2019 4:08:06 PM (5 years ago)
- Location:
- trunk
- Files:
-
- 2 deleted
- 23 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JSTests/ChangeLog
r249069 r249075 1 2019-08-23 Tadeu Zagallo <tzagallo@apple.com> 2 3 Remove MaximalFlushInsertionPhase 4 https://bugs.webkit.org/show_bug.cgi?id=201036 5 6 Reviewed by Saam Barati. 7 8 Remove all the references to maximal flush 9 10 * stress/arith-ceil-on-various-types.js: 11 (checkCompileCountForUselessNegativeZero): 12 * stress/arith-floor-on-various-types.js: 13 (checkCompileCountForUselessNegativeZero): 14 * stress/arith-negate-on-various-types.js: 15 (checkCompileCountForUselessNegativeZero): 16 * stress/arith-round-on-various-types.js: 17 (checkCompileCountForUselessNegativeZero): 18 * stress/arith-trunc-on-various-types.js: 19 (checkCompileCountForUselessNegativeZero): 20 * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js: 21 * stress/has-indexed-property-should-accept-non-int32.js: 22 * stress/has-indexed-property-with-worsening-array-mode.js: 23 * stress/known-int32-cant-be-used-across-bytecode-boundary.js: 24 * stress/read-dead-bytecode-locals-in-must-handle-values1.js: 25 * stress/read-dead-bytecode-locals-in-must-handle-values2.js: 26 * stress/rest-parameter-many-arguments.js: 27 * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js: 28 * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js: 29 * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js: 30 1 31 2019-08-23 Justin Michaud <justin_michaud@apple.com> 2 32 -
trunk/JSTests/stress/arith-ceil-on-various-types.js
r228513 r249075 141 141 function checkCompileCountForUselessNegativeZero(testFunction) 142 142 { 143 if (jscOptions().useMaximalFlushInsertionPhase) {144 // If we forced a flush after the operation, the negative zero becomes145 // observable and we may be overly optimistic.146 return numberOfDFGCompiles(testFunction) <= 2;147 }148 143 return numberOfDFGCompiles(testFunction) <= 1; 149 144 } -
trunk/JSTests/stress/arith-floor-on-various-types.js
r228513 r249075 141 141 function checkCompileCountForUselessNegativeZero(testFunction) 142 142 { 143 if (jscOptions().useMaximalFlushInsertionPhase) {144 // If we forced a flush after the operation, the negative zero becomes145 // observable and we may be overly optimistic.146 return numberOfDFGCompiles(testFunction) <= 2;147 }148 143 return numberOfDFGCompiles(testFunction) <= 1; 149 144 } -
trunk/JSTests/stress/arith-negate-on-various-types.js
r228513 r249075 121 121 function checkCompileCountForUselessNegativeZero(testFunction) 122 122 { 123 if (jscOptions().useMaximalFlushInsertionPhase) {124 // If we forced a flush after the operation, the negative zero becomes125 // observable and we may be overly optimistic.126 return numberOfDFGCompiles(testFunction) <= 2;127 }128 123 return numberOfDFGCompiles(testFunction) <= 1; 129 124 } -
trunk/JSTests/stress/arith-round-on-various-types.js
r228513 r249075 141 141 function checkCompileCountForUselessNegativeZero(testFunction) 142 142 { 143 if (jscOptions().useMaximalFlushInsertionPhase) {144 // If we forced a flush after the operation, the negative zero becomes145 // observable and we may be overly optimistic.146 return numberOfDFGCompiles(testFunction) <= 2;147 }148 143 return numberOfDFGCompiles(testFunction) <= 1; 149 144 } -
trunk/JSTests/stress/arith-trunc-on-various-types.js
r228513 r249075 141 141 function checkCompileCountForUselessNegativeZero(testFunction) 142 142 { 143 if (jscOptions().useMaximalFlushInsertionPhase) {144 // If we forced a flush after the operation, the negative zero becomes145 // observable and we may be overly optimistic.146 return numberOfDFGCompiles(testFunction) <= 2;147 }148 143 return numberOfDFGCompiles(testFunction) <= 1; 149 144 } -
trunk/JSTests/stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js
r243344 r249075 1 //@ runDefault("--collectContinuously=true", "--collectContinuouslyPeriodMS=0.15", "--use MaximalFlushInsertionPhase=true", "--useLLInt=false", "--useFTLJIT=false", "--jitPolicyScale=0")1 //@ runDefault("--collectContinuously=true", "--collectContinuouslyPeriodMS=0.15", "--useLLInt=false", "--useFTLJIT=false", "--jitPolicyScale=0") 2 2 3 3 // This test exercises DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined(). -
trunk/JSTests/stress/has-indexed-property-should-accept-non-int32.js
r244211 r249075 1 //@ runDefault("--useRandomizingFuzzerAgent=1", "--jitPolicyScale=0", "--use MaximalFlushInsertionPhase=1", "--useConcurrentJIT=0")1 //@ runDefault("--useRandomizingFuzzerAgent=1", "--jitPolicyScale=0", "--useConcurrentJIT=0") 2 2 function foo(obj) { 3 3 for (var x in obj) { -
trunk/JSTests/stress/has-indexed-property-with-worsening-array-mode.js
r241968 r249075 1 //@ requireOptions("--watchdog=1000", "--watchdog-exception-ok" , "--useMaximalFlushInsertionPhase=1")1 //@ requireOptions("--watchdog=1000", "--watchdog-exception-ok") 2 2 // This test only seems to reproduce the issue when it runs in an infinite loop. So we use the watchdog to time it out. 3 3 for (let x in [0]) { -
trunk/JSTests/stress/known-int32-cant-be-used-across-bytecode-boundary.js
r242954 r249075 1 //@ runDefault("--useConcurrentJIT=0" , "--useMaximalFlushInsertionPhase=1")1 //@ runDefault("--useConcurrentJIT=0") 2 2 3 3 function foo() { -
trunk/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values1.js
r242192 r249075 1 //@ runDefault("--use MaximalFlushInsertionPhase=1", "--useConcurrentJIT=0")1 //@ runDefault("--useConcurrentJIT=0") 2 2 function bar(x) { 3 3 if (x) { -
trunk/JSTests/stress/read-dead-bytecode-locals-in-must-handle-values2.js
r242280 r249075 1 //@ runDefault("--use MaximalFlushInsertionPhase=1", "--useConcurrentJIT=0")1 //@ runDefault("--useConcurrentJIT=0") 2 2 function bar(c) { 3 3 if (c > 1) { -
trunk/JSTests/stress/rest-parameter-many-arguments.js
r237919 r249075 1 1 //@ skip if $architecture == "x86" 2 //@ if $architecture == "x86" then defaultSpotCheckNoMaximalFlush else defaultRun end3 2 4 3 function assert(b) { -
trunk/JSTests/stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js
r245341 r249075 1 //@ runDefault("-- useMaximalFlushInsertionPhase=1", "--jitPolicyScale=0", "--useConcurrentJIT=0")1 //@ runDefault("--jitPolicyScale=0", "--useConcurrentJIT=0") 2 2 3 3 function f0() { -
trunk/JSTests/stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js
r245341 r249075 1 //@ runDefault("-- useMaximalFlushInsertionPhase=1", "--validateGraphAtEachPhase=1")1 //@ runDefault("--validateGraphAtEachPhase=1") 2 2 3 3 function f1() { -
trunk/JSTests/stress/to-index-string-should-not-assume-incoming-value-is-uint32.js
r244057 r249075 1 //@ runDefault("--use MaximalFlushInsertionPhase=1", "--useRandomizingFuzzerAgent=1")1 //@ runDefault("--useRandomizingFuzzerAgent=1") 2 2 3 3 function foo() { -
trunk/Source/JavaScriptCore/ChangeLog
r249073 r249075 1 2019-08-23 Tadeu Zagallo <tzagallo@apple.com> 2 3 Remove MaximalFlushInsertionPhase 4 https://bugs.webkit.org/show_bug.cgi?id=201036 5 6 Reviewed by Saam Barati. 7 8 Maximal flush has found too many false positives recently, so we decided it's finally time 9 to remove it instead of hacking it to fix the most recent false positive. 10 11 The most recent false positive was caused by a LoadVarargs followed by a SetArgumentDefinitely 12 for the argument count that was being flushed in a much later block. Now, since that block was 13 the head of a loop, and there was a SetLocal in the same block to the same variable, this 14 generated a Phi of both values, which then led to the unification of their VariableAccessData 15 in the unification phase. This caused AI to assign the Int52 type to argument count, which 16 broke the AI’s assumption that it should always be an Int32. 17 18 * JavaScriptCore.xcodeproj/project.pbxproj: 19 * Sources.txt: 20 * dfg/DFGByteCodeParser.cpp: 21 (JSC::DFG::ByteCodeParser::handleVarargsInlining): 22 * dfg/DFGMaximalFlushInsertionPhase.cpp: Removed. 23 * dfg/DFGMaximalFlushInsertionPhase.h: Removed. 24 * dfg/DFGPlan.cpp: 25 (JSC::DFG::Plan::compileInThreadImpl): 26 * runtime/Options.cpp: 27 (JSC::recomputeDependentOptions): 28 * runtime/Options.h: 29 1 30 2019-08-23 Ross Kirsling <ross.kirsling@sony.com> 2 31 -
trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
r248938 r249075 1216 1216 79EE0C001B4AFB85000385C9 /* VariableEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 79EE0BFE1B4AFB85000385C9 /* VariableEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; }; 1217 1217 79EFD4841EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 79EFD4821EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; }; 1218 79F8FC1F1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */; };1219 1218 79FC8A081E32E9F000D88F0E /* DFGRegisteredStructure.h in Headers */ = {isa = PBXBuildFile; fileRef = 79FC8A071E32E9F000D88F0E /* DFGRegisteredStructure.h */; settings = {ATTRIBUTES = (Private, ); }; }; 1220 1219 7A9774A8206B82E4008D03D0 /* JSWeakValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A9774A7206B82C9008D03D0 /* JSWeakValue.h */; settings = {ATTRIBUTES = (Private, ); }; }; … … 3991 3990 79EFD4811EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyCodeBlockHeapCellType.cpp; path = js/JSWebAssemblyCodeBlockHeapCellType.cpp; sourceTree = "<group>"; }; 3992 3991 79EFD4821EBC045C00F3DFEA /* JSWebAssemblyCodeBlockHeapCellType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSWebAssemblyCodeBlockHeapCellType.h; path = js/JSWebAssemblyCodeBlockHeapCellType.h; sourceTree = "<group>"; }; 3993 79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMaximalFlushInsertionPhase.cpp; path = dfg/DFGMaximalFlushInsertionPhase.cpp; sourceTree = "<group>"; };3994 79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMaximalFlushInsertionPhase.h; path = dfg/DFGMaximalFlushInsertionPhase.h; sourceTree = "<group>"; };3995 3992 79FC8A071E32E9F000D88F0E /* DFGRegisteredStructure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGRegisteredStructure.h; path = dfg/DFGRegisteredStructure.h; sourceTree = "<group>"; }; 3996 3993 7A9774A6206B828C008D03D0 /* JSWeakValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakValue.cpp; sourceTree = "<group>"; }; … … 7782 7779 A767B5B317A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp */, 7783 7780 A767B5B417A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h */, 7784 79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */,7785 79F8FC1D1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h */,7786 7781 0F5874EB194FEB1200AAB2C1 /* DFGMayExit.cpp */, 7787 7782 0F5874EC194FEB1200AAB2C1 /* DFGMayExit.h */, … … 9168 9163 A7D89CFC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h in Headers */, 9169 9164 A767B5B617A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h in Headers */, 9170 79F8FC1F1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h in Headers */,9171 9165 0F5874EE194FEB1200AAB2C1 /* DFGMayExit.h in Headers */, 9172 9166 0F2BDC451522801B00CD8910 /* DFGMinifiedGraph.h in Headers */, -
trunk/Source/JavaScriptCore/Sources.txt
r248938 r249075 365 365 dfg/DFGLivenessAnalysisPhase.cpp 366 366 dfg/DFGLoopPreHeaderCreationPhase.cpp 367 dfg/DFGMaximalFlushInsertionPhase.cpp368 367 dfg/DFGMayExit.cpp 369 368 dfg/DFGMinifiedGraph.cpp -
trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
r248906 r249075 1863 1863 registerOffset = -WTF::roundUpToMultipleOf(stackAlignmentRegisters(), -registerOffset); 1864 1864 1865 Vector<VirtualRegister> setArgumentMaybes;1866 1867 1865 auto insertChecks = [&] (CodeBlock* codeBlock) { 1868 1866 emitFunctionChecks(callVariant, callTargetNode, thisArgument); … … 1929 1927 1930 1928 Node* setArgument = addToGraph(numSetArguments >= mandatoryMinimum ? SetArgumentMaybe : SetArgumentDefinitely, OpInfo(variable)); 1931 if (numSetArguments >= mandatoryMinimum && Options::useMaximalFlushInsertionPhase())1932 setArgumentMaybes.append(variable->local());1933 1929 m_currentBlock->variablesAtTail.setOperand(variable->local(), setArgument); 1934 1930 ++numSetArguments; … … 1945 1941 inlineCall(callTargetNode, result, callVariant, registerOffset, maxNumArguments, kind, nullptr, insertChecks); 1946 1942 1947 for (VirtualRegister reg : setArgumentMaybes)1948 setDirect(reg, jsConstant(jsUndefined()), ImmediateNakedSet);1949 1943 1950 1944 VERBOSE_LOG("Successful inlining (varargs, monomorphic).\nStack: ", currentCodeOrigin(), "\n"); -
trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp
r248846 r249075 52 52 #include "DFGLivenessAnalysisPhase.h" 53 53 #include "DFGLoopPreHeaderCreationPhase.h" 54 #include "DFGMaximalFlushInsertionPhase.h"55 54 #include "DFGMovHintRemovalPhase.h" 56 55 #include "DFGOSRAvailabilityAnalysisPhase.h" … … 286 285 RUN_PHASE(performLiveCatchVariablePreservationPhase); 287 286 288 if (Options::useMaximalFlushInsertionPhase())289 RUN_PHASE(performMaximalFlushInsertion);290 291 287 RUN_PHASE(performCPSRethreading); 292 288 RUN_PHASE(performUnification); -
trunk/Source/JavaScriptCore/runtime/Options.cpp
r249013 r249075 472 472 Options::useConcurrentJIT() = false; 473 473 } 474 if (Options::useMaximalFlushInsertionPhase()) {475 Options::useOSREntryToDFG() = false;476 Options::useOSREntryToFTL() = false;477 }478 479 474 #if ENABLE(SEPARATED_WX_HEAP) 480 475 // Override globally for now. Longer term we'll just make the default -
trunk/Source/JavaScriptCore/runtime/Options.h
r248919 r249075 311 311 v(unsigned, maximumVarargsForInlining, 100, Normal, nullptr) \ 312 312 \ 313 v(bool, useMaximalFlushInsertionPhase, false, Normal, "Setting to true allows the DFG's MaximalFlushInsertionPhase to run.") \314 \315 313 v(unsigned, maximumBinaryStringSwitchCaseLength, 50, Normal, nullptr) \ 316 314 v(unsigned, maximumBinaryStringSwitchTotalLength, 2000, Normal, nullptr) \ … … 546 544 v(enablePolyvariantCallInlining, usePolyvariantCallInlining, SameOption) \ 547 545 v(enablePolyvariantByIdInlining, usePolyvariantByIdInlining, SameOption) \ 548 v(enableMaximalFlushInsertionPhase, useMaximalFlushInsertionPhase, SameOption) \549 546 v(objectsAreImmortal, useImmortalObjects, SameOption) \ 550 547 v(showObjectStatistics, dumpObjectStatistics, SameOption) \
Note: See TracChangeset
for help on using the changeset viewer.