Diff
Modified: branches/safari-605-branch/Source/_javascript_Core/ChangeLog (227302 => 227303)
--- branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-01-22 17:57:05 UTC (rev 227302)
+++ branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-01-22 17:57:07 UTC (rev 227303)
@@ -1,3 +1,21 @@
+2018-01-22 Jason Marcell <jmarc...@apple.com>
+
+ Cherry-pick r227136. rdar://problem/36722486
+
+ 2018-01-18 Commit Queue <commit-qu...@webkit.org>
+
+ Unreviewed, rolling out r227096.
+ https://bugs.webkit.org/show_bug.cgi?id=181788
+
+ "it caused a 15% octane regression" (Requested by saamyjoon on
+ #webkit).
+
+ Reverted changeset:
+
+ "Support MultiGetByOffset in the DFG"
+ https://bugs.webkit.org/show_bug.cgi?id=181466
+ https://trac.webkit.org/changeset/227096
+
2018-01-18 Jason Marcell <jmarc...@apple.com>
Cherry-pick r226956. rdar://problem/36598688
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (227302 => 227303)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2018-01-22 17:57:05 UTC (rev 227302)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2018-01-22 17:57:07 UTC (rev 227303)
@@ -2875,6 +2875,10 @@
// contradiction then there must always be a contradiction even if subsequent passes don't
// realize it. This is the case here.
+ // Ordinarily you have to be careful with calling setFoundConstants()
+ // because of the effect on compile times, but this node is FTL-only.
+ m_state.setFoundConstants(true);
+
UniquedStringImpl* uid = m_graph.identifiers()[node->multiGetByOffsetData().identifierNumber];
AbstractValue base = forNode(node->child1());
@@ -2883,10 +2887,8 @@
for (const MultiGetByOffsetCase& getCase : node->multiGetByOffsetData().cases) {
RegisteredStructureSet set = getCase.set();
set.filter(base);
- if (set.isEmpty()) {
- m_state.setFoundConstants(true);
+ if (set.isEmpty())
continue;
- }
baseSet.merge(set);
switch (getCase.method().kind()) {
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (227302 => 227303)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2018-01-22 17:57:05 UTC (rev 227302)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2018-01-22 17:57:07 UTC (rev 227303)
@@ -3924,7 +3924,8 @@
}
if (getByIdStatus.numVariants() > 1) {
- if (getByIdStatus.makesCalls() || !m_graph.supportsMultiGetByOffset(currentCodeOrigin()) || !Options::usePolymorphicAccessInlining()) {
+ if (getByIdStatus.makesCalls() || !isFTL(m_graph.m_plan.mode)
+ || !Options::usePolymorphicAccessInlining()) {
set(VirtualRegister(destinationOperand),
addToGraph(getById, OpInfo(identifierNumber), OpInfo(prediction), base));
return;
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (227302 => 227303)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2018-01-22 17:57:05 UTC (rev 227302)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2018-01-22 17:57:07 UTC (rev 227303)
@@ -522,7 +522,7 @@
break;
}
- if (!m_graph.supportsMultiGetByOffset(node->origin.semantic))
+ if (!isFTL(m_graph.m_plan.mode))
break;
MultiGetByOffsetData* data = ""
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGGraph.h (227302 => 227303)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGGraph.h 2018-01-22 17:57:05 UTC (rev 227302)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGGraph.h 2018-01-22 17:57:07 UTC (rev 227303)
@@ -970,17 +970,6 @@
return result;
}
- bool supportsMultiGetByOffset(CodeOrigin origin)
- {
- if (!is64Bit())
- return false;
- if (isFTL(m_plan.mode))
- return true;
- // We want to ensure we get polyvariant profiling data from the GetById. This allows
- // the same get_by_id inlined into two separate functions to get independent profiling data.
- return !origin.inlineCallFrame;
- }
-
VM& m_vm;
Plan& m_plan;
CodeBlock* m_codeBlock;
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (227302 => 227303)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2018-01-22 17:57:05 UTC (rev 227302)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2018-01-22 17:57:07 UTC (rev 227303)
@@ -4332,89 +4332,6 @@
jsValueResult(resultGPR, node);
break;
}
-
- case MultiGetByOffset: {
- SpeculateCellOperand base(this, node->child1());
- GPRTemporary result(this);
-
- GPRReg baseGPR = base.gpr();
- GPRReg resultGPR = result.gpr();
-
- MultiGetByOffsetData& data = ""
-
- MacroAssembler::JumpList success;
- MacroAssembler::Jump next;
- for (unsigned i = 0; i < data.cases.size(); i++) {
- if (next.isSet())
- next.link(&m_jit);
-
- MultiGetByOffsetCase getCase = data.cases[i];
- GetByOffsetMethod method = getCase.method();
- const RegisteredStructureSet& structures = getCase.set();
-
- if (structures.size() == 1) {
- next = m_jit.branchWeakStructure(JITCompiler::NotEqual,
- JITCompiler::Address(baseGPR, JSCell::structureIDOffset()), structures[0]);
- } else {
- m_jit.load32(JITCompiler::Address(baseGPR, JSCell::structureIDOffset()), resultGPR);
- JITCompiler::JumpList match;
- for (size_t i = 0; i < structures.size() - 1; ++i) {
- match.append(
- m_jit.branchWeakStructure(JITCompiler::Equal, resultGPR, structures[i]));
- }
- next = m_jit.branchWeakStructure(JITCompiler::NotEqual, resultGPR, structures.last());
- match.link(&m_jit);
- }
-
- switch (method.kind()) {
- case GetByOffsetMethod::Invalid:
- RELEASE_ASSERT_NOT_REACHED();
- break;
-
- case GetByOffsetMethod::Constant:
- m_jit.move(MacroAssembler::Imm64(JSValue::encode(method.constant()->value())), resultGPR);
- break;
-
- case GetByOffsetMethod::Load:
- case GetByOffsetMethod::LoadFromPrototype: {
- PropertyOffset offset = method.offset();
- if (method.kind() == GetByOffsetMethod::Load) {
- if (isInlineOffset(offset)) {
- m_jit.load64(
- CCallHelpers::Address(baseGPR, offsetRelativeToBase(offset)), resultGPR);
- } else {
- m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), resultGPR);
- m_jit.load64(
- CCallHelpers::Address(resultGPR, offsetRelativeToBase(offset)), resultGPR);
- }
- } else {
- JSObject* base = asObject(method.prototype()->value());
- if (isInlineOffset(offset)) {
- char* pointerToField = bitwise_cast<char*>(base) + offsetRelativeToBase(offset);
- m_jit.load64(pointerToField, resultGPR);
- } else {
- char* pointerToButterfly = bitwise_cast<char*>(base) + JSObject::butterflyOffset();
- m_jit.loadPtr(pointerToButterfly, resultGPR);
- m_jit.load64(
- CCallHelpers::Address(resultGPR, offsetRelativeToBase(offset)), resultGPR);
- }
-
- }
- break;
- }
- }
- success.append(m_jit.jump());
- }
-
- if (next.isSet())
- next.link(&m_jit);
- speculationCheck(BadCache, JSValueRegs(baseGPR), node->child1(), m_jit.jump());
- if (!success.empty())
- success.link(&m_jit);
- jsValueResult(resultGPR, node);
- break;
- }
-
case GetGetter: {
compileGetGetter(node);
@@ -5726,6 +5643,7 @@
case ExtractOSREntryLocal:
case CheckInBounds:
case ArithIMul:
+ case MultiGetByOffset:
case MultiPutByOffset:
case FiatInt52:
case CheckBadCell:
