- Revision
- 221084
- Author
- [email protected]
- Date
- 2017-08-23 10:41:48 -0700 (Wed, 23 Aug 2017)
Log Message
JSTests:
Add a micro-benchmark for checking that accessing a variable within a 'with'
block does not automatically prevent type prediction.
https://bugs.webkit.org/show_bug.cgi?id=175738
Patch by Robin Morisset <[email protected]> on 2017-08-23
Reviewed by Saam Barati.
* stress/with_and_arith.js: Added.
(with):
Source/_javascript_Core:
Make GetDynamicVar propagate heap predictions instead of saying HeapTop
https://bugs.webkit.org/show_bug.cgi?id=175738
Patch by Robin Morisset <[email protected]> on 2017-08-23
Reviewed by Saam Barati.
The heap prediction always end up in m_opInfo2. But GetDynamicVar was already storing getPutInfo in there.
So we move that one into m_opInfo. We can do this because it is 32-bit, and the already present identifierNumber
is also 32-bit, so we can pack both in m_opInfo (which is 64 bits).
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::makeDynamicVarOpInfo):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGNode.h:
(JSC::DFG::Node::getPutInfo):
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGPredictionPropagationPhase.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (221083 => 221084)
--- trunk/JSTests/ChangeLog 2017-08-23 17:41:39 UTC (rev 221083)
+++ trunk/JSTests/ChangeLog 2017-08-23 17:41:48 UTC (rev 221084)
@@ -1,3 +1,14 @@
+2017-08-23 Robin Morisset <[email protected]>
+
+ Add a micro-benchmark for checking that accessing a variable within a 'with'
+ block does not automatically prevent type prediction.
+ https://bugs.webkit.org/show_bug.cgi?id=175738
+
+ Reviewed by Saam Barati.
+
+ * stress/with_and_arith.js: Added.
+ (with):
+
2017-08-23 Skachkov Oleksandr <[email protected]>
[ESNext] Async iteration - Implement Async Generator - runtime
Added: trunk/JSTests/stress/with_and_arith.js (0 => 221084)
--- trunk/JSTests/stress/with_and_arith.js (rev 0)
+++ trunk/JSTests/stress/with_and_arith.js 2017-08-23 17:41:48 UTC (rev 221084)
@@ -0,0 +1,6 @@
+for (var i = 0; i < 10000;) {
+ var x = 1;
+ with({}) {
+ i += x;
+ }
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (221083 => 221084)
--- trunk/Source/_javascript_Core/ChangeLog 2017-08-23 17:41:39 UTC (rev 221083)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-08-23 17:41:48 UTC (rev 221084)
@@ -1,3 +1,22 @@
+2017-08-23 Robin Morisset <[email protected]>
+
+ Make GetDynamicVar propagate heap predictions instead of saying HeapTop
+ https://bugs.webkit.org/show_bug.cgi?id=175738
+
+ Reviewed by Saam Barati.
+
+ The heap prediction always end up in m_opInfo2. But GetDynamicVar was already storing getPutInfo in there.
+ So we move that one into m_opInfo. We can do this because it is 32-bit, and the already present identifierNumber
+ is also 32-bit, so we can pack both in m_opInfo (which is 64 bits).
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::makeDynamicVarOpInfo):
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::getPutInfo):
+ (JSC::DFG::Node::hasHeapPrediction):
+ * dfg/DFGPredictionPropagationPhase.cpp:
+
2017-08-23 Skachkov Oleksandr <[email protected]>
[ESNext] Async iteration - Implement Async Generator - runtime
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (221083 => 221084)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-08-23 17:41:39 UTC (rev 221083)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2017-08-23 17:41:48 UTC (rev 221084)
@@ -4064,6 +4064,13 @@
m_constants.shrink(0);
}
+static uint64_t makeDynamicVarOpInfo(unsigned identifierNumber, unsigned getPutInfo)
+{
+ static_assert(sizeof(identifierNumber) == 4,
+ "We cannot fit identifierNumber into the high bits of m_opInfo");
+ return static_cast<uint64_t>(identifierNumber) | (static_cast<uint64_t>(getPutInfo) << 32);
+}
+
bool ByteCodeParser::parseBlock(unsigned limit)
{
bool shouldContinueParsing = true;
@@ -5361,8 +5368,10 @@
}
if (needsDynamicLookup(resolveType, op_get_from_scope)) {
+ uint64_t opInfo1 = makeDynamicVarOpInfo(identifierNumber, currentInstruction[4].u.operand);
+ SpeculatedType prediction = getPrediction();
set(VirtualRegister(dst),
- addToGraph(GetDynamicVar, OpInfo(identifierNumber), OpInfo(currentInstruction[4].u.operand), get(VirtualRegister(scope))));
+ addToGraph(GetDynamicVar, OpInfo(opInfo1), OpInfo(prediction), get(VirtualRegister(scope))));
NEXT_OPCODE(op_get_from_scope);
}
@@ -5533,7 +5542,8 @@
if (needsDynamicLookup(resolveType, op_put_to_scope)) {
ASSERT(identifierNumber != UINT_MAX);
- addToGraph(PutDynamicVar, OpInfo(identifierNumber), OpInfo(currentInstruction[4].u.operand), get(VirtualRegister(scope)), get(VirtualRegister(value)));
+ uint64_t opInfo1 = makeDynamicVarOpInfo(identifierNumber, currentInstruction[4].u.operand);
+ addToGraph(PutDynamicVar, OpInfo(opInfo1), OpInfo(), get(VirtualRegister(scope)), get(VirtualRegister(value)));
NEXT_OPCODE(op_put_to_scope);
}
Modified: trunk/Source/_javascript_Core/dfg/DFGNode.h (221083 => 221084)
--- trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-08-23 17:41:39 UTC (rev 221083)
+++ trunk/Source/_javascript_Core/dfg/DFGNode.h 2017-08-23 17:41:48 UTC (rev 221084)
@@ -988,7 +988,7 @@
unsigned getPutInfo()
{
ASSERT(hasGetPutInfo());
- return m_opInfo2.as<unsigned>();
+ return static_cast<unsigned>(m_opInfo.as<uint64_t>() >> 32);
}
bool hasAccessorAttributes()
@@ -1528,6 +1528,7 @@
case AtomicsStore:
case AtomicsSub:
case AtomicsXor:
+ case GetDynamicVar:
return true;
default:
return false;
Modified: trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp (221083 => 221084)
--- trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2017-08-23 17:41:39 UTC (rev 221083)
+++ trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp 2017-08-23 17:41:48 UTC (rev 221084)
@@ -720,13 +720,13 @@
case LoadFromJSMapBucket:
case ToNumber:
case GetArgument:
- case CallDOMGetter: {
+ case CallDOMGetter:
+ case GetDynamicVar: {
setPrediction(m_currentNode->getHeapPrediction());
break;
}
- case ResolveScopeForHoistingFuncDeclInEval:
- case GetDynamicVar: {
+ case ResolveScopeForHoistingFuncDeclInEval: {
setPrediction(SpecBytecodeTop);
break;
}
