Title: [100219] trunk/Source/_javascript_Core
- Revision
- 100219
- Author
- [email protected]
- Date
- 2011-11-14 17:04:08 -0800 (Mon, 14 Nov 2011)
Log Message
DFG put_by_id transition optimizations test the wrong structures
https://bugs.webkit.org/show_bug.cgi?id=72324
Reviewed by Gavin Barraclough.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::structureChainIsStillValid):
(JSC::DFG::ByteCodeParser::parseBlock):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::privateCompilePutByIdTransition):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (100218 => 100219)
--- trunk/Source/_javascript_Core/ChangeLog 2011-11-15 00:57:53 UTC (rev 100218)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-11-15 01:04:08 UTC (rev 100219)
@@ -1,3 +1,16 @@
+2011-11-14 Filip Pizlo <[email protected]>
+
+ DFG put_by_id transition optimizations test the wrong structures
+ https://bugs.webkit.org/show_bug.cgi?id=72324
+
+ Reviewed by Gavin Barraclough.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::structureChainIsStillValid):
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::privateCompilePutByIdTransition):
+
2011-11-14 Michael Saboff <[email protected]>
Further changes and cleanup to JSString.h and cpp.
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (100218 => 100219)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2011-11-15 00:57:53 UTC (rev 100218)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2011-11-15 01:04:08 UTC (rev 100219)
@@ -684,6 +684,22 @@
return nodeIndex;
}
+ bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)
+ {
+ if (direct)
+ return true;
+
+ if (!previousStructure->storedPrototype().isNull() && previousStructure->storedPrototype().asCell()->structure() != chain->head()->get())
+ return false;
+
+ for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
+ if (!(*it)->storedPrototype().isNull() && (*it)->storedPrototype().asCell()->structure() != it[1].get())
+ return false;
+ }
+
+ return true;
+ }
+
void buildOperandMapsIfNecessary();
JSGlobalData* m_globalData;
@@ -1803,9 +1819,12 @@
Identifier identifier = m_codeBlock->identifier(identifierNumber);
size_t offset = newStructure->get(*m_globalData, identifier);
- if (offset != notFound) {
+ if (offset != notFound && structureChainIsStillValid(direct, previousStructure, structureChain)) {
addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure)), base);
if (!direct) {
+ if (!previousStructure->storedPrototype().isNull())
+ addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure->storedPrototype().asCell()->structure())), cellConstant(previousStructure->storedPrototype().asCell()));
+
for (WriteBarrier<Structure>* it = structureChain->head(); *it; ++it) {
JSValue prototype = (*it)->storedPrototype();
if (prototype.isNull())
Modified: trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp (100218 => 100219)
--- trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2011-11-15 00:57:53 UTC (rev 100218)
+++ trunk/Source/_javascript_Core/jit/JITPropertyAccess.cpp 2011-11-15 01:04:08 UTC (rev 100219)
@@ -521,12 +521,17 @@
// Check eax is an object of the right Structure.
failureCases.append(emitJumpIfNotJSCell(regT0));
failureCases.append(branchPtr(NotEqual, Address(regT0, JSCell::structureOffset()), TrustedImmPtr(oldStructure)));
+
testPrototype(oldStructure->storedPrototype(), failureCases);
+
+ ASSERT(oldStructure->storedPrototype().isNull() || oldStructure->storedPrototype().asCell()->structure() == chain->head()->get());
// ecx = baseObject->m_structure
if (!direct) {
- for (WriteBarrier<Structure>* it = chain->head(); *it; ++it)
+ for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
+ ASSERT((*it)->storedPrototype().isNull() || (*it)->storedPrototype().asCell()->structure() == it[1].get());
testPrototype((*it)->storedPrototype(), failureCases);
+ }
}
Call callTarget;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
