Title: [237447] trunk/Source/_javascript_Core
- Revision
- 237447
- Author
- [email protected]
- Date
- 2018-10-26 00:56:56 -0700 (Fri, 26 Oct 2018)
Log Message
[JSC] havingABadTimeWatchpoint is not required in Array#indexOf optimization
https://bugs.webkit.org/show_bug.cgi?id=190941
Reviewed by Saam Barati.
While "Rest" operation fast path requires havingABadTimeWatchpoint since it allocates
JSArray, Array#{indexOf,lastIndexOf} do not require it when we use the fast path for them.
This patch removes watching on havingABadTimeWatchpoint in Array#indexOf. The test causing
"havingABadTime" is already included in our test suites (e.g. array-indexof-have-a-bad-time.js).
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* runtime/JSArrayInlines.h:
(JSC::JSArray::canDoFastIndexedAccess):
* runtime/JSGlobalObject.h:
* runtime/JSGlobalObjectInlines.h:
(JSC::JSGlobalObject::isArrayPrototypeIteratorProtocolFastAndNonObservable):
(JSC::JSGlobalObject::isArrayPrototypeIndexedAccessFastAndNonObservable): Deleted.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (237446 => 237447)
--- trunk/Source/_javascript_Core/ChangeLog 2018-10-26 05:06:24 UTC (rev 237446)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-10-26 07:56:56 UTC (rev 237447)
@@ -1,5 +1,26 @@
2018-10-25 Yusuke Suzuki <[email protected]>
+ [JSC] havingABadTimeWatchpoint is not required in Array#indexOf optimization
+ https://bugs.webkit.org/show_bug.cgi?id=190941
+
+ Reviewed by Saam Barati.
+
+ While "Rest" operation fast path requires havingABadTimeWatchpoint since it allocates
+ JSArray, Array#{indexOf,lastIndexOf} do not require it when we use the fast path for them.
+ This patch removes watching on havingABadTimeWatchpoint in Array#indexOf. The test causing
+ "havingABadTime" is already included in our test suites (e.g. array-indexof-have-a-bad-time.js).
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handleIntrinsicCall):
+ * runtime/JSArrayInlines.h:
+ (JSC::JSArray::canDoFastIndexedAccess):
+ * runtime/JSGlobalObject.h:
+ * runtime/JSGlobalObjectInlines.h:
+ (JSC::JSGlobalObject::isArrayPrototypeIteratorProtocolFastAndNonObservable):
+ (JSC::JSGlobalObject::isArrayPrototypeIndexedAccessFastAndNonObservable): Deleted.
+
+2018-10-25 Yusuke Suzuki <[email protected]>
+
Unreviewed, partial rolling in r237254
https://bugs.webkit.org/show_bug.cgi?id=190340
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (237446 => 237447)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2018-10-26 05:06:24 UTC (rev 237446)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2018-10-26 07:56:56 UTC (rev 237447)
@@ -2362,12 +2362,10 @@
// FIXME: We could easily relax the Array/Object.prototype transition as long as we OSR exitted if we saw a hole.
// https://bugs.webkit.org/show_bug.cgi?id=173171
- if (globalObject->havingABadTimeWatchpoint()->isStillValid()
- && arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
+ if (arrayPrototypeStructure->transitionWatchpointSetIsStillValid()
&& objectPrototypeStructure->transitionWatchpointSetIsStillValid()
&& globalObject->arrayPrototypeChainIsSane()) {
- m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
Modified: trunk/Source/_javascript_Core/runtime/JSArrayInlines.h (237446 => 237447)
--- trunk/Source/_javascript_Core/runtime/JSArrayInlines.h 2018-10-26 05:06:24 UTC (rev 237446)
+++ trunk/Source/_javascript_Core/runtime/JSArrayInlines.h 2018-10-26 07:56:56 UTC (rev 237447)
@@ -74,7 +74,7 @@
inline bool JSArray::canDoFastIndexedAccess(VM& vm)
{
JSGlobalObject* globalObject = this->globalObject();
- if (!globalObject->isArrayPrototypeIndexedAccessFastAndNonObservable())
+ if (!globalObject->arrayPrototypeChainIsSane())
return false;
Structure* structure = this->structure(vm);
Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.h (237446 => 237447)
--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.h 2018-10-26 05:06:24 UTC (rev 237446)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.h 2018-10-26 07:56:56 UTC (rev 237447)
@@ -476,7 +476,6 @@
PoisonedUniquePtr<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>> m_setPrototypeAddWatchpoint;
PoisonedUniquePtr<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>> m_numberPrototypeToStringWatchpoint;
- bool isArrayPrototypeIndexedAccessFastAndNonObservable();
bool isArrayPrototypeIteratorProtocolFastAndNonObservable();
bool isMapPrototypeIteratorProtocolFastAndNonObservable();
bool isSetPrototypeIteratorProtocolFastAndNonObservable();
Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObjectInlines.h (237446 => 237447)
--- trunk/Source/_javascript_Core/runtime/JSGlobalObjectInlines.h 2018-10-26 05:06:24 UTC (rev 237446)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObjectInlines.h 2018-10-26 07:56:56 UTC (rev 237447)
@@ -52,12 +52,6 @@
&& objectPrototypeIsSane();
}
-ALWAYS_INLINE bool JSGlobalObject::isArrayPrototypeIndexedAccessFastAndNonObservable()
-{
- // We're fast if we don't have any indexed properties on the prototype.
- return !isHavingABadTime() && arrayPrototypeChainIsSane();
-}
-
ALWAYS_INLINE bool JSGlobalObject::isArrayPrototypeIteratorProtocolFastAndNonObservable()
{
// We're fast if we don't have any indexed properties on the prototype.
@@ -68,7 +62,7 @@
// carefully set up watchpoints to have correct ordering while JS code is
// executing concurrently.
- return arrayIteratorProtocolWatchpoint().isStillValid() && isArrayPrototypeIndexedAccessFastAndNonObservable();
+ return arrayIteratorProtocolWatchpoint().isStillValid() && !isHavingABadTime() && arrayPrototypeChainIsSane();
}
// We're non-observable if the iteration protocol hasn't changed.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
