Title: [245813] trunk
- Revision
- 245813
- Author
- [email protected]
- Date
- 2019-05-28 09:03:02 -0700 (Tue, 28 May 2019)
Log Message
JITOperations putByVal should mark negative array indices as out-of-bounds
https://bugs.webkit.org/show_bug.cgi?id=198271
Reviewed by Saam Barati.
JSTests:
* microbenchmarks/get-by-val-negative-array-index.js:
(foo):
Update the getByVal microbenchmark added in r245769. This now shows that r245769
is 4.2x faster than the previous commit.
* microbenchmarks/put-by-val-negative-array-index.js: Added.
(foo):
Source/_javascript_Core:
Similar to what was done to getByVal in r245769, we should also mark put_by_val as out-of-bounds
when we exit from DFG for putting to a negative index. This avoids the same scenario where we keep
recompiling a CodeBlock with DFG and exiting at the same bytecode.
This is a 3.7x improvement in the microbenchmark being added: put-by-val-negative-array-index.js.
* jit/JITOperations.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (245812 => 245813)
--- trunk/JSTests/ChangeLog 2019-05-28 15:36:04 UTC (rev 245812)
+++ trunk/JSTests/ChangeLog 2019-05-28 16:03:02 UTC (rev 245813)
@@ -1,3 +1,18 @@
+2019-05-28 Tadeu Zagallo <[email protected]>
+
+ JITOperations putByVal should mark negative array indices as out-of-bounds
+ https://bugs.webkit.org/show_bug.cgi?id=198271
+
+ Reviewed by Saam Barati.
+
+ * microbenchmarks/get-by-val-negative-array-index.js:
+ (foo):
+ Update the getByVal microbenchmark added in r245769. This now shows that r245769
+ is 4.2x faster than the previous commit.
+
+ * microbenchmarks/put-by-val-negative-array-index.js: Added.
+ (foo):
+
2019-05-25 Tadeu Zagallo <[email protected]>
JITOperations getByVal should mark negative array indices as out-of-bounds
Modified: trunk/JSTests/microbenchmarks/get-by-val-negative-array-index.js (245812 => 245813)
--- trunk/JSTests/microbenchmarks/get-by-val-negative-array-index.js 2019-05-28 15:36:04 UTC (rev 245812)
+++ trunk/JSTests/microbenchmarks/get-by-val-negative-array-index.js 2019-05-28 16:03:02 UTC (rev 245813)
@@ -1,11 +1,19 @@
function foo(arr, index) {
+ for (let i = 0; i < 1e2; i++) {
+ let x = {};
+ x.x = arr;
+ }
+
return arr[index];
}
noInline(foo);
-const arr = new Array(1000).fill({});
-for (let i = 0; i < 1e7; i++) {
+const arr = new Array(10).fill({});
+for (let i = 0; i < 1e6; i++) {
foo(arr, i % arr.length);
- if (!(i % 1e3))
+}
+for (let i = 0; i < 1e6; i++) {
+ foo(arr, i % arr.length);
+ if (!(i % arr.length))
foo(arr, -1);
}
Added: trunk/JSTests/microbenchmarks/put-by-val-negative-array-index.js (0 => 245813)
--- trunk/JSTests/microbenchmarks/put-by-val-negative-array-index.js (rev 0)
+++ trunk/JSTests/microbenchmarks/put-by-val-negative-array-index.js 2019-05-28 16:03:02 UTC (rev 245813)
@@ -0,0 +1,20 @@
+function foo(arr, index) {
+ arr[index] = index;
+
+ for (let j = 0; j < 1e2; j++) {
+ let x = {};
+ x.x = arr;
+ }
+}
+noInline(foo);
+
+const arr = new Array(10).fill({});
+let result = 0;
+for (let i = 0; i < 1e6; i++) {
+ result += foo(arr, i % arr.length);
+}
+for (let i = 0; i < 1e6; i++) {
+ result += foo(arr, i % arr.length);
+ if (!(i % arr.length))
+ result += foo(arr, -1);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (245812 => 245813)
--- trunk/Source/_javascript_Core/ChangeLog 2019-05-28 15:36:04 UTC (rev 245812)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-05-28 16:03:02 UTC (rev 245813)
@@ -1,3 +1,18 @@
+2019-05-28 Tadeu Zagallo <[email protected]>
+
+ JITOperations putByVal should mark negative array indices as out-of-bounds
+ https://bugs.webkit.org/show_bug.cgi?id=198271
+
+ Reviewed by Saam Barati.
+
+ Similar to what was done to getByVal in r245769, we should also mark put_by_val as out-of-bounds
+ when we exit from DFG for putting to a negative index. This avoids the same scenario where we keep
+ recompiling a CodeBlock with DFG and exiting at the same bytecode.
+
+ This is a 3.7x improvement in the microbenchmark being added: put-by-val-negative-array-index.js.
+
+ * jit/JITOperations.cpp:
+
2019-05-28 Yusuke Suzuki <[email protected]>
Unreviewed, revert r242070 due to Membuster regression
Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (245812 => 245813)
--- trunk/Source/_javascript_Core/jit/JITOperations.cpp 2019-05-28 15:36:04 UTC (rev 245812)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp 2019-05-28 16:03:02 UTC (rev 245813)
@@ -653,6 +653,10 @@
scope.release();
baseValue.putByIndex(callFrame, i, value, callFrame->codeBlock()->isStrictMode());
return;
+ } else if (subscript.isInt32()) {
+ byValInfo->tookSlowPath = true;
+ if (baseValue.isObject())
+ byValInfo->arrayProfile->setOutOfBounds();
}
auto property = subscript.toPropertyKey(callFrame);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
