Title: [276823] trunk/Source/_javascript_Core
- Revision
- 276823
- Author
- [email protected]
- Date
- 2021-04-29 17:12:00 -0700 (Thu, 29 Apr 2021)
Log Message
Inlining property accesses inside constant folding should check Options::useAccessInlining
https://bugs.webkit.org/show_bug.cgi?id=225194
Reviewed by Mark Lam.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::tryFoldAsPutByOffset):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (276822 => 276823)
--- trunk/Source/_javascript_Core/ChangeLog 2021-04-29 23:44:29 UTC (rev 276822)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-04-30 00:12:00 UTC (rev 276823)
@@ -1,5 +1,20 @@
2021-04-29 Saam Barati <[email protected]>
+ Inlining property accesses inside constant folding should check Options::useAccessInlining
+ https://bugs.webkit.org/show_bug.cgi?id=225194
+
+ Reviewed by Mark Lam.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ (JSC::DFG::ConstantFoldingPhase::tryFoldAsPutByOffset):
+
+2021-04-29 Saam Barati <[email protected]>
+
Sampling profiler should dump a tier breakdown, and add ability to see time spent in C code with sampleCCode=0, and fix bugs with frames having the wrong jitType if they're inlined
https://bugs.webkit.org/show_bug.cgi?id=225116
Modified: trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h (276822 => 276823)
--- trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2021-04-29 23:44:29 UTC (rev 276822)
+++ trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h 2021-04-30 00:12:00 UTC (rev 276823)
@@ -3411,7 +3411,9 @@
case GetById:
case GetByIdFlush: {
AbstractValue& value = forNode(node->child1());
- if (value.m_structure.isFinite()
+
+ if (Options::useAccessInlining()
+ && value.m_structure.isFinite()
&& (node->child1().useKind() == CellUse || !(value.m_type & ~SpecCell))) {
UniquedStringImpl* uid = node->cacheableIdentifier().uid();
GetByStatus status = GetByStatus::computeFor(value.m_structure.toStructureSet(), uid);
@@ -4110,7 +4112,7 @@
case PutByIdFlush:
case PutByIdDirect: {
AbstractValue& value = forNode(node->child1());
- if (value.m_structure.isFinite()) {
+ if (Options::useAccessInlining() && value.m_structure.isFinite()) {
bool isDirect = node->op() == PutByIdDirect || node->op() == PutPrivateNameById;
auto privateFieldPutKind = node->op() == PutPrivateNameById ? node->privateFieldPutKind() : PrivateFieldPutKind::none();
PutByIdStatus status = PutByIdStatus::computeFor(
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (276822 => 276823)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2021-04-29 23:44:29 UTC (rev 276822)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2021-04-30 00:12:00 UTC (rev 276823)
@@ -5949,7 +5949,8 @@
// instanceof ICs because the profit of this optimization is fairly low. So, in the
// absence of any information, it's better to avoid making this be the cause of a
// recompilation.
- if (JSObject* commonPrototype = status.commonPrototype()) {
+ JSObject* commonPrototype = status.commonPrototype();
+ if (commonPrototype && Options::useAccessInlining()) {
addToGraph(CheckIsConstant, OpInfo(m_graph.freeze(commonPrototype)), prototype);
bool allOK = true;
@@ -8245,7 +8246,7 @@
m_inlineStackTop->m_baselineMap, m_icContextStack,
currentCodeOrigin(), uid);
- if (status.isSimple()) {
+ if (status.isSimple() && Options::useAccessInlining()) {
bool allOK = true;
MatchStructureData* data = ""
for (const InByIdVariant& variant : status.variants()) {
Modified: trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp (276822 => 276823)
--- trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2021-04-29 23:44:29 UTC (rev 276822)
+++ trunk/Source/_javascript_Core/dfg/DFGConstantFoldingPhase.cpp 2021-04-30 00:12:00 UTC (rev 276823)
@@ -610,6 +610,9 @@
m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
alreadyHandled = true; // Don't allow the default constant folder to do things to this.
+ if (!Options::useAccessInlining())
+ break;
+
if (!baseValue.m_structure.isFinite()
|| (node->child1().useKind() == UntypedUse || (baseValue.m_type & ~SpecCell)))
break;
@@ -1388,6 +1391,9 @@
void tryFoldAsPutByOffset(Node* node, unsigned indexInBlock, Edge baseEdge, Edge valueEdge, bool isDirect, PrivateFieldPutKind privateFieldPutKind, bool& changed, bool& alreadyHandled)
{
+ if (!Options::useAccessInlining())
+ return;
+
NodeOrigin origin = node->origin;
Node* baseNode = baseEdge.node();
UniquedStringImpl* uid = node->cacheableIdentifier().uid();
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
