Title: [280895] releases/WebKitGTK/webkit-2.32
- Revision
- 280895
- Author
- [email protected]
- Date
- 2021-08-11 03:16:12 -0700 (Wed, 11 Aug 2021)
Log Message
Merge r274539 - Object allocation sinking phase should prioritize materializations with no dependencies before materializations with no reverse dependencies
https://bugs.webkit.org/show_bug.cgi?id=221069
<rdar://problem/73686589>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/allocation-sinking-scope-materialization-order.js: Added.
(var3.var2.x):
(var3):
Source/_javascript_Core:
Suppose we have two scope objects, A and B. Let's say A points to B, so B is
A's parent scope. A then depends on B. B has no dependencies here. When deciding
an order to materialize scope objects, we should always do it in reverse dependency
order. So above, we should materialize B, then A.
Inside object allocation sinking phase, when at an object materialization
site, we do track both dependencies and reverse dependencies. In the above
object graph, we'd attempt to materialize the objects in the right order,
always picking things with no dependencies first (and updating the list of
dependencies as we materialzed objects).
The code was using an std::list to track things to materialize, and it had
notions for materializing something first, and materializing something last.
However, there was a bug in how the code managed to insert things when
it first inserted last followed by inserting first. This patch simplifies
the code and makes it do the right thing.
* dfg/DFGObjectAllocationSinkingPhase.cpp:
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/JSTests/ChangeLog (280894 => 280895)
--- releases/WebKitGTK/webkit-2.32/JSTests/ChangeLog 2021-08-11 10:15:10 UTC (rev 280894)
+++ releases/WebKitGTK/webkit-2.32/JSTests/ChangeLog 2021-08-11 10:16:12 UTC (rev 280895)
@@ -1,3 +1,15 @@
+2021-03-16 Saam Barati <[email protected]>
+
+ Object allocation sinking phase should prioritize materializations with no dependencies before materializations with no reverse dependencies
+ https://bugs.webkit.org/show_bug.cgi?id=221069
+ <rdar://problem/73686589>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/allocation-sinking-scope-materialization-order.js: Added.
+ (var3.var2.x):
+ (var3):
+
2021-06-13 Saam Barati <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=226576
Added: releases/WebKitGTK/webkit-2.32/JSTests/stress/allocation-sinking-scope-materialization-order.js (0 => 280895)
--- releases/WebKitGTK/webkit-2.32/JSTests/stress/allocation-sinking-scope-materialization-order.js (rev 0)
+++ releases/WebKitGTK/webkit-2.32/JSTests/stress/allocation-sinking-scope-materialization-order.js 2021-08-11 10:16:12 UTC (rev 280895)
@@ -0,0 +1,22 @@
+//@ runDefault("--thresholdForJITAfterWarmUp=10", "--thresholdForFTLOptimizeAfterWarmUp=20", "--useConcurrentJIT=0", "--useConcurrentGC=0")
+
+function var3() {
+ const var15 = { a : 10 } ;
+ const var7 = { } ;
+ var7.d = var15 ;
+ const var10 = [ 1 ] ;
+ var10 . toString = [ ] ;
+ if ( ! var10 ) { return 0 ; }
+ for ( var i =0; i < 50; i++ ) {
+ var var2 = "aa";
+ var2.x = function ( ) {
+ var3.c = new Uint32Array ( 1 ) ;
+ var15.b = new Uint32Array ( 1 ) ;
+ }
+ var7 [ 0 ] = { } ;
+ }
+}
+
+for(var i = 0; i < 2000; i++) {
+ var3();
+}
Modified: releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/ChangeLog (280894 => 280895)
--- releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/ChangeLog 2021-08-11 10:15:10 UTC (rev 280894)
+++ releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/ChangeLog 2021-08-11 10:16:12 UTC (rev 280895)
@@ -1,3 +1,30 @@
+2021-03-16 Saam Barati <[email protected]>
+
+ Object allocation sinking phase should prioritize materializations with no dependencies before materializations with no reverse dependencies
+ https://bugs.webkit.org/show_bug.cgi?id=221069
+ <rdar://problem/73686589>
+
+ Reviewed by Yusuke Suzuki.
+
+ Suppose we have two scope objects, A and B. Let's say A points to B, so B is
+ A's parent scope. A then depends on B. B has no dependencies here. When deciding
+ an order to materialize scope objects, we should always do it in reverse dependency
+ order. So above, we should materialize B, then A.
+
+ Inside object allocation sinking phase, when at an object materialization
+ site, we do track both dependencies and reverse dependencies. In the above
+ object graph, we'd attempt to materialize the objects in the right order,
+ always picking things with no dependencies first (and updating the list of
+ dependencies as we materialzed objects).
+
+ The code was using an std::list to track things to materialize, and it had
+ notions for materializing something first, and materializing something last.
+ However, there was a bug in how the code managed to insert things when
+ it first inserted last followed by inserting first. This patch simplifies
+ the code and makes it do the right thing.
+
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+
2021-08-09 Michael Catanzaro <[email protected]>
Adding missing REFERENCED_FROM_ASM annotations to facilitate LTO
Modified: releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp (280894 => 280895)
--- releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2021-08-11 10:15:10 UTC (rev 280894)
+++ releases/WebKitGTK/webkit-2.32/Source/_javascript_Core/dfg/DFGObjectAllocationSinkingPhase.cpp 2021-08-11 10:16:12 UTC (rev 280895)
@@ -1579,23 +1579,26 @@
// Nodes without remaining unmaterialized fields will be
// materialized first - amongst the remaining unmaterialized
// nodes
- StdList<Allocation> toMaterialize;
- auto firstPos = toMaterialize.begin();
+ Vector<Allocation> toMaterialize;
+ toMaterialize.resize(escapees.size());
+ size_t firstIndex = 0;
+ size_t lastIndex = toMaterialize.size();
auto materializeFirst = [&] (Allocation&& allocation) {
+ RELEASE_ASSERT(firstIndex < lastIndex);
materialize(allocation.identifier());
- // We need to insert *after* the current position
- if (firstPos != toMaterialize.end())
- ++firstPos;
- firstPos = toMaterialize.insert(firstPos, WTFMove(allocation));
+ toMaterialize[firstIndex] = WTFMove(allocation);
+ ++firstIndex;
};
// Nodes that no other unmaterialized node points to will be
// materialized last - amongst the remaining unmaterialized
// nodes
- auto lastPos = toMaterialize.end();
auto materializeLast = [&] (Allocation&& allocation) {
materialize(allocation.identifier());
- lastPos = toMaterialize.insert(lastPos, WTFMove(allocation));
+ RELEASE_ASSERT(firstIndex < lastIndex);
+ RELEASE_ASSERT(lastIndex);
+ --lastIndex;
+ toMaterialize[lastIndex] = WTFMove(allocation);
};
// These are the promoted locations that contains some of the
@@ -1654,6 +1657,8 @@
escapees.remove(identifier);
}
+ RELEASE_ASSERT(firstIndex == lastIndex);
+
materialized.clear();
NodeSet escaped;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
