Title: [126826] trunk/Source/_javascript_Core
- Revision
- 126826
- Author
- [email protected]
- Date
- 2012-08-27 17:40:43 -0700 (Mon, 27 Aug 2012)
Log Message
Structure check hoisting should abstain if the OSR entry's must-handle value for the respective variable has a different structure
https://bugs.webkit.org/show_bug.cgi?id=95141
<rdar://problem/12170401>
Reviewed by Mark Hahnenberg.
* dfg/DFGStructureCheckHoistingPhase.cpp:
(JSC::DFG::StructureCheckHoistingPhase::run):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (126825 => 126826)
--- trunk/Source/_javascript_Core/ChangeLog 2012-08-28 00:29:39 UTC (rev 126825)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-08-28 00:40:43 UTC (rev 126826)
@@ -1,3 +1,14 @@
+2012-08-27 Filip Pizlo <[email protected]>
+
+ Structure check hoisting should abstain if the OSR entry's must-handle value for the respective variable has a different structure
+ https://bugs.webkit.org/show_bug.cgi?id=95141
+ <rdar://problem/12170401>
+
+ Reviewed by Mark Hahnenberg.
+
+ * dfg/DFGStructureCheckHoistingPhase.cpp:
+ (JSC::DFG::StructureCheckHoistingPhase::run):
+
2012-08-27 Mark Hahnenberg <[email protected]>
Remove use of ClassInfo from SpeculativeJIT::compileGetByValOnArguments
Modified: trunk/Source/_javascript_Core/dfg/DFGStructureCheckHoistingPhase.cpp (126825 => 126826)
--- trunk/Source/_javascript_Core/dfg/DFGStructureCheckHoistingPhase.cpp 2012-08-28 00:29:39 UTC (rev 126825)
+++ trunk/Source/_javascript_Core/dfg/DFGStructureCheckHoistingPhase.cpp 2012-08-28 00:40:43 UTC (rev 126826)
@@ -130,6 +130,50 @@
#endif
iter->second.m_structure = 0;
}
+
+ // Disable structure check hoisting for variables that cross the OSR entry that
+ // we're currently taking, and where the value currently does not have the
+ // structure we want.
+
+ for (BlockIndex blockIndex = 0; blockIndex < m_graph.m_blocks.size(); ++blockIndex) {
+ BasicBlock* block = m_graph.m_blocks[blockIndex].get();
+ if (!block)
+ continue;
+ ASSERT(block->isReachable);
+ if (!block->isOSRTarget)
+ continue;
+ if (block->bytecodeBegin != m_graph.m_osrEntryBytecodeIndex)
+ continue;
+ for (size_t i = 0; i < m_graph.m_mustHandleValues.size(); ++i) {
+ int operand = m_graph.m_mustHandleValues.operandForIndex(i);
+ NodeIndex nodeIndex = block->variablesAtHead.operand(operand);
+ if (nodeIndex == NoNode)
+ continue;
+ VariableAccessData* variable = m_graph[nodeIndex].variableAccessData();
+ HashMap<VariableAccessData*, CheckData>::iterator iter = m_map.find(variable);
+ if (iter == m_map.end())
+ continue;
+ if (!iter->second.m_structure)
+ continue;
+ JSValue value = m_graph.m_mustHandleValues[i];
+ if (!value || !value.isCell()) {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+ dataLog("Zeroing the structure to hoist for %s because the OSR entry value is not a cell: %s.\n",
+ m_graph.nameOfVariableAccessData(variable), value.description());
+#endif
+ iter->second.m_structure = 0;
+ continue;
+ }
+ if (value.asCell()->structure() != iter->second.m_structure) {
+#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
+ dataLog("Zeroing the structure to hoist for %s because the OSR entry value has structure %p and we wanted %p.\n",
+ m_graph.nameOfVariableAccessData(variable), value.asCell()->structure(), iter->second.m_structure);
+#endif
+ iter->second.m_structure = 0;
+ continue;
+ }
+ }
+ }
// Identify the set of variables that are live across a structure clobber.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
