Modified: trunk/Source/_javascript_Core/ChangeLog (133566 => 133567)
--- trunk/Source/_javascript_Core/ChangeLog 2012-11-06 07:44:18 UTC (rev 133566)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-11-06 07:47:51 UTC (rev 133567)
@@ -1,5 +1,19 @@
2012-11-05 Filip Pizlo <[email protected]>
+ DFG should not fall down to patchable GetById just because a prototype had things added to it
+ https://bugs.webkit.org/show_bug.cgi?id=101299
+
+ Reviewed by Geoffrey Garen.
+
+ This looks like a slight win on V8v7 and SunSpider.
+
+ * bytecode/DFGExitProfile.h:
+ (JSC::DFG::exitKindToString):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
+2012-11-05 Filip Pizlo <[email protected]>
+
Get rid of method_check
https://bugs.webkit.org/show_bug.cgi?id=101147
Modified: trunk/Source/_javascript_Core/bytecode/DFGExitProfile.h (133566 => 133567)
--- trunk/Source/_javascript_Core/bytecode/DFGExitProfile.h 2012-11-06 07:44:18 UTC (rev 133566)
+++ trunk/Source/_javascript_Core/bytecode/DFGExitProfile.h 2012-11-06 07:47:51 UTC (rev 133567)
@@ -36,6 +36,7 @@
ExitKindUnset,
BadType, // We exited because a type prediction was wrong.
BadCache, // We exited because an inline cache was wrong.
+ BadWeakConstantCache, // We exited because a cache on a weak constant (usually a prototype) was wrong.
BadIndexingType, // We exited because an indexing type was wrong.
Overflow, // We exited because of overflow.
NegativeZero, // We exited because we encountered negative zero.
@@ -55,6 +56,8 @@
return "BadType";
case BadCache:
return "BadCache";
+ case BadWeakConstantCache:
+ return "BadWeakConstantCache";
case Overflow:
return "Overflow";
case NegativeZero:
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (133566 => 133567)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-11-06 07:44:18 UTC (rev 133566)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2012-11-06 07:47:51 UTC (rev 133567)
@@ -3830,9 +3830,15 @@
ASSERT(node.structureSet().size());
+ ExitKind exitKind;
+ if (m_jit.graph()[node.child1()].op() == WeakJSConstant)
+ exitKind = BadWeakConstantCache;
+ else
+ exitKind = BadCache;
+
if (node.structureSet().size() == 1) {
speculationCheckWithConditionalDirection(
- BadCache, JSValueRegs(base.gpr()), NoNode,
+ exitKind, JSValueRegs(base.gpr()), NoNode,
m_jit.branchWeakPtr(
JITCompiler::NotEqual,
JITCompiler::Address(base.gpr(), JSCell::structureOffset()),
@@ -3849,7 +3855,7 @@
done.append(m_jit.branchWeakPtr(JITCompiler::Equal, structure.gpr(), node.structureSet()[i]));
speculationCheckWithConditionalDirection(
- BadCache, JSValueRegs(base.gpr()), NoNode,
+ exitKind, JSValueRegs(base.gpr()), NoNode,
m_jit.branchWeakPtr(
JITCompiler::NotEqual, structure.gpr(), node.structureSet().last()),
node.op() == ForwardCheckStructure);
@@ -3873,7 +3879,8 @@
m_jit.addWeakReference(node.structure());
node.structure()->addTransitionWatchpoint(
speculationWatchpointWithConditionalDirection(
- BadCache, node.op() == ForwardStructureTransitionWatchpoint));
+ m_jit.graph()[node.child1()].op() == WeakJSConstant ? BadWeakConstantCache : BadCache,
+ node.op() == ForwardStructureTransitionWatchpoint));
#if !ASSERT_DISABLED
SpeculateCellOperand op1(this, node.child1());
