Log Message
DFG folding of PutById to SimpleReplace should consider the specialized function case https://bugs.webkit.org/show_bug.cgi?id=113093
Reviewed by Geoffrey Garen and Mark Hahnenberg. Source/_javascript_Core: * bytecode/PutByIdStatus.cpp: (JSC::PutByIdStatus::computeFor): LayoutTests: * fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function-expected.txt: Added. * fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.html: Added. * fast/js/jsc-test-list: * fast/js/script-tests/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.js: Added. (foo): (baz): (fuzz):
Modified Paths
- trunk/LayoutTests/ChangeLog
- trunk/LayoutTests/fast/js/jsc-test-list
- trunk/Source/_javascript_Core/ChangeLog
- trunk/Source/_javascript_Core/bytecode/PutByIdStatus.cpp
Added Paths
- trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function-expected.txt
- trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.html
- trunk/LayoutTests/fast/js/script-tests/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.js
Diff
Modified: trunk/LayoutTests/ChangeLog (146652 => 146653)
--- trunk/LayoutTests/ChangeLog 2013-03-22 20:41:56 UTC (rev 146652)
+++ trunk/LayoutTests/ChangeLog 2013-03-22 20:51:24 UTC (rev 146653)
@@ -1,3 +1,18 @@
+2013-03-22 Filip Pizlo <fpi...@apple.com>
+
+ DFG folding of PutById to SimpleReplace should consider the specialized function case
+ https://bugs.webkit.org/show_bug.cgi?id=113093
+
+ Reviewed by Geoffrey Garen and Mark Hahnenberg.
+
+ * fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function-expected.txt: Added.
+ * fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.html: Added.
+ * fast/js/jsc-test-list:
+ * fast/js/script-tests/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.js: Added.
+ (foo):
+ (baz):
+ (fuzz):
+
2013-03-22 Ryosuke Niwa <rn...@webkit.org>
Add failing test expectations to the test added by r146644 on Mac.
Added: trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function-expected.txt (0 => 146653)
--- trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function-expected.txt 2013-03-22 20:51:24 UTC (rev 146653)
@@ -0,0 +1,211 @@
+Checks that the DFG CFA does the right things if it proves that a put_by_id is a simple replace when storing to a specialized function property.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+baz!
+PASS bar.call({f:baz}, baz) is "baz"
+fuzz!
+PASS bar.call({f:baz}, fuzz) is "fuzz"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.html (0 => 146653)
--- trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.html 2013-03-22 20:51:24 UTC (rev 146653)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Modified: trunk/LayoutTests/fast/js/jsc-test-list (146652 => 146653)
--- trunk/LayoutTests/fast/js/jsc-test-list 2013-03-22 20:41:56 UTC (rev 146652)
+++ trunk/LayoutTests/fast/js/jsc-test-list 2013-03-22 20:51:24 UTC (rev 146653)
@@ -99,6 +99,7 @@
fast/js/dfg-branch-not-fail
fast/js/dfg-captured-var-get-local
fast/js/dfg-cfa-merge-with-dead-use-at-tail
+fast/js/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function
fast/js/dfg-cfg-simplify-eliminate-set-local-type-check-then-branch-not-null
fast/js/dfg-cfg-simplify-eliminate-set-local-type-check-then-branch-not-null-and-decrement
fast/js/dfg-cfg-simplify-eliminate-set-local-type-check-then-typeof
Added: trunk/LayoutTests/fast/js/script-tests/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.js (0 => 146653)
--- trunk/LayoutTests/fast/js/script-tests/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-cfa-prove-put-by-id-simple-when-storing-to-specialized-function.js 2013-03-22 20:51:24 UTC (rev 146653)
@@ -0,0 +1,32 @@
+description(
+"Checks that the DFG CFA does the right things if it proves that a put_by_id is a simple replace when storing to a specialized function property."
+);
+
+function foo(o, v) {
+ o.f = v;
+}
+
+// Warm up foo's put_by_id to make it look polymorphic.
+for (var i = 0; i < 100; ++i)
+ foo(i % 2 ? {a: 1} : {b: 2});
+
+function bar(f) {
+ foo(this, f);
+ return this.f();
+}
+
+function baz() {
+ debug("baz!");
+ return "baz";
+}
+
+for (var i = 0; i < 100; ++i)
+ shouldBe("bar.call({f:baz}, baz)", "\"baz\"");
+
+function fuzz() {
+ debug("fuzz!");
+ return "fuzz";
+}
+
+shouldBe("bar.call({f:baz}, fuzz)", "\"fuzz\"");
+
Modified: trunk/Source/_javascript_Core/ChangeLog (146652 => 146653)
--- trunk/Source/_javascript_Core/ChangeLog 2013-03-22 20:41:56 UTC (rev 146652)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-03-22 20:51:24 UTC (rev 146653)
@@ -1,3 +1,13 @@
+2013-03-22 Filip Pizlo <fpi...@apple.com>
+
+ DFG folding of PutById to SimpleReplace should consider the specialized function case
+ https://bugs.webkit.org/show_bug.cgi?id=113093
+
+ Reviewed by Geoffrey Garen and Mark Hahnenberg.
+
+ * bytecode/PutByIdStatus.cpp:
+ (JSC::PutByIdStatus::computeFor):
+
2013-03-22 David Kilzer <ddkil...@apple.com>
BUILD FIX (r146558): Build testapi.mm with ARC enabled for armv7s
Modified: trunk/Source/_javascript_Core/bytecode/PutByIdStatus.cpp (146652 => 146653)
--- trunk/Source/_javascript_Core/bytecode/PutByIdStatus.cpp 2013-03-22 20:41:56 UTC (rev 146652)
+++ trunk/Source/_javascript_Core/bytecode/PutByIdStatus.cpp 2013-03-22 20:51:24 UTC (rev 146653)
@@ -147,11 +147,16 @@
return PutByIdStatus(TakesSlowPath);
unsigned attributes;
- JSCell* specificValueIgnored;
- PropertyOffset offset = structure->get(globalData, ident, attributes, specificValueIgnored);
+ JSCell* specificValue;
+ PropertyOffset offset = structure->get(globalData, ident, attributes, specificValue);
if (isValidOffset(offset)) {
if (attributes & (Accessor | ReadOnly))
return PutByIdStatus(TakesSlowPath);
+ if (specificValue) {
+ // We need the PutById slow path to verify that we're storing the right value into
+ // the specialized slot.
+ return PutByIdStatus(TakesSlowPath);
+ }
return PutByIdStatus(SimpleReplace, structure, 0, 0, offset);
}
_______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes
