Title: [164071] trunk/Source/_javascript_Core
- Revision
- 164071
- Author
- [email protected]
- Date
- 2014-02-13 15:57:53 -0800 (Thu, 13 Feb 2014)
Log Message
Unreviewed, roll out http://trac.webkit.org/changeset/164066.
It broke tests and it was just plain wrong.
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeFromLLInt):
(JSC::GetByIdStatus::computeForStubInfo):
* runtime/Structure.h:
(JSC::Structure::takesSlowPathInDFGForImpureProperty):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (164070 => 164071)
--- trunk/Source/_javascript_Core/ChangeLog 2014-02-13 23:41:14 UTC (rev 164070)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-02-13 23:57:53 UTC (rev 164071)
@@ -1,3 +1,15 @@
+2014-02-13 Filip Pizlo <[email protected]>
+
+ Unreviewed, roll out http://trac.webkit.org/changeset/164066.
+
+ It broke tests and it was just plain wrong.
+
+ * bytecode/GetByIdStatus.cpp:
+ (JSC::GetByIdStatus::computeFromLLInt):
+ (JSC::GetByIdStatus::computeForStubInfo):
+ * runtime/Structure.h:
+ (JSC::Structure::takesSlowPathInDFGForImpureProperty):
+
2014-02-13 Ryuan Choi <[email protected]>
Unreviewed build fix.
Modified: trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp (164070 => 164071)
--- trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp 2014-02-13 23:41:14 UTC (rev 164070)
+++ trunk/Source/_javascript_Core/bytecode/GetByIdStatus.cpp 2014-02-13 23:57:53 UTC (rev 164071)
@@ -59,6 +59,9 @@
if (!structure)
return GetByIdStatus(NoInformation, false);
+ if (structure->takesSlowPathInDFGForImpureProperty())
+ return GetByIdStatus(NoInformation, false);
+
unsigned attributesIgnored;
JSCell* specificValue;
PropertyOffset offset = structure->getConcurrently(
@@ -188,6 +191,8 @@
case access_get_by_id_self: {
Structure* structure = stubInfo->u.getByIdSelf.baseObjectStructure.get();
+ if (structure->takesSlowPathInDFGForImpureProperty())
+ return GetByIdStatus(TakesSlowPath, true);
unsigned attributesIgnored;
JSCell* specificValue;
result.m_offset = structure->getConcurrently(
@@ -210,6 +215,9 @@
ASSERT(list->list[i].isDirect);
Structure* structure = list->list[i].base.get();
+ if (structure->takesSlowPathInDFGForImpureProperty())
+ return GetByIdStatus(TakesSlowPath, true);
+
if (result.m_structureSet.contains(structure))
continue;
Modified: trunk/Source/_javascript_Core/runtime/Structure.h (164070 => 164071)
--- trunk/Source/_javascript_Core/runtime/Structure.h 2014-02-13 23:41:14 UTC (rev 164070)
+++ trunk/Source/_javascript_Core/runtime/Structure.h 2014-02-13 23:57:53 UTC (rev 164071)
@@ -139,6 +139,7 @@
// DFG from inlining property accesses since structures don't transition when a new impure property appears.
bool takesSlowPathInDFGForImpureProperty()
{
+ ASSERT(!typeInfo().hasImpureGetOwnPropertySlot() || typeInfo().newImpurePropertyFiresWatchpoints());
return typeInfo().hasImpureGetOwnPropertySlot();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
