Log Message
Unreviewed, rolling out r167501. https://bugs.webkit.org/show_bug.cgi?id=131913
It broke DYEBench (Requested by mhahnenberg on #webkit). Reverted changeset: "Deleting properties poisons objects" https://bugs.webkit.org/show_bug.cgi?id=131551 http://trac.webkit.org/changeset/167501
Modified Paths
- trunk/LayoutTests/ChangeLog
- trunk/Source/_javascript_Core/ChangeLog
- trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp
- trunk/Source/_javascript_Core/runtime/Structure.cpp
- trunk/Source/_javascript_Core/runtime/Structure.h
- trunk/Source/_javascript_Core/runtime/StructureInlines.h
Removed Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (167563 => 167564)
--- trunk/LayoutTests/ChangeLog 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/LayoutTests/ChangeLog 2014-04-20 11:45:32 UTC (rev 167564)
@@ -1,3 +1,16 @@
+2014-04-20 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r167501.
+ https://bugs.webkit.org/show_bug.cgi?id=131913
+
+ It broke DYEBench (Requested by mhahnenberg on #webkit).
+
+ Reverted changeset:
+
+ "Deleting properties poisons objects"
+ https://bugs.webkit.org/show_bug.cgi?id=131551
+ http://trac.webkit.org/changeset/167501
+
2014-04-19 Zalan Bujtas <[email protected]>
Subpixel rendering: RenderLayer's clipping should snap to device pixel boundaries.
Deleted: trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id-expected.txt (167563 => 167564)
--- trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id-expected.txt 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id-expected.txt 2014-04-20 11:45:32 UTC (rev 167564)
@@ -1,10 +0,0 @@
-JSRegress/delete-a-few-properties-then-get-by-id
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
Deleted: trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id.html (167563 => 167564)
--- trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id.html 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/LayoutTests/js/regress/delete-a-few-properties-then-get-by-id.html 2014-04-20 11:45:32 UTC (rev 167564)
@@ -1,12 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src=""
-</head>
-<body>
-<script src=""
-<script src=""
-<script src=""
-<script src=""
-</body>
-</html>
Deleted: trunk/LayoutTests/js/regress/script-tests/delete-a-few-properties-then-get-by-id.js (167563 => 167564)
--- trunk/LayoutTests/js/regress/script-tests/delete-a-few-properties-then-get-by-id.js 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/LayoutTests/js/regress/script-tests/delete-a-few-properties-then-get-by-id.js 2014-04-20 11:45:32 UTC (rev 167564)
@@ -1,21 +0,0 @@
-function MyObject(x, y) {
- this.x = x;
- this.y = y;
- this.deleteMe = "delete me";
-}
-
-function foo(o) {
- return o.x + o.y;
-}
-
-var niters = 100000;
-var sum = 0;
-var o = new MyObject(13, 42);
-delete o.deleteMe;
-
-for (var i = 0; i < niters; ++i) {
- sum += foo(o);
-}
-
-if (sum != 55 * niters)
- throw new Error("Bad result!");
Modified: trunk/Source/_javascript_Core/ChangeLog (167563 => 167564)
--- trunk/Source/_javascript_Core/ChangeLog 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-04-20 11:45:32 UTC (rev 167564)
@@ -1,3 +1,16 @@
+2014-04-20 Commit Queue <[email protected]>
+
+ Unreviewed, rolling out r167501.
+ https://bugs.webkit.org/show_bug.cgi?id=131913
+
+ It broke DYEBench (Requested by mhahnenberg on #webkit).
+
+ Reverted changeset:
+
+ "Deleting properties poisons objects"
+ https://bugs.webkit.org/show_bug.cgi?id=131551
+ http://trac.webkit.org/changeset/167501
+
2014-04-19 Filip Pizlo <[email protected]>
It should be OK to store new fields into objects that have no prototypes
Modified: trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp (167563 => 167564)
--- trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/Source/_javascript_Core/runtime/JSPropertyNameIterator.cpp 2014-04-20 11:45:32 UTC (rev 167564)
@@ -63,8 +63,7 @@
JSPropertyNameIterator* jsPropertyNameIterator = new (NotNull, allocateCell<JSPropertyNameIterator>(vm.heap)) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
jsPropertyNameIterator->finishCreation(vm, propertyNames.data(), o);
- // JSPropertyNameIterator doesn't know how to skip deleted buckets, so just give up.
- if (o->structure()->isDictionary() || o->structure()->hasDeletedOffsets())
+ if (o->structure()->isDictionary())
return jsPropertyNameIterator;
if (o->structure()->typeInfo().overridesGetPropertyNames())
Modified: trunk/Source/_javascript_Core/runtime/Structure.cpp (167563 => 167564)
--- trunk/Source/_javascript_Core/runtime/Structure.cpp 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/Source/_javascript_Core/runtime/Structure.cpp 2014-04-20 11:45:32 UTC (rev 167564)
@@ -165,7 +165,6 @@
, m_transitionWatchpointSet(IsWatched)
, m_offset(invalidOffset)
, m_inlineCapacity(inlineCapacity)
- , m_forgivenDeletes(0)
, m_dictionaryKind(NoneDictionaryKind)
, m_isPinnedPropertyTable(false)
, m_hasGetterSetterProperties(classInfo->hasStaticSetterOrReadonlyProperties(vm))
@@ -193,7 +192,6 @@
, m_transitionWatchpointSet(IsWatched)
, m_offset(invalidOffset)
, m_inlineCapacity(0)
- , m_forgivenDeletes(0)
, m_dictionaryKind(NoneDictionaryKind)
, m_isPinnedPropertyTable(false)
, m_hasGetterSetterProperties(m_classInfo->hasStaticSetterOrReadonlyProperties(vm))
@@ -220,7 +218,6 @@
, m_transitionWatchpointSet(IsWatched)
, m_offset(invalidOffset)
, m_inlineCapacity(previous->m_inlineCapacity)
- , m_forgivenDeletes(previous->m_forgivenDeletes)
, m_dictionaryKind(previous->m_dictionaryKind)
, m_isPinnedPropertyTable(false)
, m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
@@ -313,12 +310,7 @@
structure = structures[i];
if (!structure->m_nameInPrevious)
continue;
-
- PropertyMapEntry entry(vm, this,
- structure->m_nameInPrevious.get(),
- propertyTable()->nextOffset(m_inlineCapacity),
- structure->m_attributesInPrevious,
- structure->m_specificValueInPrevious.get());
+ PropertyMapEntry entry(vm, this, structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious.get());
propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
}
@@ -466,25 +458,10 @@
{
ASSERT(!structure->isUncacheableDictionary());
- if (structure->m_forgivenDeletes < s_maxForgivenDeletes) {
- Structure* transition = create(vm, structure);
-
- DeferGC deferGC(vm.heap);
- structure->materializePropertyMapIfNecessary(vm, deferGC);
- transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
- transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
-
- offset = transition->remove(propertyName);
- ASSERT(offset != invalidOffset);
- transition->m_forgivenDeletes = structure->m_forgivenDeletes + 1;
-
- transition->checkOffsetConsistency();
- return transition;
- }
-
Structure* transition = toUncacheableDictionaryTransition(vm, structure);
+
offset = transition->remove(propertyName);
+
transition->checkOffsetConsistency();
return transition;
}
@@ -499,7 +476,7 @@
structure->materializePropertyMapIfNecessary(vm, deferGC);
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
+ transition->pin();
transition->checkOffsetConsistency();
return transition;
@@ -516,7 +493,7 @@
structure->materializePropertyMapIfNecessary(vm, deferGC);
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
+ transition->pin();
if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
transition->despecifyAllFunctions(vm);
@@ -538,7 +515,7 @@
structure->materializePropertyMapIfNecessary(vm, deferGC);
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
- transition->pinAndPreventTransitions();
+ transition->pin();
structure = transition;
}
@@ -563,7 +540,7 @@
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
transition->m_dictionaryKind = kind;
- transition->pinAndPreventTransitions();
+ transition->pin();
transition->checkOffsetConsistency();
return transition;
@@ -626,7 +603,7 @@
transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm, transition));
transition->m_offset = structure->m_offset;
transition->m_preventExtensions = true;
- transition->pinAndPreventTransitions();
+ transition->pin();
transition->checkOffsetConsistency();
return transition;
@@ -775,7 +752,7 @@
DeferGC deferGC(vm.heap);
materializePropertyMapIfNecessaryForPinning(vm, deferGC);
- pinAndPreventTransitions();
+ pin();
return putSpecificValue(vm, propertyName, attributes, specificValue);
}
@@ -788,7 +765,7 @@
DeferGC deferGC(vm.heap);
materializePropertyMapIfNecessaryForPinning(vm, deferGC);
- pinAndPreventTransitions();
+ pin();
return remove(propertyName);
}
@@ -796,11 +773,6 @@
{
ASSERT(propertyTable());
m_isPinnedPropertyTable = true;
-}
-
-void Structure::pinAndPreventTransitions()
-{
- pin();
clearPreviousID();
m_nameInPrevious.clear();
}
Modified: trunk/Source/_javascript_Core/runtime/Structure.h (167563 => 167564)
--- trunk/Source/_javascript_Core/runtime/Structure.h 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/Source/_javascript_Core/runtime/Structure.h 2014-04-20 11:45:32 UTC (rev 167564)
@@ -137,8 +137,6 @@
PropertyOffset removePropertyWithoutTransition(VM&, PropertyName);
void setPrototypeWithoutTransition(VM& vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }
- bool hasDeletedOffsets() const;
-
bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
@@ -413,7 +411,6 @@
void despecifyAllFunctions(VM&);
WriteBarrier<PropertyTable>& propertyTable();
- const WriteBarrier<PropertyTable>& propertyTable() const;
PropertyTable* takePropertyTableOrCloneIfPinned(VM&, Structure* owner);
PropertyTable* copyPropertyTable(VM&, Structure* owner);
PropertyTable* copyPropertyTableForPinning(VM&, Structure* owner);
@@ -460,7 +457,6 @@
bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
void pin();
- void pinAndPreventTransitions();
Structure* previous() const
{
@@ -516,9 +512,6 @@
ConcurrentJITLock m_lock;
- static const unsigned s_maxForgivenDeletes = 5;
- unsigned m_forgivenDeletes;
-
unsigned m_dictionaryKind : 2;
bool m_isPinnedPropertyTable : 1;
bool m_hasGetterSetterProperties : 1;
Modified: trunk/Source/_javascript_Core/runtime/StructureInlines.h (167563 => 167564)
--- trunk/Source/_javascript_Core/runtime/StructureInlines.h 2014-04-20 04:42:42 UTC (rev 167563)
+++ trunk/Source/_javascript_Core/runtime/StructureInlines.h 2014-04-20 11:45:32 UTC (rev 167564)
@@ -217,21 +217,8 @@
return propertyTable()->size() == totalStorageCapacity();
}
-inline bool Structure::hasDeletedOffsets() const
+ALWAYS_INLINE WriteBarrier<PropertyTable>& Structure::propertyTable()
{
- // If we had deleted anything then we would have pinned our property table.
- if (!propertyTable())
- return false;
- return propertyTable()->hasDeletedOffset();
-}
-
-inline WriteBarrier<PropertyTable>& Structure::propertyTable()
-{
- return const_cast<WriteBarrier<PropertyTable>&>(static_cast<const Structure*>(this)->propertyTable());
-}
-
-inline const WriteBarrier<PropertyTable>& Structure::propertyTable() const
-{
ASSERT(!globalObject() || !globalObject()->vm().heap.isCollecting());
return m_propertyTableUnsafe;
}
@@ -252,8 +239,8 @@
if (isCompilationThread())
return true;
+ RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize());
unsigned totalSize = propertyTable->propertyStorageSize();
- RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == totalSize);
RELEASE_ASSERT((totalSize < inlineCapacity() ? 0 : totalSize - inlineCapacity()) == numberOfOutOfLineSlotsForLastOffset(m_offset));
return true;
_______________________________________________ webkit-changes mailing list [email protected] https://lists.webkit.org/mailman/listinfo/webkit-changes
