Title: [170382] branches/ftlopt/Source/_javascript_Core
Revision
170382
Author
fpi...@apple.com
Date
2014-06-24 12:51:11 -0700 (Tue, 24 Jun 2014)

Log Message

[ftlopt] GC should notify us if it resets to_this
https://bugs.webkit.org/show_bug.cgi?id=128231

Reviewed by Geoffrey Garen.

* CMakeLists.txt:
* _javascript_Core.vcxproj/_javascript_Core.vcxproj:
* _javascript_Core.xcodeproj/project.pbxproj:
* bytecode/BytecodeList.json:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::finalizeUnconditionally):
* bytecode/Instruction.h:
* bytecode/ToThisStatus.cpp: Added.
(JSC::merge):
(WTF::printInternal):
* bytecode/ToThisStatus.h: Added.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):

Modified Paths

Added Paths

Diff

Modified: branches/ftlopt/Source/_javascript_Core/CMakeLists.txt (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/CMakeLists.txt	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/CMakeLists.txt	2014-06-24 19:51:11 UTC (rev 170382)
@@ -93,6 +93,7 @@
     bytecode/StructureSet.cpp
     bytecode/StructureStubClearingWatchpoint.cpp
     bytecode/StructureStubInfo.cpp
+    bytecode/ToThisStatus.cpp
     bytecode/UnlinkedCodeBlock.cpp
     bytecode/UnlinkedInstructionStream.cpp
     bytecode/ValueRecovery.cpp

Modified: branches/ftlopt/Source/_javascript_Core/ChangeLog (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/ChangeLog	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/ChangeLog	2014-06-24 19:51:11 UTC (rev 170382)
@@ -1,5 +1,33 @@
 2014-06-24  Filip Pizlo  <fpi...@apple.com>
 
+        [ftlopt] GC should notify us if it resets to_this
+        https://bugs.webkit.org/show_bug.cgi?id=128231
+
+        Reviewed by Geoffrey Garen.
+
+        * CMakeLists.txt:
+        * _javascript_Core.vcxproj/_javascript_Core.vcxproj:
+        * _javascript_Core.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        * bytecode/Instruction.h:
+        * bytecode/ToThisStatus.cpp: Added.
+        (JSC::merge):
+        (WTF::printInternal):
+        * bytecode/ToThisStatus.h: Added.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+
+2014-06-24  Filip Pizlo  <fpi...@apple.com>
+
         [ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
         https://bugs.webkit.org/show_bug.cgi?id=134256
 

Modified: branches/ftlopt/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/_javascript_Core.vcxproj/_javascript_Core.vcxproj	2014-06-24 19:51:11 UTC (rev 170382)
@@ -347,6 +347,7 @@
     <ClCompile Include="..\bytecode\StructureSet.cpp" />
     <ClCompile Include="..\bytecode\StructureStubClearingWatchpoint.cpp" />
     <ClCompile Include="..\bytecode\StructureStubInfo.cpp" />
+    <ClCompile Include="..\bytecode\ToThisStatus.cpp" />
     <ClCompile Include="..\bytecode\UnlinkedCodeBlock.cpp" />
     <ClCompile Include="..\bytecode\UnlinkedInstructionStream.cpp" />
     <ClCompile Include="..\bytecode\ValueRecovery.cpp" />
@@ -890,6 +891,7 @@
     <ClInclude Include="..\bytecode\StructureSet.h" />
     <ClInclude Include="..\bytecode\StructureStubClearingWatchpoint.h" />
     <ClInclude Include="..\bytecode\StructureStubInfo.h" />
+    <ClInclude Include="..\bytecode\ToThisStatus.h" />
     <ClInclude Include="..\bytecode\UnlinkedCodeBlock.h" />
     <ClInclude Include="..\bytecode\UnlinkedInstructionStream.h" />
     <ClInclude Include="..\bytecode\ValueProfile.h" />

Modified: branches/ftlopt/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj	2014-06-24 19:51:11 UTC (rev 170382)
@@ -355,6 +355,8 @@
 		0F766D3815AE4A1C008F363E /* StructureStubClearingWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F766D3615AE4A1A008F363E /* StructureStubClearingWatchpoint.cpp */; };
 		0F766D3915AE4A1F008F363E /* StructureStubClearingWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F7700921402FF3C0078EB39 /* SamplingCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7700911402FF280078EB39 /* SamplingCounter.cpp */; };
+		0F7AB82E1958DA1C00C6881F /* ToThisStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F7AB82C1958DA1C00C6881F /* ToThisStatus.cpp */; };
+		0F7AB82F1958DA1C00C6881F /* ToThisStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7AB82D1958DA1C00C6881F /* ToThisStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0977E1469EBC400CF2442 /* DFGCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8023E91613832300A0BA45 /* ByValInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2522,6 +2524,8 @@
 		0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureStubClearingWatchpoint.h; sourceTree = "<group>"; };
 		0F77008E1402FDD60078EB39 /* SamplingCounter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SamplingCounter.h; sourceTree = "<group>"; };
 		0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = "<group>"; };
+		0F7AB82C1958DA1C00C6881F /* ToThisStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ToThisStatus.cpp; sourceTree = "<group>"; };
+		0F7AB82D1958DA1C00C6881F /* ToThisStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ToThisStatus.h; sourceTree = "<group>"; };
 		0F8023E91613832300A0BA45 /* ByValInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByValInfo.h; sourceTree = "<group>"; };
 		0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayAllocationProfile.cpp; sourceTree = "<group>"; };
 		0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
@@ -5420,6 +5424,8 @@
 				0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */,
 				BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */,
 				BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */,
+				0F7AB82C1958DA1C00C6881F /* ToThisStatus.cpp */,
+				0F7AB82D1958DA1C00C6881F /* ToThisStatus.h */,
 				A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */,
 				A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */,
 				B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */,
@@ -6262,6 +6268,7 @@
 				A5840E21187B7B8600843B10 /* InjectedScriptModule.h in Headers */,
 				A513E5C7185F9446007E95AD /* InjectedScriptSource.h in Headers */,
 				A5840E29187CA5E600843B10 /* inline-and-minify-stylesheets-and-scripts.py in Headers */,
+				0F7AB82F1958DA1C00C6881F /* ToThisStatus.h in Headers */,
 				0F24E55617F0B71C00ABB217 /* InlineCallFrameSet.h in Headers */,
 				99E45A2718A1B2590026D88F /* InputCursor.h in Headers */,
 				A593CF7F1840362C00BFCE27 /* InspectorAgentBase.h in Headers */,
@@ -7923,6 +7930,7 @@
 				0FCEFACD1805E75500472CE4 /* LLVMAPI.cpp in Sources */,
 				A7E5AB371799E4B200D2833D /* LLVMDisassembler.cpp in Sources */,
 				0F4CED5E18CEA7AB00802FE0 /* PolymorphicGetByIdList.cpp in Sources */,
+				0F7AB82E1958DA1C00C6881F /* ToThisStatus.cpp in Sources */,
 				14469DDE107EC7E700650446 /* Lookup.cpp in Sources */,
 				0F4680CC14BBB17A00BFE272 /* LowLevelInterpreter.cpp in Sources */,
 				14B723B212D7DA46003BD5ED /* MachineStackMarker.cpp in Sources */,

Modified: branches/ftlopt/Source/_javascript_Core/bytecode/BytecodeList.json (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/bytecode/BytecodeList.json	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/bytecode/BytecodeList.json	2014-06-24 19:51:11 UTC (rev 170382)
@@ -10,7 +10,7 @@
             { "name" : "op_create_arguments", "length" : 2 },
             { "name" : "op_create_this", "length" : 4 },
             { "name" : "op_get_callee", "length" : 3 },
-            { "name" : "op_to_this", "length" : 3 },
+            { "name" : "op_to_this", "length" : 4 },
             { "name" : "op_new_object", "length" : 4 },
             { "name" : "op_new_array", "length" : 5 },
             { "name" : "op_new_array_with_size", "length" : 4 },

Modified: branches/ftlopt/Source/_javascript_Core/bytecode/CodeBlock.cpp (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/bytecode/CodeBlock.cpp	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/bytecode/CodeBlock.cpp	2014-06-24 19:51:11 UTC (rev 170382)
@@ -780,6 +780,7 @@
             Structure* structure = (++it)->u.structure.get();
             if (structure)
                 out.print(" cache(struct = ", RawPointer(structure), ")");
+            out.print(" ", (++it)->u.toThisStatus);
             break;
         }
         case op_new_object: {
@@ -2322,6 +2323,8 @@
                 if (Options::verboseOSR())
                     dataLogF("Clearing LLInt to_this with structure %p.\n", curInstruction[2].u.structure.get());
                 curInstruction[2].u.structure.clear();
+                curInstruction[3].u.toThisStatus = merge(
+                    curInstruction[3].u.toThisStatus, ToThisClearedByGC);
                 break;
             case op_get_callee:
                 if (!curInstruction[2].u.jsCell || Heap::isMarked(curInstruction[2].u.jsCell.get()))

Modified: branches/ftlopt/Source/_javascript_Core/bytecode/Instruction.h (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/bytecode/Instruction.h	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/bytecode/Instruction.h	2014-06-24 19:51:11 UTC (rev 170382)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2012, 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2012, 2013, 2014 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,7 @@
 #include "SpecialPointer.h"
 #include "Structure.h"
 #include "StructureChain.h"
+#include "ToThisStatus.h"
 #include "VirtualRegister.h"
 #include <wtf/VectorTraits.h>
 
@@ -118,6 +119,7 @@
         WriteBarrierBase<JSActivation> activation;
         void* pointer;
         bool* predicatePointer;
+        ToThisStatus toThisStatus;
     } u;
         
 private:

Added: branches/ftlopt/Source/_javascript_Core/bytecode/ToThisStatus.cpp (0 => 170382)


--- branches/ftlopt/Source/_javascript_Core/bytecode/ToThisStatus.cpp	                        (rev 0)
+++ branches/ftlopt/Source/_javascript_Core/bytecode/ToThisStatus.cpp	2014-06-24 19:51:11 UTC (rev 170382)
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ToThisStatus.h"
+
+namespace JSC {
+
+ToThisStatus merge(ToThisStatus a, ToThisStatus b)
+{
+    switch (a) {
+    case ToThisOK:
+        return b;
+    case ToThisConflicted:
+        return ToThisConflicted;
+    case ToThisClearedByGC:
+        if (b == ToThisConflicted)
+            return ToThisConflicted;
+        return ToThisClearedByGC;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+    return ToThisConflicted;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, ToThisStatus status)
+{
+    switch (status) {
+    case ToThisOK:
+        out.print("OK");
+        return;
+    case ToThisConflicted:
+        out.print("Conflicted");
+        return;
+    case ToThisClearedByGC:
+        out.print("ClearedByGC");
+        return;
+    }
+    
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+

Added: branches/ftlopt/Source/_javascript_Core/bytecode/ToThisStatus.h (0 => 170382)


--- branches/ftlopt/Source/_javascript_Core/bytecode/ToThisStatus.h	                        (rev 0)
+++ branches/ftlopt/Source/_javascript_Core/bytecode/ToThisStatus.h	2014-06-24 19:51:11 UTC (rev 170382)
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ToThisStatus_h
+#define ToThisStatus_h
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum ToThisStatus {
+    ToThisOK,
+    ToThisConflicted,
+    ToThisClearedByGC
+};
+
+ToThisStatus merge(ToThisStatus, ToThisStatus);
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::ToThisStatus);
+
+} // namespace WTF
+
+#endif // ToThisStatus_h
+

Modified: branches/ftlopt/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp	2014-06-24 19:51:11 UTC (rev 170382)
@@ -410,6 +410,7 @@
         emitOpcode(op_to_this);
         instructions().append(kill(&m_thisRegister));
         instructions().append(0);
+        instructions().append(0);
     }
 }
 

Modified: branches/ftlopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp	2014-06-24 19:51:11 UTC (rev 170382)
@@ -2012,7 +2012,8 @@
             Node* op1 = getThis();
             if (op1->op() != ToThis) {
                 Structure* cachedStructure = currentInstruction[2].u.structure.get();
-                if (!cachedStructure
+                if (currentInstruction[2].u.toThisStatus != ToThisOK
+                    || !cachedStructure
                     || cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis
                     || m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
                     || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)

Modified: branches/ftlopt/Source/_javascript_Core/llint/LowLevelInterpreter32_64.asm (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/llint/LowLevelInterpreter32_64.asm	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/llint/LowLevelInterpreter32_64.asm	2014-06-24 19:51:11 UTC (rev 170382)
@@ -760,11 +760,11 @@
     bbneq JSCell::m_type[t0], FinalObjectType, .opToThisSlow
     loadpFromInstruction(2, t2)
     bpneq JSCell::m_structureID[t0], t2, .opToThisSlow
-    dispatch(3)
+    dispatch(4)
 
 .opToThisSlow:
     callSlowPath(_slow_path_to_this)
-    dispatch(3)
+    dispatch(4)
 
 
 _llint_op_new_object:

Modified: branches/ftlopt/Source/_javascript_Core/llint/LowLevelInterpreter64.asm (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/llint/LowLevelInterpreter64.asm	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/llint/LowLevelInterpreter64.asm	2014-06-24 19:51:11 UTC (rev 170382)
@@ -622,11 +622,11 @@
     loadStructureWithScratch(t0, t1, t2)
     loadpFromInstruction(2, t2)
     bpneq t1, t2, .opToThisSlow
-    dispatch(3)
+    dispatch(4)
 
 .opToThisSlow:
     callSlowPath(_slow_path_to_this)
-    dispatch(3)
+    dispatch(4)
 
 
 _llint_op_new_object:

Modified: branches/ftlopt/Source/_javascript_Core/runtime/CommonSlowPaths.cpp (170381 => 170382)


--- branches/ftlopt/Source/_javascript_Core/runtime/CommonSlowPaths.cpp	2014-06-24 19:49:25 UTC (rev 170381)
+++ branches/ftlopt/Source/_javascript_Core/runtime/CommonSlowPaths.cpp	2014-06-24 19:51:11 UTC (rev 170382)
@@ -251,10 +251,18 @@
 {
     BEGIN();
     JSValue v1 = OP(1).jsValue();
-    if (v1.isCell())
-        pc[2].u.structure.set(vm, exec->codeBlock()->ownerExecutable(), v1.asCell()->structure(vm));
-    else
+    if (v1.isCell()) {
+        Structure* myStructure = v1.asCell()->structure(vm);
+        Structure* otherStructure = pc[2].u.structure.get();
+        if (myStructure != otherStructure) {
+            if (otherStructure)
+                pc[3].u.toThisStatus = ToThisConflicted;
+            pc[2].u.structure.set(vm, exec->codeBlock()->ownerExecutable(), myStructure);
+        }
+    } else {
+        pc[3].u.toThisStatus = ToThisConflicted;
         pc[2].u.structure.clear();
+    }
     RETURN(v1.toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
 }
 
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to