WebKit Bugzilla
Attachment 339623 Details for
Bug 185287
: DFG AI should have O(1) clobbering
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
more
blah.patch (text/plain), 60.12 KB, created by
Filip Pizlo
on 2018-05-04 18:53:49 PDT
(
hide
)
Description:
more
Filename:
MIME Type:
Creator:
Filip Pizlo
Created:
2018-05-04 18:53:49 PDT
Size:
60.12 KB
patch
obsolete
>Index: Source/JavaScriptCore/Sources.txt >=================================================================== >--- Source/JavaScriptCore/Sources.txt (revision 231338) >+++ Source/JavaScriptCore/Sources.txt (working copy) >@@ -274,6 +274,7 @@ debugger/DebuggerScope.cpp > dfg/DFGAbstractHeap.cpp > dfg/DFGAbstractInterpreterClobberState.cpp > dfg/DFGAbstractValue.cpp >+dfg/DFGAbstractValueClobberEpoch.cpp > dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp > dfg/DFGAdaptiveStructureWatchpoint.cpp > dfg/DFGArgumentsEliminationPhase.cpp >Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj >=================================================================== >--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (revision 231338) >+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (working copy) >@@ -319,6 +319,7 @@ > 0F4D8C781FCA3CFA001D32AC /* SimpleMarkingConstraint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4D8C771FCA3CF3001D32AC /* SimpleMarkingConstraint.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F4DE1CF1C4C1B54004D6C11 /* AirFixObviousSpills.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4DE1CD1C4C1B54004D6C11 /* AirFixObviousSpills.h */; }; > 0F4F11E8209BCDAB00709654 /* CompilerTimingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F11E6209BCDA100709654 /* CompilerTimingScope.h */; }; >+ 0F4F11EB209D426600709654 /* DFGAbstractValueClobberEpoch.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */; }; > 0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; }; > 0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; }; > 0F4F828C1E31B9760075184C /* StochasticSpaceTimeMutatorScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F828A1E31B9710075184C /* StochasticSpaceTimeMutatorScheduler.h */; }; >@@ -2310,6 +2311,8 @@ > 0F4DE1D01C4D764B004D6C11 /* B3OriginDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3OriginDump.cpp; path = b3/B3OriginDump.cpp; sourceTree = "<group>"; }; > 0F4F11E6209BCDA100709654 /* CompilerTimingScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CompilerTimingScope.h; sourceTree = "<group>"; }; > 0F4F11E7209BCDA100709654 /* CompilerTimingScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CompilerTimingScope.cpp; sourceTree = "<group>"; }; >+ 0F4F11E9209D426300709654 /* DFGAbstractValueClobberEpoch.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGAbstractValueClobberEpoch.cpp; path = dfg/DFGAbstractValueClobberEpoch.cpp; sourceTree = "<group>"; }; >+ 0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAbstractValueClobberEpoch.h; path = dfg/DFGAbstractValueClobberEpoch.h; sourceTree = "<group>"; }; > 0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = "<group>"; }; > 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = "<group>"; }; > 0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectHeapCellType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSegmentedVariableObjectHeapCellType.cpp; sourceTree = "<group>"; }; >@@ -7114,6 +7117,8 @@ > A704D8FF17A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h */, > 0F55C19317276E4600CEABFD /* DFGAbstractValue.cpp */, > 0F62016F143FCD2F0068B77C /* DFGAbstractValue.h */, >+ 0F4F11E9209D426300709654 /* DFGAbstractValueClobberEpoch.cpp */, >+ 0F4F11EA209D426300709654 /* DFGAbstractValueClobberEpoch.h */, > 0FD3E3FF1B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.cpp */, > 0FD3E4001B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h */, > 0F18D3CD1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp */, >@@ -9040,6 +9045,7 @@ > A513E5C2185BFACC007E95AD /* JSInjectedScriptHostPrototype.h in Headers */, > 0F2B66F817B6B5AB00A7AE3F /* JSInt16Array.h in Headers */, > 0F2B66F917B6B5AB00A7AE3F /* JSInt32Array.h in Headers */, >+ 0F4F11EB209D426600709654 /* DFGAbstractValueClobberEpoch.h in Headers */, > 0F2B66F717B6B5AB00A7AE3F /* JSInt8Array.h in Headers */, > A76C51761182748D00715B05 /* JSInterfaceJIT.h in Headers */, > E33F50811B8429A400413856 /* JSInternalPromise.h in Headers */, >Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h >=================================================================== >--- Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2013-2016 Apple Inc. All rights reserved. >+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -41,21 +41,38 @@ public: > AbstractInterpreter(Graph&, AbstractStateType&); > ~AbstractInterpreter(); > >- AbstractValue& forNode(NodeFlowProjection node) >+ ALWAYS_INLINE AbstractValue& forNode(NodeFlowProjection node) > { > return m_state.forNode(node); > } > >- AbstractValue& forNode(Edge edge) >+ ALWAYS_INLINE AbstractValue& forNode(Edge edge) > { > return forNode(edge.node()); > } > >- Operands<AbstractValue>& variables() >+ template<typename ValueType> >+ ALWAYS_INLINE void setForNode(NodeFlowProjection node, ValueType&& value) > { >- return m_state.variables(); >+ m_state.setForNode(node, std::forward<ValueType>(value)); > } > >+ template<typename ValueType> >+ ALWAYS_INLINE void setForNode(Edge edge, ValueType&& value) >+ { >+ setForNode(edge.node(), std::forward<ValueType>(value)); >+ } >+ >+ ALWAYS_INLINE void clearForNode(NodeFlowProjection node) >+ { >+ m_state.clearForNode(node); >+ } >+ >+ ALWAYS_INLINE void clearForNode(Edge edge) >+ { >+ clearForNode(edge.node()); >+ } >+ > bool needsTypeCheck(Node* node, SpeculatedType typesPassedThrough) > { > return !forNode(node).isType(typesPassedThrough); >@@ -149,13 +166,13 @@ public: > PhiChildren* phiChildren() { return m_phiChildren.get(); } > > private: >- void clobberWorld(const CodeOrigin&, unsigned indexInBlock); >+ void clobberWorld(); > void didFoldClobberWorld(); > > template<typename Functor> > void forAllValues(unsigned indexInBlock, Functor&); > >- void clobberStructures(unsigned indexInBlock); >+ void clobberStructures(); > void didFoldClobberStructures(); > > void observeTransition(unsigned indexInBlock, RegisteredStructure from, RegisteredStructure to); >Index: Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h >=================================================================== >--- Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (working copy) >@@ -235,7 +235,7 @@ bool AbstractInterpreter<AbstractStateTy > > case IdentityWithProfile: > case Identity: { >- forNode(node) = forNode(node->child1()); >+ setForNode(node, forNode(node->child1())); > if (forNode(node).value()) > m_state.setFoundConstants(true); > break; >@@ -249,33 +249,33 @@ bool AbstractInterpreter<AbstractStateTy > > case GetLocal: { > VariableAccessData* variableAccessData = node->variableAccessData(); >- AbstractValue value = m_state.variables().operand(variableAccessData->local().offset()); >+ AbstractValue value = m_state.operand(variableAccessData->local().offset()); > // The value in the local should already be checked. > DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(variableAccessData->flushFormat()))); > if (value.value()) > m_state.setFoundConstants(true); >- forNode(node) = value; >+ setForNode(node, value); > break; > } > > case GetStack: { > StackAccessData* data = node->stackAccessData(); >- AbstractValue value = m_state.variables().operand(data->local); >+ AbstractValue value = m_state.operand(data->local); > // The value in the local should already be checked. > DFG_ASSERT(m_graph, node, value.isType(typeFilterFor(data->format))); > if (value.value()) > m_state.setFoundConstants(true); >- forNode(node) = value; >+ setForNode(node, value); > break; > } > > case SetLocal: { >- m_state.variables().operand(node->local()) = forNode(node->child1()); >+ m_state.operand(node->local()) = forNode(node->child1()); > break; > } > > case PutStack: { >- m_state.variables().operand(node->stackAccessData()->local) = forNode(node->child1()); >+ m_state.operand(node->stackAccessData()->local) = forNode(node->child1()); > break; > } > >@@ -296,14 +296,14 @@ bool AbstractInterpreter<AbstractStateTy > // Assert that the state of arguments has been set. SetArgument means that someone set > // the argument values out-of-band, and currently this always means setting to a > // non-clear value. >- ASSERT(!m_state.variables().operand(node->local()).isClear()); >+ ASSERT(!m_state.operand(node->local()).isClear()); > break; > > case InitializeEntrypointArguments: { > unsigned entrypointIndex = node->entrypointIndex(); > const Vector<FlushFormat>& argumentFormats = m_graph.m_argumentFormats[entrypointIndex]; > for (unsigned argument = 0; argument < argumentFormats.size(); ++argument) { >- AbstractValue& value = m_state.variables().argument(argument); >+ AbstractValue& value = m_state.argument(argument); > switch (argumentFormats[argument]) { > case FlushedInt32: > value.setType(SpecInt32Only); >@@ -332,7 +332,7 @@ bool AbstractInterpreter<AbstractStateTy > // https://bugs.webkit.org/show_bug.cgi?id=143071 > switch (node->op()) { > case LoadVarargs: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > case ForwardVarargs: > break; >@@ -341,9 +341,9 @@ bool AbstractInterpreter<AbstractStateTy > break; > } > LoadVarargsData* data = node->loadVarargsData(); >- m_state.variables().operand(data->count).setType(SpecInt32Only); >+ m_state.operand(data->count).setType(SpecInt32Only); > for (unsigned i = data->limit - 1; i--;) >- m_state.variables().operand(data->start.offset() + i).makeHeapTop(); >+ m_state.operand(data->start.offset() + i).makeHeapTop(); > break; > } > >@@ -354,7 +354,7 @@ bool AbstractInterpreter<AbstractStateTy > case BitLShift: > case BitURShift: { > if (node->child1().useKind() == UntypedUse || node->child2().useKind() == UntypedUse) { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecInt32Only); > break; > } >@@ -555,7 +555,7 @@ bool AbstractInterpreter<AbstractStateTy > > case ValueAdd: { > ASSERT(node->binaryUseKind() == UntypedUse); >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecString | SpecBytecodeNumber); > break; > } >@@ -611,7 +611,7 @@ bool AbstractInterpreter<AbstractStateTy > > case AtomicsIsLockFree: { > if (node->child1().useKind() != Int32Use) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBoolInt32); > break; > } >@@ -636,7 +636,7 @@ bool AbstractInterpreter<AbstractStateTy > case KnownInt32Use: > break; > default: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > forNode(node).setType(SpecInt32Only); >@@ -674,12 +674,12 @@ bool AbstractInterpreter<AbstractStateTy > m_state.setFoundConstants(true); > if (numberOfRemovedChildren == numberOfChildren) { > // Propagate the last child. This is the way taken in the constant folding phase. >- forNode(node) = forNode(node->children.child(numberOfChildren - 1)); >+ setForNode(node, forNode(node->children.child(numberOfChildren - 1))); > break; > } > if ((numberOfRemovedChildren + 1) == numberOfChildren) { > ASSERT(nonEmptyIndex); >- forNode(node) = forNode(node->children.child(nonEmptyIndex.value())); >+ setForNode(node, forNode(node->children.child(nonEmptyIndex.value()))); > break; > } > } >@@ -725,7 +725,7 @@ bool AbstractInterpreter<AbstractStateTy > forNode(node->child1()).m_type, forNode(node->child2()).m_type)); > break; > case UntypedUse: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecBytecodeNumber); > break; > default: >@@ -783,7 +783,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > default: > DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind()); >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBytecodeNumber); > break; > } >@@ -834,7 +834,7 @@ bool AbstractInterpreter<AbstractStateTy > forNode(node->child1()).m_type, forNode(node->child2()).m_type)); > break; > case UntypedUse: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecBytecodeNumber); > break; > default: >@@ -873,7 +873,7 @@ bool AbstractInterpreter<AbstractStateTy > forNode(node->child1()).m_type, forNode(node->child2()).m_type)); > break; > case UntypedUse: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecBytecodeNumber); > break; > default: >@@ -998,7 +998,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > default: > DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind()); >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecFullNumber); > break; > } >@@ -1078,7 +1078,7 @@ bool AbstractInterpreter<AbstractStateTy > forNode(node).setType(typeOfDoubleRounding(forNode(node->child1()).m_type)); > } else { > DFG_ASSERT(m_graph, node, node->child1().useKind() == UntypedUse, node->child1().useKind()); >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecFullNumber); > } > break; >@@ -1668,7 +1668,7 @@ bool AbstractInterpreter<AbstractStateTy > } > > if (isClobbering) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBoolean); > break; > } >@@ -1762,7 +1762,7 @@ bool AbstractInterpreter<AbstractStateTy > case Int32Use: > break; > case UntypedUse: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > default: > DFG_CRASH(m_graph, node, "Bad use kind"); >@@ -1786,7 +1786,7 @@ bool AbstractInterpreter<AbstractStateTy > case AtomicsSub: > case AtomicsXor: { > if (node->op() != GetByVal) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > switch (node->arrayMode().type()) { > case Array::SelectUsingPredictions: > case Array::Unprofiled: >@@ -1806,7 +1806,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > } > case Array::Generic: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > case Array::String: >@@ -1821,7 +1821,7 @@ bool AbstractInterpreter<AbstractStateTy > // implies an in-bounds access). None of this feels like it's worth it, > // so we're going with TOP for now. The same thing applies to > // clobbering the world. >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > } else > forNode(node).set(m_graph, m_vm.stringStructure.get()); >@@ -1829,19 +1829,19 @@ bool AbstractInterpreter<AbstractStateTy > case Array::DirectArguments: > case Array::ScopedArguments: > if (node->arrayMode().isOutOfBounds()) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > case Array::Int32: > if (node->arrayMode().isOutOfBounds()) { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > } else > forNode(node).setType(SpecInt32Only); > break; > case Array::Double: > if (node->arrayMode().isOutOfBounds()) { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > } else if (node->arrayMode().isSaneChain()) > forNode(node).setType(SpecBytecodeDouble); >@@ -1852,7 +1852,7 @@ bool AbstractInterpreter<AbstractStateTy > case Array::ArrayStorage: > case Array::SlowPutArrayStorage: > if (node->arrayMode().isOutOfBounds()) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > case Array::Int8Array: >@@ -1902,24 +1902,24 @@ bool AbstractInterpreter<AbstractStateTy > m_state.setIsValid(false); > break; > case Array::Generic: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > case Array::Int32: > if (node->arrayMode().isOutOfBounds()) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > case Array::Double: > if (node->arrayMode().isOutOfBounds()) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > case Array::Contiguous: > case Array::ArrayStorage: > if (node->arrayMode().isOutOfBounds()) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > case Array::SlowPutArrayStorage: > if (node->arrayMode().mayStoreToHole()) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > default: > break; >@@ -1928,7 +1928,7 @@ bool AbstractInterpreter<AbstractStateTy > } > > case ArrayPush: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBytecodeNumber); > break; > >@@ -1952,7 +1952,7 @@ bool AbstractInterpreter<AbstractStateTy > } > > case ArrayPop: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > >@@ -1972,14 +1972,14 @@ bool AbstractInterpreter<AbstractStateTy > if (argumentIndexChecked.safeGet(argumentIndex) != CheckedState::DidOverflow) { > if (inlineCallFrame) { > if (argumentIndex < inlineCallFrame->argumentCountIncludingThis - 1) { >- forNode(node) = m_state.variables().operand( >- virtualRegisterForArgument(argumentIndex + 1) + inlineCallFrame->stackOffset); >+ setForNode(node, m_state.operand( >+ virtualRegisterForArgument(argumentIndex + 1) + inlineCallFrame->stackOffset)); > m_state.setFoundConstants(true); > break; > } > } else { >- if (argumentIndex < m_state.variables().numberOfArguments() - 1) { >- forNode(node) = m_state.variables().argument(argumentIndex + 1); >+ if (argumentIndex < m_state.numberOfArguments() - 1) { >+ setForNode(node, m_state.argument(argumentIndex + 1)); > m_state.setFoundConstants(true); > break; > } >@@ -1993,7 +1993,7 @@ bool AbstractInterpreter<AbstractStateTy > AbstractValue result; > for (unsigned i = 1 + node->numberOfArgumentsToSkip(); i < inlineCallFrame->argumentCountIncludingThis; ++i) { > result.merge( >- m_state.variables().operand( >+ m_state.operand( > virtualRegisterForArgument(i) + inlineCallFrame->stackOffset)); > } > >@@ -2003,7 +2003,7 @@ bool AbstractInterpreter<AbstractStateTy > if (result.value()) > m_state.setFoundConstants(true); > >- forNode(node) = result; >+ setForNode(node, result); > break; > } > >@@ -2016,7 +2016,7 @@ bool AbstractInterpreter<AbstractStateTy > if (node->op() == RegExpExec) { > // Even if we've proven known input types as RegExpObject and String, > // accessing lastIndex is effectful if it's a global regexp. >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > } > > if (JSValue globalObjectValue = forNode(node->child1()).m_value) { >@@ -2038,7 +2038,7 @@ bool AbstractInterpreter<AbstractStateTy > case RegExpTest: > // Even if we've proven known input types as RegExpObject and String, > // accessing lastIndex is effectful if it's a global regexp. >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBoolean); > break; > >@@ -2060,7 +2060,7 @@ bool AbstractInterpreter<AbstractStateTy > && node->child3().useKind() == StringUse) { > // This doesn't clobber the world. It just reads and writes regexp state. > } else >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).set(m_graph, m_vm.stringStructure.get()); > break; > >@@ -2105,7 +2105,7 @@ bool AbstractInterpreter<AbstractStateTy > case DirectTailCall: > case TailCallVarargs: > case TailCallForwardVarargs: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > m_state.setIsValid(false); > break; > >@@ -2122,11 +2122,11 @@ bool AbstractInterpreter<AbstractStateTy > if (!(forNode(node->child1()).m_type & ~(SpecFullNumber | SpecBoolean | SpecString | SpecSymbol | SpecBigInt))) { > m_state.setFoundConstants(true); > didFoldClobberWorld(); >- forNode(node) = forNode(node->child1()); >+ setForNode(node, forNode(node->child1())); > break; > } > >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > > forNode(node).setType(m_graph, SpecHeapTop & ~SpecObject); > break; >@@ -2145,11 +2145,11 @@ bool AbstractInterpreter<AbstractStateTy > if (!(forNode(node->child1()).m_type & ~SpecBytecodeNumber)) { > m_state.setFoundConstants(true); > didFoldClobberWorld(); >- forNode(node) = forNode(node->child1()); >+ setForNode(node, forNode(node->child1())); > break; > } > >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecBytecodeNumber); > break; > } >@@ -2172,7 +2172,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > case CellUse: > case UntypedUse: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > default: > RELEASE_ASSERT_NOT_REACHED(); >@@ -2193,7 +2193,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > } > } >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get()); > break; > } >@@ -2238,7 +2238,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > default: > if (!m_graph.canDoFastSpread(node, forNode(node->child1()))) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > else > didFoldClobberWorld(); > break; >@@ -2263,7 +2263,7 @@ bool AbstractInterpreter<AbstractStateTy > case Int32Use: > break; > case UntypedUse: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > default: > RELEASE_ASSERT_NOT_REACHED(); >@@ -2332,7 +2332,7 @@ bool AbstractInterpreter<AbstractStateTy > } > } > } >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecFinalObject); > break; > } >@@ -2356,7 +2356,7 @@ bool AbstractInterpreter<AbstractStateTy > } > > if (node->op() == ToObject) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecObject); > break; > } >@@ -2605,14 +2605,14 @@ bool AbstractInterpreter<AbstractStateTy > } > } > >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > } > > case GetByValWithThis: > case GetByIdWithThis: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > >@@ -2636,7 +2636,7 @@ bool AbstractInterpreter<AbstractStateTy > case DeleteByVal: { > // FIXME: This could decide if the delete will be successful based on the set of structures that > // we get from our base value. https://bugs.webkit.org/show_bug.cgi?id=156611 >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBoolean); > break; > } >@@ -2747,7 +2747,7 @@ bool AbstractInterpreter<AbstractStateTy > // nobody would currently benefit from having that information. But it's a bug nonetheless. > if (node->op() == NukeStructureAndSetButterfly) > didFoldClobberStructures(); >- forNode(node).clear(); // The result is not a JS value. >+ clearForNode(node); // The result is not a JS value. > break; > case CheckSubClass: { > JSValue constant = forNode(node->child1()).value(); >@@ -2771,7 +2771,7 @@ bool AbstractInterpreter<AbstractStateTy > CallDOMGetterData* callDOMGetterData = node->callDOMGetterData(); > DOMJIT::CallDOMGetterSnippet* snippet = callDOMGetterData->snippet; > if (!snippet || snippet->effect.writes) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > if (callDOMGetterData->domJIT) > forNode(node).setType(m_graph, callDOMGetterData->domJIT->resultType()); > else >@@ -2781,7 +2781,7 @@ bool AbstractInterpreter<AbstractStateTy > case CallDOM: { > const DOMJIT::Signature* signature = node->signature(); > if (signature->effect.writes) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, signature->result); > break; > } >@@ -2851,7 +2851,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > } > ASSERT(node->arrayMode().conversion() == Array::Convert); >- clobberStructures(clobberLimit); >+ clobberStructures(); > filterArrayModes(node->child1(), node->arrayMode().arrayModesThatPassFiltering()); > break; > } >@@ -2859,7 +2859,7 @@ bool AbstractInterpreter<AbstractStateTy > AbstractValue& value = forNode(node->child1()); > if (value.m_structure.isSubsetOf(RegisteredStructureSet(node->structure()))) > m_state.setFoundConstants(true); >- clobberStructures(clobberLimit); >+ clobberStructures(); > > // We have a bunch of options of how to express the abstract set at this point. Let set S > // be the set of structures that the value had before clobbering and assume that all of >@@ -2888,7 +2888,7 @@ bool AbstractInterpreter<AbstractStateTy > // Note that it's tempting to simply say that the resulting value is BOTTOM because of > // the contradiction. That would be wrong, since we haven't hit an invalidation point, > // yet. >- value.set(m_graph, node->structure()); >+ forNode(node->child1()).set(m_graph, node->structure()); > break; > } > case GetIndexedPropertyStorage: { >@@ -2896,11 +2896,11 @@ bool AbstractInterpreter<AbstractStateTy > forNode(node->child1()).m_value, node->arrayMode()); > if (view) > m_state.setFoundConstants(true); >- forNode(node).clear(); >+ clearForNode(node); > break; > } > case ConstantStoragePointer: { >- forNode(node).clear(); >+ clearForNode(node); > break; > } > >@@ -2958,7 +2958,7 @@ bool AbstractInterpreter<AbstractStateTy > case FinalObjectUse: > break; > default: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > forNode(node).setType(m_graph, SpecObject | SpecOther); >@@ -2987,7 +2987,7 @@ bool AbstractInterpreter<AbstractStateTy > if (value.isClear()) > m_state.setIsValid(false); > >- forNode(node) = value; >+ setForNode(node, value); > if (value.m_value) > m_state.setFoundConstants(true); > break; >@@ -3058,7 +3058,7 @@ bool AbstractInterpreter<AbstractStateTy > if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction) > m_state.setIsValid(false); > >- forNode(node) = result; >+ setForNode(node, result); > break; > } > >@@ -3108,7 +3108,7 @@ bool AbstractInterpreter<AbstractStateTy > observeTransitions(clobberLimit, transitions); > if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction) > m_state.setIsValid(false); >- forNode(node->child2()) = resultingValue; >+ setForNode(node->child2(), resultingValue); > if (!!originalValue && !resultingValue) > m_state.setIsValid(false); > break; >@@ -3219,13 +3219,13 @@ bool AbstractInterpreter<AbstractStateTy > } > } > >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > > case PutByValWithThis: > case PutByIdWithThis: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > > case PutGetterById: >@@ -3233,25 +3233,25 @@ bool AbstractInterpreter<AbstractStateTy > case PutGetterSetterById: > case PutGetterByVal: > case PutSetterByVal: { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > > case DefineDataProperty: > case DefineAccessorProperty: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > > case In: { > // FIXME: We can determine when the property definitely exists based on abstract > // value information. >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBoolean); > break; > } > > case HasOwnProperty: { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBoolean); > break; > } >@@ -3262,12 +3262,12 @@ bool AbstractInterpreter<AbstractStateTy > } > case HasGenericProperty: { > forNode(node).setType(SpecBoolean); >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > case HasStructureProperty: { > forNode(node).setType(SpecBoolean); >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > case HasIndexedProperty: { >@@ -3280,7 +3280,7 @@ bool AbstractInterpreter<AbstractStateTy > break; > } > default: { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > } >@@ -3288,13 +3288,13 @@ bool AbstractInterpreter<AbstractStateTy > break; > } > case GetDirectPname: { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > } > case GetPropertyEnumerator: { > forNode(node).setType(m_graph, SpecCell); >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > case GetEnumeratorStructurePname: { >@@ -3319,21 +3319,21 @@ bool AbstractInterpreter<AbstractStateTy > break; > > case GetDynamicVar: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeBytecodeTop(); > break; > > case PutDynamicVar: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > > case ResolveScope: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecObject); > break; > > case ResolveScopeForHoistingFuncDeclInEval: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeBytecodeTop(); > break; > >@@ -3351,13 +3351,13 @@ bool AbstractInterpreter<AbstractStateTy > break; > > case InstanceOfCustom: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(SpecBoolean); > break; > > case Phi: > RELEASE_ASSERT(m_graph.m_form == SSA); >- forNode(node) = forNode(NodeFlowProjection(node, NodeFlowProjection::Shadow)); >+ setForNode(node, forNode(NodeFlowProjection(node, NodeFlowProjection::Shadow))); > // The state of this node would have already been decided, but it may have become a > // constant, in which case we'd like to know. > if (forNode(node).m_value) >@@ -3368,7 +3368,7 @@ bool AbstractInterpreter<AbstractStateTy > NodeFlowProjection shadow(node->phi(), NodeFlowProjection::Shadow); > if (shadow.isStillValid()) { > m_state.createValueForNode(shadow); >- forNode(shadow) = forNode(node->child1()); >+ setForNode(shadow, forNode(node->child1())); > } > break; > } >@@ -3390,7 +3390,7 @@ bool AbstractInterpreter<AbstractStateTy > case DirectCall: > case DirectConstruct: > case DirectTailCallInlinedCaller: >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).makeHeapTop(); > break; > >@@ -3400,8 +3400,8 @@ bool AbstractInterpreter<AbstractStateTy > break; > > case InvalidationPoint: >- forAllValues(clobberLimit, AbstractValue::observeInvalidationPointFor); > m_state.setStructureClobberState(StructuresAreWatched); >+ m_state.observeInvalidationPoint(); > break; > > case CPUIntrinsic: >@@ -3447,7 +3447,7 @@ bool AbstractInterpreter<AbstractStateTy > } > > if (node->child1().useKind() == UntypedUse) >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecBytecodeNumber); > break; > } >@@ -3455,7 +3455,7 @@ bool AbstractInterpreter<AbstractStateTy > case CreateRest: > if (!m_graph.isWatchingHavingABadTimeWatchpoint(node)) { > // This means we're already having a bad time. >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(m_graph, SpecArray); > break; > } >@@ -3477,7 +3477,7 @@ bool AbstractInterpreter<AbstractStateTy > } > > case SetFunctionName: { >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > break; > } > >@@ -3537,10 +3537,9 @@ bool AbstractInterpreter<AbstractStateTy > } > > template<typename AbstractStateType> >-void AbstractInterpreter<AbstractStateType>::clobberWorld( >- const CodeOrigin&, unsigned clobberLimit) >+void AbstractInterpreter<AbstractStateType>::clobberWorld() > { >- clobberStructures(clobberLimit); >+ clobberStructures(); > } > > template<typename AbstractStateType> >@@ -3572,16 +3571,16 @@ void AbstractInterpreter<AbstractStateTy > functor(forNode(node)); > } > } >- for (size_t i = m_state.variables().numberOfArguments(); i--;) >- functor(m_state.variables().argument(i)); >- for (size_t i = m_state.variables().numberOfLocals(); i--;) >- functor(m_state.variables().local(i)); >+ for (size_t i = m_state.numberOfArguments(); i--;) >+ functor(m_state.argument(i)); >+ for (size_t i = m_state.numberOfLocals(); i--;) >+ functor(m_state.local(i)); > } > > template<typename AbstractStateType> >-void AbstractInterpreter<AbstractStateType>::clobberStructures(unsigned clobberLimit) >+void AbstractInterpreter<AbstractStateType>::clobberStructures() > { >- forAllValues(clobberLimit, AbstractValue::clobberStructuresFor); >+ m_state.clobberStructures(); > m_state.mergeClobberState(AbstractInterpreterClobberState::ClobberedStructures); > m_state.setStructureClobberState(StructuresAreClobbered); > } >@@ -3729,7 +3728,7 @@ void AbstractInterpreter<AbstractStateTy > if (node->child1().useKind() == DoubleRepUse) > type = typeOfDoubleUnaryOp(forNode(node->child1()).m_type); > else >- clobberWorld(node->origin.semantic, clobberLimit); >+ clobberWorld(); > forNode(node).setType(type); > } > >Index: Source/JavaScriptCore/dfg/DFGAbstractValue.cpp >=================================================================== >--- Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2013-2016 Apple Inc. All rights reserved. >+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -574,6 +574,20 @@ void AbstractValue::ensureCanInitializeW > } > #endif > >+void AbstractValue::fastForwardToSlow(AbstractValueClobberEpoch newEpoch) >+{ >+ ASSERT(newEpoch != m_effectEpoch); >+ >+ if (newEpoch.clobberEpoch() != m_effectEpoch.clobberEpoch()) >+ clobberStructures(); >+ if (newEpoch.structureClobberState() == StructuresAreWatched) >+ m_structure.observeInvalidationPoint(); >+ >+ m_effectEpoch = newEpoch; >+ >+ checkConsistency(); >+} >+ > } } // namespace JSC::DFG > > #endif // ENABLE(DFG_JIT) >Index: Source/JavaScriptCore/dfg/DFGAbstractValue.h >=================================================================== >--- Source/JavaScriptCore/dfg/DFGAbstractValue.h (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGAbstractValue.h (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2011-2016 Apple Inc. All rights reserved. >+ * Copyright (C) 2011-2018 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -28,6 +28,7 @@ > #if ENABLE(DFG_JIT) > > #include "ArrayProfile.h" >+#include "DFGAbstractValueClobberEpoch.h" > #include "DFGFiltrationResult.h" > #include "DFGFrozenValue.h" > #include "DFGNodeFlags.h" >@@ -103,20 +104,10 @@ struct AbstractValue { > checkConsistency(); > } > >- static void clobberStructuresFor(AbstractValue& value) >+ ALWAYS_INLINE void fastForwardTo(AbstractValueClobberEpoch newEpoch) > { >- value.clobberStructures(); >- } >- >- void observeInvalidationPoint() >- { >- m_structure.observeInvalidationPoint(); >- checkConsistency(); >- } >- >- static void observeInvalidationPointFor(AbstractValue& value) >- { >- value.observeInvalidationPoint(); >+ if (newEpoch != m_effectEpoch) >+ fastForwardToSlow(newEpoch); > } > > void observeTransition(RegisteredStructure from, RegisteredStructure to) >@@ -397,6 +388,10 @@ struct AbstractValue { > // effect that makes non-obvious changes to the heap. > ArrayModes m_arrayModes; > >+ // The epoch. >+ // FIXME: Explain this. (OOPS!!) >+ AbstractValueClobberEpoch m_effectEpoch; >+ > // This is a proven constraint on the possible values that this value can > // have now or any time in the future, unless it is reassigned. Note that this > // implies nothing about the structure. Oddly, JSValue() (i.e. the empty value) >@@ -455,6 +450,8 @@ private: > checkConsistency(); > } > >+ void fastForwardToSlow(AbstractValueClobberEpoch); >+ > void filterValueByType(); > void filterArrayModesByType(); > >Index: Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.cpp >=================================================================== >--- Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.cpp (nonexistent) >+++ Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.cpp (working copy) >@@ -0,0 +1,41 @@ >+/* >+ * Copyright (C) 2018 Apple Inc. All rights reserved. >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY >+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR >+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, >+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, >+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR >+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY >+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE >+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >+ */ >+ >+#include "config.h" >+#include "DFGAbstractValueClobberEpoch.h" >+ >+#if ENABLE(DFG_JIT) >+ >+namespace JSC { namespace DFG { >+ >+void AbstractValueClobberEpoch::dump(PrintStream& out) const >+{ >+ out.print(clobberEpoch(), ":", structureClobberState()); >+} >+ >+} } // namespae JSC::DFG >+ >+#endif // ENABLE(DFG_JIT) >+ >Index: Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.h >=================================================================== >--- Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.h (nonexistent) >+++ Source/JavaScriptCore/dfg/DFGAbstractValueClobberEpoch.h (working copy) >@@ -0,0 +1,99 @@ >+/* >+ * Copyright (C) 2018 Apple Inc. All rights reserved. >+ * >+ * Redistribution and use in source and binary forms, with or without >+ * modification, are permitted provided that the following conditions >+ * are met: >+ * 1. Redistributions of source code must retain the above copyright >+ * notice, this list of conditions and the following disclaimer. >+ * 2. Redistributions in binary form must reproduce the above copyright >+ * notice, this list of conditions and the following disclaimer in the >+ * documentation and/or other materials provided with the distribution. >+ * >+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY >+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE >+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR >+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR >+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, >+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, >+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR >+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY >+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT >+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE >+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. >+ */ >+ >+#pragma once >+ >+#if ENABLE(DFG_JIT) >+ >+#include "DFGEpoch.h" >+#include "DFGStructureClobberState.h" >+#include <wtf/PrintStream.h> >+ >+namespace JSC { namespace DFG { >+ >+class AbstractValueClobberEpoch { >+public: >+ AbstractValueClobberEpoch() >+ { >+ } >+ >+ static AbstractValueClobberEpoch first(StructureClobberState clobberState) >+ { >+ AbstractValueClobberEpoch result; >+ result.m_value = Epoch::first().toUnsigned() << epochShift; >+ switch (clobberState) { >+ case StructuresAreWatched: >+ result.m_value |= watchedFlag; >+ break; >+ case StructuresAreClobbered: >+ break; >+ } >+ return result; >+ } >+ >+ void clobber() >+ { >+ m_value += step; >+ m_value &= ~watchedFlag; >+ } >+ >+ void observeInvalidationPoint() >+ { >+ m_value |= watchedFlag; >+ } >+ >+ bool operator==(const AbstractValueClobberEpoch& other) const >+ { >+ return m_value == other.m_value; >+ } >+ >+ bool operator!=(const AbstractValueClobberEpoch& other) const >+ { >+ return !(*this == other); >+ } >+ >+ StructureClobberState structureClobberState() const >+ { >+ return m_value & watchedFlag ? StructuresAreWatched : StructuresAreClobbered; >+ } >+ >+ Epoch clobberEpoch() const >+ { >+ return Epoch::fromUnsigned(m_value >> epochShift); >+ } >+ >+ void dump(PrintStream&) const; >+ >+private: >+ static constexpr unsigned step = 2; >+ static constexpr unsigned watchedFlag = 1; >+ static constexpr unsigned epochShift = 1; >+ >+ unsigned m_value { 0 }; >+}; >+ >+} } // namespace JSC::DFG >+ >+#endif // ENABLE(DFG_JIT) >Index: Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h >=================================================================== >--- Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h (working copy) >@@ -52,7 +52,45 @@ public: > void createValueForNode(NodeFlowProjection); > AbstractValue& forNode(NodeFlowProjection); > AbstractValue& forNode(Edge edge) { return forNode(edge.node()); } >- Operands<AbstractValue>& variables() { return m_block->valuesAtTail; } >+ >+ template<typename ValueType> >+ ALWAYS_INLINE void setForNode(NodeFlowProjection node, ValueType&& value) >+ { >+ forNode(node) = std::forward<ValueType>(value); >+ } >+ >+ template<typename ValueType> >+ ALWAYS_INLINE void setForNode(Edge edge, ValueType&& value) >+ { >+ setForNode(edge.node(), std::forward<ValueType>(value)); >+ } >+ >+ ALWAYS_INLINE void clearForNode(NodeFlowProjection node) >+ { >+ forNode(node).clear(); >+ } >+ >+ ALWAYS_INLINE void clearForNode(Edge edge) >+ { >+ clearForNode(edge.node()); >+ } >+ >+ unsigned numberOfArguments() const { return m_block->valuesAtTail.numberOfArguments(); } >+ unsigned numberOfLocals() const { return m_block->valuesAtTail.numberOfLocals(); } >+ AbstractValue& operand(int operand) { return m_block->valuesAtTail.operand(operand); } >+ AbstractValue& operand(VirtualRegister operand) { return m_block->valuesAtTail.operand(operand); } >+ AbstractValue& local(size_t index) { return m_block->valuesAtTail.local(index); } >+ AbstractValue& argument(size_t index) { return m_block->valuesAtTail.argument(index); } >+ >+ void clobberStructures() >+ { >+ UNREACHABLE_FOR_PLATFORM(); >+ } >+ >+ void observeInvalidationPoint() >+ { >+ UNREACHABLE_FOR_PLATFORM(); >+ } > > BasicBlock* block() const { return m_block; } > >Index: Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp >=================================================================== >--- Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (working copy) >@@ -378,7 +378,7 @@ private: > if (index >= inlineCallFrame->argumentCountIncludingThis - 1) > break; > } else { >- if (index >= m_state.variables().numberOfArguments() - 1) >+ if (index >= m_state.numberOfArguments() - 1) > break; > } > >Index: Source/JavaScriptCore/dfg/DFGFlowMap.h >=================================================================== >--- Source/JavaScriptCore/dfg/DFGFlowMap.h (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGFlowMap.h (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2016 Apple Inc. All Rights Reserved. >+ * Copyright (C) 2016-2018 Apple Inc. All Rights Reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -55,27 +55,27 @@ public: > > Graph& graph() const { return m_graph; } > >- T& at(unsigned nodeIndex) >+ ALWAYS_INLINE T& at(unsigned nodeIndex) > { > return m_map[nodeIndex]; > } > >- T& at(Node* node) >+ ALWAYS_INLINE T& at(Node* node) > { > return at(node->index()); > } > >- T& atShadow(unsigned nodeIndex) >+ ALWAYS_INLINE T& atShadow(unsigned nodeIndex) > { > return m_shadowMap[nodeIndex]; > } > >- T& atShadow(Node* node) >+ ALWAYS_INLINE T& atShadow(Node* node) > { > return atShadow(node->index()); > } > >- T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind) >+ ALWAYS_INLINE T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind) > { > switch (kind) { > case NodeFlowProjection::Primary: >@@ -87,23 +87,23 @@ public: > return *bitwise_cast<T*>(nullptr); > } > >- T& at(Node* node, NodeFlowProjection::Kind kind) >+ ALWAYS_INLINE T& at(Node* node, NodeFlowProjection::Kind kind) > { > return at(node->index(), kind); > } > >- T& at(NodeFlowProjection projection) >+ ALWAYS_INLINE T& at(NodeFlowProjection projection) > { > return at(projection.node(), projection.kind()); > } > >- const T& at(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->at(nodeIndex); } >- const T& at(Node* node) const { return const_cast<FlowMap*>(this)->at(node); } >- const T& atShadow(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->atShadow(nodeIndex); } >- const T& atShadow(Node* node) const { return const_cast<FlowMap*>(this)->atShadow(node); } >- const T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(nodeIndex, kind); } >- const T& at(Node* node, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(node, kind); } >- const T& at(NodeFlowProjection projection) const { return const_cast<FlowMap*>(this)->at(projection); } >+ ALWAYS_INLINE const T& at(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->at(nodeIndex); } >+ ALWAYS_INLINE const T& at(Node* node) const { return const_cast<FlowMap*>(this)->at(node); } >+ ALWAYS_INLINE const T& atShadow(unsigned nodeIndex) const { return const_cast<FlowMap*>(this)->atShadow(nodeIndex); } >+ ALWAYS_INLINE const T& atShadow(Node* node) const { return const_cast<FlowMap*>(this)->atShadow(node); } >+ ALWAYS_INLINE const T& at(unsigned nodeIndex, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(nodeIndex, kind); } >+ ALWAYS_INLINE const T& at(Node* node, NodeFlowProjection::Kind kind) const { return const_cast<FlowMap*>(this)->at(node, kind); } >+ ALWAYS_INLINE const T& at(NodeFlowProjection projection) const { return const_cast<FlowMap*>(this)->at(projection); } > > private: > Graph& m_graph; >Index: Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp >=================================================================== >--- Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp (working copy) >@@ -1,5 +1,5 @@ > /* >- * Copyright (C) 2013-2016 Apple Inc. All rights reserved. >+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved. > * > * Redistribution and use in source and binary forms, with or without > * modification, are permitted provided that the following conditions >@@ -60,20 +60,22 @@ void InPlaceAbstractState::beginBasicBlo > ASSERT(basicBlock->variablesAtHead.numberOfLocals() == basicBlock->variablesAtTail.numberOfLocals()); > > m_abstractValues.resize(); >+ m_effectEpoch = AbstractValueClobberEpoch::first(basicBlock->cfaStructureClobberStateAtHead); > > for (size_t i = 0; i < basicBlock->size(); i++) { > NodeFlowProjection::forEach( > basicBlock->at(i), [&] (NodeFlowProjection nodeProjection) { >- forNode(nodeProjection).clear(); >+ clearForNode(nodeProjection); > }); > } > >- m_variables = basicBlock->valuesAtHead; >+ for (size_t i = m_variables.size(); i--;) >+ variableAt(i) = basicBlock->valuesAtHead[i]; > > if (m_graph.m_form == SSA) { > for (NodeAbstractValuePair& entry : basicBlock->ssa->valuesAtHead) { > if (entry.node.isStillValid()) >- forNode(entry.node) = entry.value; >+ setForNode(entry.node, entry.value); > } > } > basicBlock->cfaShouldRevisit = false; >@@ -201,19 +203,19 @@ bool InPlaceAbstractState::endBasicBlock > case ThreadedCPS: { > for (size_t argument = 0; argument < block->variablesAtTail.numberOfArguments(); ++argument) { > AbstractValue& destination = block->valuesAtTail.argument(argument); >- mergeStateAtTail(destination, m_variables.argument(argument), block->variablesAtTail.argument(argument)); >+ mergeStateAtTail(destination, argument(argument), block->variablesAtTail.argument(argument)); > } > > for (size_t local = 0; local < block->variablesAtTail.numberOfLocals(); ++local) { > AbstractValue& destination = block->valuesAtTail.local(local); >- mergeStateAtTail(destination, m_variables.local(local), block->variablesAtTail.local(local)); >+ mergeStateAtTail(destination, local(local), block->variablesAtTail.local(local)); > } > break; > } > > case SSA: { > for (size_t i = 0; i < block->valuesAtTail.size(); ++i) >- block->valuesAtTail[i].merge(m_variables[i]); >+ block->valuesAtTail[i].merge(variableAt(i)); > > for (NodeAbstractValuePair& valueAtTail : block->ssa->valuesAtTail) { > AbstractValue& valueAtNode = forNode(valueAtTail.node); >Index: Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h >=================================================================== >--- Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h (revision 231337) >+++ Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h (working copy) >@@ -47,21 +47,46 @@ public: > > void createValueForNode(NodeFlowProjection) { } > >- AbstractValue& forNode(NodeFlowProjection node) >+ ALWAYS_INLINE AbstractValue& forNode(NodeFlowProjection node) > { >- return m_abstractValues.at(node); >+ return fastForward(m_abstractValues.at(node)); > } > >- AbstractValue& forNode(Edge edge) >+ ALWAYS_INLINE AbstractValue& forNode(Edge edge) > { > return forNode(edge.node()); > } > >- Operands<AbstractValue>& variables() >+ template<typename ValueType> >+ ALWAYS_INLINE void setForNode(NodeFlowProjection node, ValueType&& value) > { >- return m_variables; >+ m_abstractValues.at(node) = std::forward<ValueType>(value); > } > >+ template<typename ValueType> >+ ALWAYS_INLINE void setForNode(Edge edge, ValueType&& value) >+ { >+ setForNode(edge.node(), std::forward<ValueType>(value)); >+ } >+ >+ ALWAYS_INLINE void clearForNode(NodeFlowProjection node) >+ { >+ m_abstractValues.at(node).clear(); >+ } >+ >+ ALWAYS_INLINE void clearForNode(Edge edge) >+ { >+ clearForNode(edge.node()); >+ } >+ >+ unsigned numberOfArguments() const { return m_variables.numberOfArguments(); } >+ unsigned numberOfLocals() const { return m_variables.numberOfLocals(); } >+ AbstractValue& operand(int operand) { return fastForward(m_variables.operand(operand)); } >+ AbstractValue& operand(VirtualRegister operand) { return fastForward(m_variables.operand(operand)); } >+ AbstractValue& local(size_t index) { return fastForward(m_variables.local(index)); } >+ AbstractValue& argument(size_t index) { return fastForward(m_variables.argument(index)); } >+ AbstractValue& variableAt(size_t index) { return fastForward(m_variables[index]); } >+ > // Call this before beginning CFA to initialize the abstract values of > // arguments, and to indicate which blocks should be listed for CFA > // execution. >@@ -119,6 +144,10 @@ public: > // MergeToSuccessors. > bool mergeToSuccessors(BasicBlock*); > >+ void clobberStructures() { m_effectEpoch.clobber(); } >+ >+ void observeInvalidationPoint() { m_effectEpoch.observeInvalidationPoint(); } >+ > // Methods intended to be called from AbstractInterpreter. > void setClobberState(AbstractInterpreterClobberState state) { m_clobberState = state; } > void mergeClobberState(AbstractInterpreterClobberState state) { m_clobberState = mergeClobberStates(m_clobberState, state); } >@@ -139,6 +168,12 @@ public: > } > > private: >+ AbstractValue& fastForward(AbstractValue& value) >+ { >+ value.fastForwardTo(m_effectEpoch); >+ return value; >+ } >+ > void mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node*); > > static bool mergeVariableBetweenBlocks(AbstractValue& destination, AbstractValue& source, Node* destinationNode, Node* sourceNode); >@@ -154,6 +189,7 @@ private: > bool m_isValid; > AbstractInterpreterClobberState m_clobberState; > StructureClobberState m_structureClobberState; >+ AbstractValueClobberEpoch m_effectEpoch; > > BranchDirection m_branchDirection; // This is only set for blocks that end in Branch and that execute to completion (i.e. m_isValid == true). > };
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=339623">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 185287
:
339509
|
339620
|
339623
|
339650
|
339661
|
339662
|
339663
|
339687