Attachment 340714 Details for Bug 185695 – it begins

[patch] it begins

blah.patch (text/plain), 18.87 KB, created by Filip Pizlo on 2018-05-18 11:09:24 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Filip Pizlo

Created: 2018-05-18 11:09:24 PDT

Size: 18.87 KB

patch

obsolete

>Index: Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/GetByIdStatus.cpp	(revision 231961)
>+++ Source/JavaScriptCore/bytecode/GetByIdStatus.cpp	(working copy)
>@@ -29,6 +29,7 @@
> #include "CodeBlock.h"
> #include "ComplexGetStatus.h"
> #include "GetterSetterAccessCase.h"
>+#include "ICStatusUtils.h"
> #include "InterpreterInlines.h"
> #include "IntrinsicGetterAccessCase.h"
> #include "JSCInlines.h"
>@@ -47,22 +48,7 @@ class GetterSetter;
> 
> bool GetByIdStatus::appendVariant(const GetByIdVariant& variant)
> {
>-    // Attempt to merge this variant with an already existing variant.
>-    for (unsigned i = 0; i < m_variants.size(); ++i) {
>-        if (m_variants[i].attemptToMerge(variant))
>-            return true;
>-    }
>-    
>-    // Make sure there is no overlap. We should have pruned out opportunities for
>-    // overlap but it's possible that an inline cache got into a weird state. We are
>-    // defensive and bail if we detect crazy.
>-    for (unsigned i = 0; i < m_variants.size(); ++i) {
>-        if (m_variants[i].structureSet().overlaps(variant.structureSet()))
>-            return false;
>-    }
>-    
>-    m_variants.append(variant);
>-    return true;
>+    return appendICStatusVariant(m_variants, variant);
> }
> 
> #if ENABLE(DFG_JIT)
>@@ -432,14 +418,7 @@ void GetByIdStatus::filter(const Structu
> {
>     if (m_state != Simple)
>         return;
>-    
>-    // FIXME: We could also filter the variants themselves.
>-    
>-    m_variants.removeAllMatching(
>-        [&] (GetByIdVariant& variant) -> bool {
>-            return !variant.structureSet().overlaps(set);
>-        });
>-    
>+    filterICStatusVariants(m_variants, set);
>     if (m_variants.isEmpty())
>         m_state = NoInformation;
> }
>Index: Source/JavaScriptCore/bytecode/GetByIdStatus.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/GetByIdStatus.h	(revision 231961)
>+++ Source/JavaScriptCore/bytecode/GetByIdStatus.h	(working copy)
>@@ -93,7 +93,7 @@ public:
>     State state() const { return m_state; }
>     
>     bool isSet() const { return m_state != NoInformation; }
>-    bool operator!() const { return !isSet(); }
>+    explicit operator bool() const { return isSet(); }
>     bool isSimple() const { return m_state == Simple; }
>     bool isCustom() const { return m_state == Custom; }
>     bool isModuleNamespace() const { return m_state == ModuleNamespace; }
>Index: Source/JavaScriptCore/bytecode/GetByIdVariant.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/GetByIdVariant.h	(revision 231961)
>+++ Source/JavaScriptCore/bytecode/GetByIdVariant.h	(working copy)
>@@ -55,7 +55,7 @@ public:
>     GetByIdVariant& operator=(const GetByIdVariant&);
>     
>     bool isSet() const { return !!m_structureSet.size(); }
>-    bool operator!() const { return !isSet(); }
>+    explicit operator bool() const { return isSet(); }
>     const StructureSet& structureSet() const { return m_structureSet; }
>     StructureSet& structureSet() { return m_structureSet; }
> 
>Index: Source/JavaScriptCore/bytecode/ICStatusUtils.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/ICStatusUtils.h	(nonexistent)
>+++ Source/JavaScriptCore/bytecode/ICStatusUtils.h	(working copy)
>@@ -0,0 +1,63 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#pragma once
>+
>+namespace JSC {
>+
>+template<typename VariantVectorType, typename VariantType>
>+bool appendICStatusVariant(VariantVectorType& variants, const VariantType& variant)
>+{
>+    // Attempt to merge this variant with an already existing variant.
>+    for (unsigned i = 0; i < variants.size(); ++i) {
>+        if (variants[i].attemptToMerge(variant))
>+            return true;
>+    }
>+    
>+    // Make sure there is no overlap. We should have pruned out opportunities for
>+    // overlap but it's possible that an inline cache got into a weird state. We are
>+    // defensive and bail if we detect crazy.
>+    for (unsigned i = 0; i < variants.size(); ++i) {
>+        if (variants[i].structureSet().overlaps(variant.structureSet()))
>+            return false;
>+    }
>+    
>+    variants.append(variant);
>+    return true;
>+}
>+
>+template<typename VariantVectorType>
>+void filterICStatusVariants(VariantVectorType& variants, const StructureSet& set)
>+{
>+    // FIXME: We could also filter the variants themselves.
>+    
>+    m_variants.removeAllMatching(
>+        [&] (auto& variant) -> bool {
>+            return !variant.structureSet().overlaps(set);
>+        });
>+}
>+
>+} // namespace JSC
>+
>Index: Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp	(nonexistent)
>+++ Source/JavaScriptCore/bytecode/InstanceOfStatus.cpp	(working copy)
>@@ -0,0 +1,108 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "InstanceOfStatus.h"
>+
>+#include "ICStatusUtils.h"
>+#include "JSCInlines.h"
>+
>+namespace JSC {
>+
>+void InstanceOfStatus::appendVariant(const InstanceOfVariant& variant)
>+{
>+    return appendICStatusVariant(m_variants, variant);
>+}
>+
>+InstanceOfStatus InstanceOfStatus::computeFor(
>+    CodeBlock* codeBlock, StubInfoMap& infoMap, unsigned bytecodeIndex)
>+{
>+    ConcurrentJSLocker locker(codeBlock->m_lock);
>+    
>+    InstanceOfStatus result;
>+#if ENABLE(DFG_JIT)
>+    result = computeForStubInfo(locker, codeBlock, map.get(bytecodeIndex));
>+
>+    if (!result.takesSlowPath()) {
>+        UnlinkedCodeBlock* unlinkedCodeBlock = profiledBlock->unlinkedCodeBlock();
>+        ConcurrentJSLocker locker(unlinkedCodeBlock->m_lock);
>+        if (unlinkedCodeBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadCache))
>+            || unlinkedCodeBlock->hasExitSite(locker, DFG::FrequentExitSite(bytecodeIndex, BadConstantCache)))
>+            return TakesSlowPath;
>+    }
>+#else
>+    UNUSED_PARAM(infoMap);
>+    UNUSED_PARAM(codeOrigin);
>+#endif
>+    
>+    return result;
>+}
>+
>+#if ENABLE(DFG_JIT)
>+InstanceOfStatus InstanceOfStatus::computeForStubInfo(
>+    const ConcurrentJSLocker& locker, CodeBlock* codeblock, StructureStubInfo* stubInfo)
>+{
>+    if (!stubInfo || !stubInfo->everConsidered)
>+        return NoInformation;
>+    
>+    if (stubInfo->tookSlowPath)
>+        return TakesSlowPath;
>+    
>+    if (stubInfo->cacheType != CacheType::Stub)
>+        return TakesSlowPath; // This is conservative. It could be that we have no information.
>+    
>+    PolymorphicAccess* list = stubInfo->u.stub;
>+    InstanceOfStatus result;
>+    for (unsigned listIndex = 0; listIndex < list->size(); ++listIndex) {
>+        const AccessCase& access = list->at(listIndex);
>+        
>+        if (access.type() == AccessCase::InstanceOfGeneric)
>+            return TakesSlowPath;
>+        
>+        if (!access.conditionSet().structuresEnsureValidity())
>+            return TakesSlowPath;
>+        
>+        result.appendVariant(InstanceOfVariant(
>+            access.structure(),
>+            access.conditionSet(),
>+            access.as<InstanceOfAccessCase>().prototype(),
>+            access.type() == AccessCase::InstanceOfHit));
>+    }
>+    
>+    return result;
>+}
>+#endif // ENABLE(DFG_JIT)
>+
>+void InstanceOfStatus::filter(const StructureSet& structureSet)
>+{
>+    if (m_state != Simple)
>+        return;
>+    filterICStatusVariants(m_variants, structureSet);
>+    if (m_variants.isEmpty())
>+        m_state = NoInformation;
>+}
>+
>+} // namespace JSC
>+
>Index: Source/JavaScriptCore/bytecode/InstanceOfStatus.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/InstanceOfStatus.h	(nonexistent)
>+++ Source/JavaScriptCore/bytecode/InstanceOfStatus.h	(working copy)
>@@ -0,0 +1,90 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#pragma once
>+
>+#include "CodeOrigin.h"
>+#include "ConcurrentJSLock.h"
>+#include "InstanceOfVariant.h"
>+
>+namespace JSC {
>+
>+class AccessCase;
>+class CodeBlock;
>+class StructureStubInfo;
>+
>+typedef HashMap<CodeOrigin, StructureStubInfo*, CodeOriginApproximateHash> StubInfoMap;
>+
>+class InstanceOfStatus {
>+public:
>+    enum State {
>+        // It's uncached so we have no information.
>+        NoInformation,
>+        
>+        // It's cached in a simple way.
>+        Simple,
>+        
>+        // It's known to often take slow path.
>+        TakesSlowPath
>+    };
>+    
>+    InstanceOfStatus()
>+        : m_state(NoInformation)
>+    {
>+    }
>+    
>+    explicit InstanceOfStatus(State state)
>+        : m_state(state)
>+    {
>+        ASSERT(state == NoInformation || state == MakesCalls);
>+    }
>+    
>+    static InstanceOfStatus computeFor(CodeBlock*, StubInfoMap&, unsigned bytecodeIndex);
>+    
>+#if ENABLE(DFG_JIT)
>+    static InstanceOfStatus computeForStubInfo(const ConcurrentJSLocker&, CodeBlock*, StructureStubInfo*);
>+#endif
>+    
>+    State state() const { return m_state; }
>+    
>+    bool isSet() const { return m_state != NoInformation; }
>+    explicit operator bool() const { return isSet(); }
>+    
>+    bool isSimple() const { return m_state == Simple; }
>+    bool takesSlowPath() const { return m_state == TakesSlowPath; }
>+    
>+    void filter(const StructureSet&);
>+    
>+    void dump(PrintStream&) const;
>+
>+private:
>+    void appendVariant(const InstanceOfVariant&);
>+    
>+    State m_state;
>+    Vector<InstanceOfVariant, 2> m_variants;
>+};
>+
>+} // namespace JSC
>+
>Index: Source/JavaScriptCore/bytecode/InstanceOfVariant.cpp
>===================================================================
>--- Source/JavaScriptCore/bytecode/InstanceOfVariant.cpp	(nonexistent)
>+++ Source/JavaScriptCore/bytecode/InstanceOfVariant.cpp	(working copy)
>@@ -0,0 +1,81 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "InstanceOfVariant.h"
>+
>+#include "JSCInlines.h"
>+#include <wtf/ListDump.h>
>+
>+namespace JSC {
>+
>+InstanceOfVariant::InstanceOfVariant(
>+    const StructureSet& structureSet, const ObjectPropertyConditionSet& conditionSet,
>+    JSObject* prototype, bool isHit)
>+    : m_structureSet(structureSet)
>+    , m_conditionSet(conditionSet)
>+    , m_prototype(prototype)
>+    , m_isHit(isHit)
>+{
>+}
>+
>+bool InstanceOfVariant::attemptToMerge(const InstanceOfVariant& other)
>+{
>+    if (m_prototype != other.m_prototype)
>+        return false;
>+    
>+    if (m_isHit != other.m_isHit)
>+        return false;
>+    
>+    ObjectPropertyConditionSet mergedConditionSet = m_conditionSet.mergedWith(other.m_conditionSet);
>+    if (!mergedConditionSet.isValid())
>+        return false;
>+    m_conditionSet = mergedConditionSet;
>+    
>+    m_structureSet.merge(other.m_structureSet);
>+    
>+    return true;
>+}
>+
>+void InstanceOfVariant::dump(PrintStream& out) const
>+{
>+    dumpInContext(out, nullptr);
>+}
>+
>+void InstanceOfVariant::dumpInContext(PrintStream& out, DumpContext* context) const
>+{
>+    if (!*this) {
>+        out.print("<empty>");
>+        return;
>+    }
>+    
>+    out.print(
>+        "<", inContext(structureSet(), context), ", ", inContext(m_conditionSet, context), ","
>+        " prototype = ", inContext(JSValue(m_prototype), context), ","
>+        " isHit = ", m_isHit, ">");
>+}
>+
>+} // namespace JSC
>+
>Index: Source/JavaScriptCore/bytecode/InstanceOfVariant.h
>===================================================================
>--- Source/JavaScriptCore/bytecode/InstanceOfVariant.h	(nonexistent)
>+++ Source/JavaScriptCore/bytecode/InstanceOfVariant.h	(working copy)
>@@ -0,0 +1,68 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#pragma once
>+
>+#include "ObjectPropertyConditionSet.h"
>+#include "StructureSet.h"
>+
>+namespace JSC {
>+
>+class InstanceOfStatus;
>+
>+class InstanceOfVariant {
>+public:
>+    InstanceOfVariant(
>+        const StructureSet& = StructureSet(),
>+        const ObjectPropertyConditionSet& = ObjectPropertyConditionSet(),
>+        JSObject* prototype, bool isHit);
>+    
>+    explicit operator bool() const { return !!m_structureSet.size(); }
>+    
>+    const StructureSet& structureSet() const { return m_structureSet; }
>+    StructureSet& structureSet() { return m_structureSet; }
>+    
>+    const ObjectPropertyConditionSet& conditionSet() const { return m_conditionSet; }
>+    
>+    JSObject* prototype() const { return m_prototype; }
>+    
>+    bool isHit() const { return m_isHit; }
>+    
>+    bool attemptToMerge(const InstanceOfVariant& other);
>+    
>+    void dump(PrintStream&) const;
>+    void dumpInContext(PrintStream&, DumpContext*) const;
>+    
>+private:
>+    friend class InstanceOfStatus;
>+    
>+    StructureSet m_structureSet;
>+    ObjectPropertyConditionSet m_conditionSet;
>+    JSObject* prototype;
>+    bool m_isHit;
>+};
>+
>+} // namespace JSC
>+

Actions: View | Formatted Diff | Diff

Attachments on bug 185695: 340714 | 340724 | 340731 | 340740 | 340748 | 340751 | 340755 | 340756 | 340759