Bug 130750 – Repatch should support setters and plant calls to them directly

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Filip Pizlo]

Patch forthcoming.

[Filip Pizlo]

Created attachment 228800 [details]
almost done

[Filip Pizlo]

Created attachment 228802 [details]
the patch

[Filip Pizlo]

This is a 12x speed-up on setter microbenchmarks.

[Geoffrey Garen]

Comment on attachment 228802 [details]
the patch

r=me

Can you beef up setter.js to force a cached setter to miss the cache due to a redefined setter?

[Filip Pizlo]

(In reply to comment #4)
> (From update of attachment 228802 [details])
> r=me
> 
> Can you beef up setter.js to force a cached setter to miss the cache due to a redefined setter?

Sure!

[Build Bot]

Comment on attachment 228802 [details]
the patch

Attachment 228802 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.appspot.com/results/5760488755429376

New failing tests:
platform/mac/fast/scrolling/scroll-iframe-latched-mainframe.html
platform/mac/fast/scrolling/scroll-select-latched-mainframe.html
js/regress/setter.html
platform/mac/fast/scrolling/scroll-div-latched-mainframe.html

[Build Bot]

Created attachment 228808 [details]
Archive of layout-test-results from webkit-ews-12 for mac-mountainlion-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: webkit-ews-12  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.5

[Build Bot]

Comment on attachment 228802 [details]
the patch

Attachment 228802 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/5040769945567232

New failing tests:
js/regress/setter.html

[Build Bot]

Created attachment 228809 [details]
Archive of layout-test-results from webkit-ews-04 for mac-mountainlion

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: webkit-ews-04  Port: mac-mountainlion  Platform: Mac OS X 10.8.5

[Build Bot]

Comment on attachment 228802 [details]
the patch

Attachment 228802 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.appspot.com/results/6551012919738368

New failing tests:
platform/mac/fast/scrolling/scroll-iframe-latched-mainframe.html
platform/mac/fast/scrolling/scroll-select-latched-mainframe.html
js/regress/setter.html
platform/mac/fast/scrolling/scroll-div-latched-mainframe.html

[Build Bot]

Created attachment 228810 [details]
Archive of layout-test-results from webkit-ews-11 for mac-mountainlion-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: webkit-ews-11  Port: mac-mountainlion-wk2  Platform: Mac OS X 10.8.5

[Build Bot]

Comment on attachment 228802 [details]
the patch

Attachment 228802 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.appspot.com/results/6604913685561344

New failing tests:
js/regress/setter.html

[Build Bot]

Created attachment 228813 [details]
Archive of layout-test-results from webkit-ews-08 for mac-mountainlion

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: webkit-ews-08  Port: mac-mountainlion  Platform: Mac OS X 10.8.5

[Filip Pizlo]

Created attachment 228862 [details]
patch for landing

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/166945

[Csaba Osztrogonác]

(In reply to comment #15)
> Landed in http://trac.webkit.org/changeset/166945
It broke 18 tests on 32 bit:
http://build.webkit.org/builders/Apple%20Mavericks%2032-bit%20JSC%20%28BuildAndTest%29/builds/248

** The following JSC stress test failures have been introduced:
	mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-baseline
	mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-dfg-eager-no-cjit-validate-phases
	mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla
	mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla-baseline
	mozilla-tests.yaml/ecma/Expressions/11.6.1-2.js.mozilla-baseline
	mozilla-tests.yaml/ecma/Expressions/11.6.2-1.js.mozilla-baseline
	mozilla-tests.yaml/ecma/Types/8.6.2.1-1.js.mozilla-baseline
	stress/setter.js.default
	stress/setter.js.no-llint
	stress/setter.js.always-trigger-copy-phase
	stress/setter.js.no-cjit-validate-phases
	regress/script-tests/assign-custom-setter-polymorphic.js.no-llint
	regress/script-tests/assign-custom-setter.js.no-llint
	regress/script-tests/assign-custom-setter.js.dfg-eager
	regress/script-tests/assign-custom-setter.js.dfg-eager-no-cjit-validate
	jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout
	jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-llint
	jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-cjit

Results for JSC stress tests:
    18 failures found.

[Filip Pizlo]

(In reply to comment #16)
> (In reply to comment #15)
> > Landed in http://trac.webkit.org/changeset/166945
> It broke 18 tests on 32 bit:
> http://build.webkit.org/builders/Apple%20Mavericks%2032-bit%20JSC%20%28BuildAndTest%29/builds/248
> 
> ** The following JSC stress test failures have been introduced:
>     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-baseline
>     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-dfg-eager-no-cjit-validate-phases
>     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla
>     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla-baseline
>     mozilla-tests.yaml/ecma/Expressions/11.6.1-2.js.mozilla-baseline
>     mozilla-tests.yaml/ecma/Expressions/11.6.2-1.js.mozilla-baseline
>     mozilla-tests.yaml/ecma/Types/8.6.2.1-1.js.mozilla-baseline
>     stress/setter.js.default
>     stress/setter.js.no-llint
>     stress/setter.js.always-trigger-copy-phase
>     stress/setter.js.no-cjit-validate-phases
>     regress/script-tests/assign-custom-setter-polymorphic.js.no-llint
>     regress/script-tests/assign-custom-setter.js.no-llint
>     regress/script-tests/assign-custom-setter.js.dfg-eager
>     regress/script-tests/assign-custom-setter.js.dfg-eager-no-cjit-validate
>     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout
>     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-llint
>     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-cjit
> 
> Results for JSC stress tests:
>     18 failures found.

I am looking.

[Filip Pizlo]

(In reply to comment #17)
> (In reply to comment #16)
> > (In reply to comment #15)
> > > Landed in http://trac.webkit.org/changeset/166945
> > It broke 18 tests on 32 bit:
> > http://build.webkit.org/builders/Apple%20Mavericks%2032-bit%20JSC%20%28BuildAndTest%29/builds/248
> > 
> > ** The following JSC stress test failures have been introduced:
> >     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-baseline
> >     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-dfg-eager-no-cjit-validate-phases
> >     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla
> >     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla-baseline
> >     mozilla-tests.yaml/ecma/Expressions/11.6.1-2.js.mozilla-baseline
> >     mozilla-tests.yaml/ecma/Expressions/11.6.2-1.js.mozilla-baseline
> >     mozilla-tests.yaml/ecma/Types/8.6.2.1-1.js.mozilla-baseline
> >     stress/setter.js.default
> >     stress/setter.js.no-llint
> >     stress/setter.js.always-trigger-copy-phase
> >     stress/setter.js.no-cjit-validate-phases
> >     regress/script-tests/assign-custom-setter-polymorphic.js.no-llint
> >     regress/script-tests/assign-custom-setter.js.no-llint
> >     regress/script-tests/assign-custom-setter.js.dfg-eager
> >     regress/script-tests/assign-custom-setter.js.dfg-eager-no-cjit-validate
> >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout
> >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-llint
> >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-cjit
> > 
> > Results for JSC stress tests:
> >     18 failures found.
> 
> I am looking.

Does not repro in release for me.  Trying debug now...

[Filip Pizlo]

(In reply to comment #18)
> (In reply to comment #17)
> > (In reply to comment #16)
> > > (In reply to comment #15)
> > > > Landed in http://trac.webkit.org/changeset/166945
> > > It broke 18 tests on 32 bit:
> > > http://build.webkit.org/builders/Apple%20Mavericks%2032-bit%20JSC%20%28BuildAndTest%29/builds/248
> > > 
> > > ** The following JSC stress test failures have been introduced:
> > >     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-baseline
> > >     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-dfg-eager-no-cjit-validate-phases
> > >     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla
> > >     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla-baseline
> > >     mozilla-tests.yaml/ecma/Expressions/11.6.1-2.js.mozilla-baseline
> > >     mozilla-tests.yaml/ecma/Expressions/11.6.2-1.js.mozilla-baseline
> > >     mozilla-tests.yaml/ecma/Types/8.6.2.1-1.js.mozilla-baseline
> > >     stress/setter.js.default
> > >     stress/setter.js.no-llint
> > >     stress/setter.js.always-trigger-copy-phase
> > >     stress/setter.js.no-cjit-validate-phases
> > >     regress/script-tests/assign-custom-setter-polymorphic.js.no-llint
> > >     regress/script-tests/assign-custom-setter.js.no-llint
> > >     regress/script-tests/assign-custom-setter.js.dfg-eager
> > >     regress/script-tests/assign-custom-setter.js.dfg-eager-no-cjit-validate
> > >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout
> > >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-llint
> > >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-cjit
> > > 
> > > Results for JSC stress tests:
> > >     18 failures found.
> > 
> > I am looking.
> 
> Does not repro in release for me.  Trying debug now...

Oh yuck!!  That assertion probably affects 64-bit too.  It's a dumb assertion, will land fix shortly...

[Filip Pizlo]

(In reply to comment #19)
> (In reply to comment #18)
> > (In reply to comment #17)
> > > (In reply to comment #16)
> > > > (In reply to comment #15)
> > > > > Landed in http://trac.webkit.org/changeset/166945
> > > > It broke 18 tests on 32 bit:
> > > > http://build.webkit.org/builders/Apple%20Mavericks%2032-bit%20JSC%20%28BuildAndTest%29/builds/248
> > > > 
> > > > ** The following JSC stress test failures have been introduced:
> > > >     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-baseline
> > > >     mozilla-tests.yaml/ecma/ExecutionContexts/10.1.6.js.mozilla-dfg-eager-no-cjit-validate-phases
> > > >     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla
> > > >     mozilla-tests.yaml/ecma/Expressions/11.6.1-1.js.mozilla-baseline
> > > >     mozilla-tests.yaml/ecma/Expressions/11.6.1-2.js.mozilla-baseline
> > > >     mozilla-tests.yaml/ecma/Expressions/11.6.2-1.js.mozilla-baseline
> > > >     mozilla-tests.yaml/ecma/Types/8.6.2.1-1.js.mozilla-baseline
> > > >     stress/setter.js.default
> > > >     stress/setter.js.no-llint
> > > >     stress/setter.js.always-trigger-copy-phase
> > > >     stress/setter.js.no-cjit-validate-phases
> > > >     regress/script-tests/assign-custom-setter-polymorphic.js.no-llint
> > > >     regress/script-tests/assign-custom-setter.js.no-llint
> > > >     regress/script-tests/assign-custom-setter.js.dfg-eager
> > > >     regress/script-tests/assign-custom-setter.js.dfg-eager-no-cjit-validate
> > > >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout
> > > >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-llint
> > > >     jsc-layout-tests.yaml/js/script-tests/for-in-cached.js.layout-no-cjit
> > > > 
> > > > Results for JSC stress tests:
> > > >     18 failures found.
> > > 
> > > I am looking.
> > 
> > Does not repro in release for me.  Trying debug now...
> 
> Oh yuck!!  That assertion probably affects 64-bit too.  It's a dumb assertion, will land fix shortly...

Fixed in http://trac.webkit.org/changeset/166952