Skip to content

Commit 48facae

Browse files
ConstellationConstellation
committed
Unreviewed, reland 264134@main
https://bugs.webkit.org/show_bug.cgi?id=256921 rdar://109481847 Relanding 264134@main. Only change is using clobberWorld instead of didFoldClobberWorld in PutByVal -> PutById change since it is still clobbering world regardless of this conversion. * JSTests/microbenchmarks/megamorphic-store-by-val.js: Added. * JSTests/microbenchmarks/megamorphic-store.js: Added. * JSTests/stress/put-by-id-megamorphic-have-a-bad-time.js: Added. (test): * Source/JavaScriptCore/JavaScriptCore.order: * Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj: * Source/JavaScriptCore/bytecode/AccessCase.cpp: (JSC::AccessCase::create): (JSC::AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck const): (JSC::AccessCase::requiresIdentifierNameMatch const): (JSC::AccessCase::requiresInt32PropertyCheck const): (JSC::AccessCase::needsScratchFPR const): (JSC::AccessCase::forEachDependentCell const): (JSC::AccessCase::doesCalls const): (JSC::AccessCase::canReplace const): (JSC::AccessCase::runWithDowncast): (JSC::AccessCase::canBeShared): * Source/JavaScriptCore/bytecode/AccessCase.h: * Source/JavaScriptCore/bytecode/GetByStatus.cpp: (JSC::isSameStyledCodeOrigin): Deleted. * Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp: (JSC::InlineCacheCompiler::generateWithGuard): (JSC::InlineCacheCompiler::generateImpl): (JSC::canUseMegamorphicPutFastPath): (JSC::InlineCacheCompiler::regenerate): * Source/JavaScriptCore/bytecode/InlineCacheCompiler.h: (JSC::canUseMegamorphicGetById): (JSC::canUseMegamorphicPutById): * Source/JavaScriptCore/bytecode/InlineCallFrame.h: (JSC::isSameStyledCodeOrigin): * Source/JavaScriptCore/bytecode/PutByStatus.cpp: (JSC::PutByStatus::PutByStatus): (JSC::PutByStatus::computeFor): (JSC::PutByStatus::computeForStubInfo): (JSC::PutByStatus::makesCalls const): (JSC::PutByStatus::merge): (JSC::PutByStatus::dump const): * Source/JavaScriptCore/bytecode/PutByStatus.h: * Source/JavaScriptCore/bytecode/PutKind.h: Removed. * Source/JavaScriptCore/bytecode/Repatch.cpp: (JSC::appropriateGenericPutByFunction): (JSC::repatchPutBySlowPathCall): (JSC::appropriateOptimizingPutByFunction): (JSC::tryCachePutBy): (JSC::repatchPutBy): (JSC::tryCacheArrayPutByVal): (JSC::repatchArrayPutByVal): (JSC::resetPutBy): (JSC::retagOperationWithValidation): Deleted. (JSC::retagCallTargetWithValidation): Deleted. (JSC::readPutICCallTarget): Deleted. * Source/JavaScriptCore/bytecode/Repatch.h: * Source/JavaScriptCore/bytecode/StructureStubInfo.cpp: (JSC::StructureStubInfo::reset): (JSC::StructureStubInfo::summary const): (JSC::slowOperationFromUnlinkedStructureStubInfo): (JSC::StructureStubInfo::initializeFromUnlinkedStructureStubInfo): * Source/JavaScriptCore/bytecode/StructureStubInfo.h: * Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::BytecodeGenerator): (JSC::BytecodeGenerator::variable): (JSC::BytecodeGenerator::resolveType): * Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h: * Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): * Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp: (JSC::DFG::BackwardsPropagationPhase::propagate): * Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::handleGetById): (JSC::DFG::ByteCodeParser::emitPutById): (JSC::DFG::ByteCodeParser::parseBlock): (JSC::DFG::ByteCodeParser::handlePutByVal): * Source/JavaScriptCore/dfg/DFGClobberize.h: (JSC::DFG::clobberize): * Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp: (JSC::DFG::ConstantFoldingPhase::foldConstants): * Source/JavaScriptCore/dfg/DFGDoesGC.cpp: (JSC::DFG::doesGC): * Source/JavaScriptCore/dfg/DFGFixupPhase.cpp: (JSC::DFG::FixupPhase::fixupNode): * Source/JavaScriptCore/dfg/DFGNode.cpp: (JSC::DFG::Node::convertToGetByIdMaybeMegamorphic): (JSC::DFG::Node::convertToPutByIdMaybeMegamorphic): * Source/JavaScriptCore/dfg/DFGNode.h: (JSC::DFG::Node::convertToPutByOffset): (JSC::DFG::Node::convertToMultiPutByOffset): (JSC::DFG::Node::hasCacheableIdentifier): (JSC::DFG::Node::hasStorageChild const): (JSC::DFG::Node::storageChildIndex): (JSC::DFG::Node::hasArrayMode): (JSC::DFG::Node::hasECMAMode): (JSC::DFG::Node::ecmaMode): * Source/JavaScriptCore/dfg/DFGNodeType.h: * Source/JavaScriptCore/dfg/DFGOperations.cpp: (JSC::DFG::JSC_DEFINE_JIT_OPERATION): * Source/JavaScriptCore/dfg/DFGOperations.h: * Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp: * Source/JavaScriptCore/dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileContiguousPutByVal): (JSC::DFG::SpeculativeJIT::compileDoublePutByVal): (JSC::DFG::SpeculativeJIT::compilePutByVal): (JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h: * Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp: (JSC::DFG::SpeculativeJIT::compile): * Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp: (JSC::DFG::SpeculativeJIT::compile): (JSC::DFG::SpeculativeJIT::compileEnumeratorPutByVal): (JSC::DFG::SpeculativeJIT::compilePutByIdMegamorphic): (JSC::DFG::SpeculativeJIT::compilePutByValMegamorphic): * Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp: * Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp: (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks): (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks): * Source/JavaScriptCore/ftl/FTLCapabilities.cpp: (JSC::FTL::canCompile): * Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNode): (JSC::FTL::DFG::LowerDFGToB3::compilePutByValMegamorphic): (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateNameById): (JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName): (JSC::FTL::DFG::LowerDFGToB3::cachedPutById): (JSC::FTL::DFG::LowerDFGToB3::compilePutById): (JSC::FTL::DFG::LowerDFGToB3::compilePutByIdMegamorphic): (JSC::FTL::DFG::LowerDFGToB3::compilePutByVal): (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq): * Source/JavaScriptCore/interpreter/Interpreter.cpp: (JSC::eval): * Source/JavaScriptCore/jit/AssemblyHelpers.cpp: (JSC::AssemblyHelpers::storeMegamorphicProperty): * Source/JavaScriptCore/jit/AssemblyHelpers.h: * Source/JavaScriptCore/jit/ICStats.h: * Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp: (JSC::JITInlineCacheGenerator::JITInlineCacheGenerator): (JSC::JITPutByIdGenerator::JITPutByIdGenerator): (JSC::JITPutByIdGenerator::slowPathFunction): (JSC::JITPutByValGenerator::JITPutByValGenerator): * Source/JavaScriptCore/jit/JITInlineCacheGenerator.h: * Source/JavaScriptCore/jit/JITOperations.cpp: (JSC::JSC_DEFINE_JIT_OPERATION): (JSC::putByIdMegamorphic): (JSC::putByValOptimize): (JSC::directPutByValOptimize): (JSC::putByValMegamorphic): (JSC::putPrivateNameOptimize): (JSC::getByValMegamorphic): * Source/JavaScriptCore/jit/JITOperations.h: * Source/JavaScriptCore/jit/JITPropertyAccess.cpp: (JSC::JIT::emit_op_put_by_val): (JSC::JIT::emit_op_put_private_name): (JSC::JIT::emit_op_put_by_id): (JSC::JIT::emit_op_enumerator_put_by_val): * Source/JavaScriptCore/runtime/CachedTypes.cpp: (JSC::CachedSymbolTable::encode): (JSC::CachedSymbolTable::decode const): * Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp: (JSC::JSC_DEFINE_HOST_FUNCTION): * Source/JavaScriptCore/runtime/JSObject.h: * Source/JavaScriptCore/runtime/JSScope.cpp: (JSC::abstractAccess): * Source/JavaScriptCore/runtime/LiteralParser.cpp: (JSC::LiteralParser<CharType>::Lexer::lexString): (JSC::LiteralParser<CharType>::Lexer::lexStringSlow): * Source/JavaScriptCore/runtime/LiteralParser.h: * Source/JavaScriptCore/runtime/MegamorphicCache.cpp: (JSC::MegamorphicCache::age): (JSC::MegamorphicCache::clearEntries): * Source/JavaScriptCore/runtime/MegamorphicCache.h: (JSC::MegamorphicCache::StoreEntry::offsetOfUid): (JSC::MegamorphicCache::StoreEntry::offsetOfOldStructureID): (JSC::MegamorphicCache::StoreEntry::offsetOfNewStructureID): (JSC::MegamorphicCache::StoreEntry::offsetOfEpoch): (JSC::MegamorphicCache::StoreEntry::offsetOfOffset): (JSC::MegamorphicCache::StoreEntry::init): (JSC::MegamorphicCache::offsetOfStoreCachePrimaryEntries): (JSC::MegamorphicCache::offsetOfStoreCacheSecondaryEntries): (JSC::MegamorphicCache::storeCachePrimaryHash): (JSC::MegamorphicCache::storeCacheSecondaryHash): (JSC::MegamorphicCache::initAsTransition): (JSC::MegamorphicCache::initAsReplace): * Source/JavaScriptCore/runtime/RegExpObject.cpp: (JSC::JSC_DEFINE_CUSTOM_SETTER): (JSC::RegExpObject::put): * Source/JavaScriptCore/runtime/SymbolTable.cpp: (JSC::SymbolTable::SymbolTable): (JSC::SymbolTable::cloneScopePart): * Source/JavaScriptCore/runtime/SymbolTable.h: Canonical link: https://commits.webkit.org/264186@main
1 parent f4b4f2f commit 48facae

62 files changed

Lines changed: 1571 additions & 524 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎JSTests/microbenchmarks/megamorphic-store-by-val.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
//@ skip if $model == "Apple Watch Series 3" # added by mark-jsc-stress-test.py
2+
(function() {
3+
var array = [];
4+
var names = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p'];
5+
for (var i = 0; i < 100; ++i) {
6+
var o = {};
7+
o["i" + i] = i;
8+
o[names[i & 15]] = 42;
9+
array.push(o);
10+
}
11+
12+
for (var i = 0; i < 1000000; ++i) {
13+
var name = names[i & 15];
14+
var instance = array[i % array.length];
15+
instance[name] = i;
16+
if (instance[name] != i)
17+
throw "Error: bad result: " + result;
18+
}
19+
})();

‎JSTests/microbenchmarks/megamorphic-store.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
//@ skip if $model == "Apple Watch Series 3" # added by mark-jsc-stress-test.py
2+
(function() {
3+
var array = [];
4+
for (var i = 0; i < 100; ++i) {
5+
var o = {};
6+
o["i" + i] = i;
7+
o.f = 42;
8+
array.push(o);
9+
}
10+
11+
for (var i = 0; i < 1000000; ++i) {
12+
var instance = array[i % array.length];
13+
instance.f = i;
14+
if (instance.f != i)
15+
throw "Error: bad result: " + result;
16+
}
17+
})();

‎JSTests/stress/put-by-id-megamorphic-have-a-bad-time.js‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
//@ skip if $model == "Apple Watch Series 3" # added by mark-jsc-stress-test.py
2+
(function() {
3+
var array = [];
4+
var array2 = [];
5+
for (var i = 0; i < 100; ++i) {
6+
var o = {};
7+
o["i" + i] = i;
8+
array.push(o);
9+
var o = {};
10+
o["i" + i] = i;
11+
array2.push(o);
12+
}
13+
14+
function test(object, i) {
15+
object.f = i;
16+
}
17+
noInline(test);
18+
19+
for (var i = 0; i < 1000000; ++i) {
20+
var instance = array[i % array.length];
21+
test(instance, i);
22+
if (instance.f !== i)
23+
throw "Error: bad result: " + result;
24+
}
25+
26+
Object.prototype[0] = 43;
27+
Object.defineProperty(Object.prototype, 'f', {
28+
get() { return 44; }
29+
});
30+
for (var i = 0; i < 1000000; ++i) {
31+
var instance = array[i % array.length];
32+
test(instance, i);
33+
if (instance.f !== i)
34+
throw "Error: bad result: " + result;
35+
}
36+
37+
for (var i = 0; i < 100; ++i) {
38+
var instance = array2[i % array.length];
39+
test(instance, i);
40+
if (instance.f !== 44)
41+
throw "Error: bad result: " + result;
42+
}
43+
44+
})();

‎Source/JavaScriptCore/JavaScriptCore.order‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2505,7 +2505,7 @@ __ZN3JSC3DFGL21linkForThunkGeneratorEPNS_2VMENS_22CodeSpecializationKindE
25052505
__ZN3JSC3DFGL11slowPathForERNS0_12CCallHelpersEPNS_2VMEPFPcPNS_9ExecStateEE
25062506
_operationLinkCall
25072507
_linkFor
2508-
_operationPutByValNonStrict
2508+
_operationPutByValSloppy
25092509
_operationCompareEq
25102510
_operationGetByVal
25112511
__ZN3JSC3DFG10dfgLinkForEPNS_9ExecStateERNS_12CallLinkInfoEPNS_9CodeBlockEPNS_10JSFunctionENS_21MacroAssemblerCodePtrENS_22CodeSpecializationKindE
@@ -2917,10 +2917,10 @@ __ZN3JSC3DFG14SpeculativeJIT13callOperationEPFPNS_6JSCellEPNS_9ExecStateEPNS_8JS
29172917
__ZN3JSC3DFG14SpeculativeJIT13callOperationEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS_12X86Registers10RegisterIDESB_S7_
29182918
__ZNK3JSC3DFG21CallSlowPathGeneratorINS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPFvPNS_9ExecStateExPNS_6JSCellEPNS_10IdentifierEENS0_11NoResultTagEE4callEv
29192919
_operationToString
2920-
_operationPutByIdNonStrictOptimize
2921-
_operationPutByIdNonStrictOptimizeWithReturnAddress
2920+
_operationPutByIdSloppyOptimize
2921+
_operationPutByIdSloppyOptimizeWithReturnAddress
29222922
__ZN3JSC3DFG17dfgRepatchPutByIDEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_15PutPropertySlotERNS_17StructureStubInfoENS_7PutKindE
2923-
_operationPutByIdNonStrict
2923+
_operationPutByIdSloppy
29242924
__ZN3WTF20ThreadIdentifierData8destructEPv
29252925
__ZN3WTF13threadDidExitEj
29262926
__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
@@ -3407,8 +3407,8 @@ __ZN3JSC3DFG15AssemblyHelpers11unboxDoubleENS_12X86Registers10RegisterIDENS2_13X
34073407
__ZN3JSC3DFG14SpeculativeJIT20compileDoubleCompareEPNS0_4NodeENS_23MacroAssemblerX86Common15DoubleConditionE
34083408
__ZN3JSC3DFG14SpeculativeJIT19fillSpeculateDoubleENS0_4EdgeE
34093409
_operationMakeRope2
3410-
_operationPutByIdNonStrictBuildList
3411-
_operationPutByIdNonStrictBuildListWithReturnAddress
3410+
_operationPutByIdSloppyBuildList
3411+
_operationPutByIdSloppyBuildListWithReturnAddress
34123412
__ZN3JSC3DFG19dfgBuildPutByIdListEPNS_9ExecStateENS_7JSValueERKNS_10IdentifierERKNS_15PutPropertySlotERNS_17StructureStubInfoENS_7PutKindE
34133413
__ZN3JSC22PolymorphicPutByIdList4fromENS_7PutKindERNS_17StructureStubInfoENS_21MacroAssemblerCodePtrE
34143414
__ZN3JSC22PolymorphicPutByIdListC2ENS_7PutKindERNS_17StructureStubInfoENS_21MacroAssemblerCodePtrE
@@ -3585,7 +3585,7 @@ __ZN3WTF17double_conversionL21GenerateCountedDigitsEiPiPNS0_6BignumES3_NS0_15Buf
35853585
__ZN3WTF17double_conversion6Bignum21DivideModuloIntBignumERKS1_
35863586
__ZN3WTF17double_conversion6Bignum13SubtractTimesERKS1_i
35873587
__ZN3WTF17double_conversion6Bignum14SubtractBignumERKS1_
3588-
_operationPutByValBeyondArrayBoundsNonStrict
3588+
_operationPutByValBeyondArrayBoundsSloppy
35893589
__ZN3JSC8JSObject16putByIndexInlineEPNS_9ExecStateEjNS_7JSValueEb
35903590
__ZN3JSC3JIT25emit_op_resolve_with_baseEPNS_11InstructionE
35913591
__ZN3JSC3JIT29emitSlow_op_resolve_with_baseEPNS_11InstructionERPNS_13SlowCaseEntryE
@@ -3763,9 +3763,9 @@ __ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateE
37633763
__ZN3JSCL24dateProtoFuncSetFullYearEPNS_9ExecStateE
37643764
__ZN3JSCL23setNewValueFromDateArgsEPNS_9ExecStateEib
37653765
__ZN3JSC9CodeBlock26findClosureCallForReturnPCENS_16ReturnAddressPtrE
3766-
_operationPutByIdDirectNonStrictOptimize
3767-
_operationPutByIdDirectNonStrictOptimizeWithReturnAddress
3768-
_operationPutByIdDirectNonStrict
3766+
_operationPutByIdDirectSloppyOptimize
3767+
_operationPutByIdDirectSloppyOptimizeWithReturnAddress
3768+
_operationPutByIdDirectSloppy
37693769
__ZN3WTF6VectorIN3JSC13PutByIdAccessELm2ENS_15CrashOnOverflowEE15reserveCapacityEm
37703770
__ZN3JSC3DFG15dfgResetPutByIDERNS_13RepatchBufferERNS_17StructureStubInfoE
37713771
__ZN3JSCL18arrayProtoFuncSomeEPNS_9ExecStateE
@@ -4802,7 +4802,7 @@ _JSStringGetLength
48024802
__ZN3JSC5LexerItE23parseIdentifierSlowCaseILb1EEENS_11JSTokenTypeEPNS_11JSTokenDataEjb
48034803
__ZN3WTF6VectorIN3JSC10LabelScopeELm8ENS_15CrashOnOverflowEE15reserveCapacityEm
48044804
__ZN3JSC16JSCallbackObjectINS_20JSDestructibleObjectEE11getCallDataEPNS_6JSCellERNS_8CallDataE
4805-
_operationPutDoubleByValBeyondArrayBoundsNonStrict
4805+
_operationPutDoubleByValBeyondArrayBoundsSloppy
48064806
_JSStringGetMaximumUTF8CStringSize
48074807
__ZN3JSC15constructStringEPNS_9ExecStateEPNS_14JSGlobalObjectENS_7JSValueE
48084808
__ZN3WTF17charactersToFloatEPKtmRm

‎Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -443,7 +443,6 @@
443443
0F9DAA0A1FD1C3D30079C5B2 /* ParallelSourceAdapter.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9DAA081FD1C3C80079C5B2 /* ParallelSourceAdapter.h */; };
444444
0F9E32641B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9E32621B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h */; };
445445
0F9FB4F517FCB91700CB67F8 /* DFGStackLayoutPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */; };
446-
0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
447446
0FA2C17C17D7CF84009D015F /* TestRunnerUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA2C17A17D7CF84009D015F /* TestRunnerUtils.h */; settings = {ATTRIBUTES = (Private, ); }; };
448447
0FA581BB150E953000B9A2D9 /* DFGNodeFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */; };
449448
0FA581BC150E953000B9A2D9 /* DFGNodeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FA581B9150E952A00B9A2D9 /* DFGNodeType.h */; };
@@ -2980,7 +2979,6 @@
29802979
0F9E32621B05AB0400801ED5 /* DFGStoreBarrierInsertionPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStoreBarrierInsertionPhase.h; path = dfg/DFGStoreBarrierInsertionPhase.h; sourceTree = "<group>"; };
29812980
0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStackLayoutPhase.cpp; path = dfg/DFGStackLayoutPhase.cpp; sourceTree = "<group>"; };
29822981
0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStackLayoutPhase.h; path = dfg/DFGStackLayoutPhase.h; sourceTree = "<group>"; };
2983-
0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PutKind.h; sourceTree = "<group>"; };
29842982
0FA1265320C8DB98004B0D11 /* StubInfoSummary.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StubInfoSummary.cpp; sourceTree = "<group>"; };
29852983
0FA2C17917D7CF84009D015F /* TestRunnerUtils.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TestRunnerUtils.cpp; sourceTree = "<group>"; };
29862984
0FA2C17A17D7CF84009D015F /* TestRunnerUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TestRunnerUtils.h; sourceTree = "<group>"; };
@@ -9076,7 +9074,6 @@
90769074
0F93329A14CA7DC10085F3C6 /* PutByStatus.h */,
90779075
0F93B4A718B92C4D00178A3F /* PutByVariant.cpp */,
90789076
0F93B4A818B92C4D00178A3F /* PutByVariant.h */,
9079-
0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */,
90809077
0F44A7AD20BF685F0022B171 /* RecordedStatuses.cpp */,
90819078
0F44A7AA20BF685E0022B171 /* RecordedStatuses.h */,
90829079
0FF60ABF16740F8100029779 /* ReduceWhitespace.cpp */,
@@ -10973,7 +10970,6 @@
1097310970
0F9332A414CA7DD90085F3C6 /* PutByStatus.h in Headers */,
1097410971
0F93B4AA18B92C4D00178A3F /* PutByVariant.h in Headers */,
1097510972
0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */,
10976-
0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */,
1097710973
147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */,
1097810974
E33A94962255323000D42B06 /* RandomizingFuzzerAgent.h in Headers */,
1097910975
0F44A7B320BF68D10022B171 /* RecordedStatuses.h in Headers */,

‎Source/JavaScriptCore/bytecode/AccessCase.cpp‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ Ref<AccessCase> AccessCase::create(VM& vm, JSCell* owner, AccessType type, Cache
7373
{
7474
switch (type) {
7575
case LoadMegamorphic:
76+
case StoreMegamorphic:
7677
case InHit:
7778
case InMiss:
7879
case DeleteNonConfigurable:
@@ -90,6 +91,7 @@ Ref<AccessCase> AccessCase::create(VM& vm, JSCell* owner, AccessType type, Cache
9091
case InstanceOfGeneric:
9192
case IndexedProxyObjectLoad:
9293
case IndexedMegamorphicLoad:
94+
case IndexedMegamorphicStore:
9395
case IndexedInt32Load:
9496
case IndexedDoubleLoad:
9597
case IndexedContiguousLoad:
@@ -340,6 +342,7 @@ bool AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck() const
340342

341343
switch (m_type) {
342344
case LoadMegamorphic:
345+
case StoreMegamorphic:
343346
case ArrayLength:
344347
case StringLength:
345348
case DirectArgumentsLength:
@@ -353,6 +356,7 @@ bool AccessCase::guardedByStructureCheckSkippingConstantIdentifierCheck() const
353356
case InstanceOfGeneric:
354357
case IndexedProxyObjectLoad:
355358
case IndexedMegamorphicLoad:
359+
case IndexedMegamorphicStore:
356360
case IndexedInt32Load:
357361
case IndexedDoubleLoad:
358362
case IndexedContiguousLoad:
@@ -431,6 +435,7 @@ bool AccessCase::requiresIdentifierNameMatch() const
431435
switch (m_type) {
432436
case Load:
433437
case LoadMegamorphic:
438+
case StoreMegamorphic:
434439
// We don't currently have a by_val for these puts, but we do care about the identifier.
435440
case Transition:
436441
case Delete:
@@ -464,6 +469,7 @@ bool AccessCase::requiresIdentifierNameMatch() const
464469
case InstanceOfGeneric:
465470
case IndexedProxyObjectLoad:
466471
case IndexedMegamorphicLoad:
472+
case IndexedMegamorphicStore:
467473
case IndexedInt32Load:
468474
case IndexedDoubleLoad:
469475
case IndexedContiguousLoad:
@@ -522,6 +528,7 @@ bool AccessCase::requiresInt32PropertyCheck() const
522528
switch (m_type) {
523529
case Load:
524530
case LoadMegamorphic:
531+
case StoreMegamorphic:
525532
case Transition:
526533
case Delete:
527534
case DeleteNonConfigurable:
@@ -553,6 +560,7 @@ bool AccessCase::requiresInt32PropertyCheck() const
553560
case SetPrivateBrand:
554561
case IndexedProxyObjectLoad:
555562
case IndexedMegamorphicLoad:
563+
case IndexedMegamorphicStore:
556564
return false;
557565
case IndexedInt32Load:
558566
case IndexedDoubleLoad:
@@ -612,6 +620,7 @@ bool AccessCase::needsScratchFPR() const
612620
switch (m_type) {
613621
case Load:
614622
case LoadMegamorphic:
623+
case StoreMegamorphic:
615624
case Transition:
616625
case Delete:
617626
case DeleteNonConfigurable:
@@ -642,6 +651,7 @@ bool AccessCase::needsScratchFPR() const
642651
case InstanceOfGeneric:
643652
case IndexedProxyObjectLoad:
644653
case IndexedMegamorphicLoad:
654+
case IndexedMegamorphicStore:
645655
case IndexedInt32Load:
646656
case IndexedContiguousLoad:
647657
case IndexedArrayStorageLoad:
@@ -756,6 +766,7 @@ void AccessCase::forEachDependentCell(VM&, const Functor& functor) const
756766
case CustomAccessorSetter:
757767
case Load:
758768
case LoadMegamorphic:
769+
case StoreMegamorphic:
759770
case Transition:
760771
case Delete:
761772
case DeleteNonConfigurable:
@@ -773,6 +784,7 @@ void AccessCase::forEachDependentCell(VM&, const Functor& functor) const
773784
case ScopedArgumentsLength:
774785
case InstanceOfGeneric:
775786
case IndexedMegamorphicLoad:
787+
case IndexedMegamorphicStore:
776788
case IndexedInt32Load:
777789
case IndexedDoubleLoad:
778790
case IndexedContiguousLoad:
@@ -853,6 +865,7 @@ bool AccessCase::doesCalls(VM& vm, Vector<JSCell*>* cellsToMarkIfDoesCalls) cons
853865
case DeleteMiss:
854866
case Load:
855867
case LoadMegamorphic:
868+
case StoreMegamorphic:
856869
case Miss:
857870
case GetGetter:
858871
case InHit:
@@ -868,6 +881,7 @@ bool AccessCase::doesCalls(VM& vm, Vector<JSCell*>* cellsToMarkIfDoesCalls) cons
868881
case InstanceOfMiss:
869882
case InstanceOfGeneric:
870883
case IndexedMegamorphicLoad:
884+
case IndexedMegamorphicStore:
871885
case IndexedInt32Load:
872886
case IndexedDoubleLoad:
873887
case IndexedContiguousLoad:
@@ -978,7 +992,9 @@ bool AccessCase::canReplace(const AccessCase& other) const
978992

979993
switch (type()) {
980994
case LoadMegamorphic:
995+
case StoreMegamorphic:
981996
case IndexedMegamorphicLoad:
997+
case IndexedMegamorphicStore:
982998
case IndexedInt32Load:
983999
case IndexedDoubleLoad:
9841000
case IndexedContiguousLoad:
@@ -1188,6 +1204,7 @@ inline void AccessCase::runWithDowncast(const Func& func)
11881204
{
11891205
switch (m_type) {
11901206
case LoadMegamorphic:
1207+
case StoreMegamorphic:
11911208
case Transition:
11921209
case Delete:
11931210
case DeleteNonConfigurable:
@@ -1202,6 +1219,7 @@ inline void AccessCase::runWithDowncast(const Func& func)
12021219
case CheckPrivateBrand:
12031220
case SetPrivateBrand:
12041221
case IndexedMegamorphicLoad:
1222+
case IndexedMegamorphicStore:
12051223
case IndexedInt32Load:
12061224
case IndexedDoubleLoad:
12071225
case IndexedContiguousLoad:
@@ -1328,6 +1346,7 @@ bool AccessCase::canBeShared(const AccessCase& lhs, const AccessCase& rhs)
13281346
switch (lhs.m_type) {
13291347
case Load:
13301348
case LoadMegamorphic:
1349+
case StoreMegamorphic:
13311350
case Transition:
13321351
case Delete:
13331352
case DeleteNonConfigurable:
@@ -1344,6 +1363,7 @@ bool AccessCase::canBeShared(const AccessCase& lhs, const AccessCase& rhs)
13441363
case CheckPrivateBrand:
13451364
case SetPrivateBrand:
13461365
case IndexedMegamorphicLoad:
1366+
case IndexedMegamorphicStore:
13471367
case IndexedInt32Load:
13481368
case IndexedDoubleLoad:
13491369
case IndexedContiguousLoad:

‎Source/JavaScriptCore/bytecode/AccessCase.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER(AccessCase);
9595
macro(Load) \
9696
macro(LoadMegamorphic) \
9797
macro(Transition) \
98+
macro(StoreMegamorphic) \
9899
macro(Delete) \
99100
macro(DeleteNonConfigurable) \
100101
macro(DeleteMiss) \
@@ -151,6 +152,7 @@ DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER(AccessCase);
151152
macro(IndexedResizableTypedArrayFloat64Load) \
152153
macro(IndexedStringLoad) \
153154
macro(IndexedNoIndexingMiss) \
155+
macro(IndexedMegamorphicStore) \
154156
macro(IndexedInt32Store) \
155157
macro(IndexedDoubleStore) \
156158
macro(IndexedContiguousStore) \

‎Source/JavaScriptCore/bytecode/GetByStatus.cpp‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -217,20 +217,6 @@ GetByStatus::GetByStatus(const ProxyObjectAccessCase&)
217217
{
218218
}
219219

220-
static bool isSameStyledCodeOrigin(CodeOrigin lhs, CodeOrigin rhs)
221-
{
222-
while (true) {
223-
if (lhs.bytecodeIndex() != rhs.bytecodeIndex())
224-
return false;
225-
if (!!lhs.inlineCallFrame() != !!rhs.inlineCallFrame())
226-
return false;
227-
if (!lhs.inlineCallFrame())
228-
return true;
229-
lhs = lhs.inlineCallFrame()->directCaller;
230-
rhs = rhs.inlineCallFrame()->directCaller;
231-
}
232-
}
233-
234220
GetByStatus GetByStatus::computeForStubInfoWithoutExitSiteFeedback(const ConcurrentJSLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CallLinkStatus::ExitSiteData callExitSiteData, CodeOrigin codeOrigin)
235221
{
236222
StubInfoSummary summary = StructureStubInfo::summary(profiledBlock->vm(), stubInfo);

0 commit comments

Comments
 (0)