Changeset 100219 in webkit for trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

Timestamp:

Nov 14, 2011, 5:04:08 PM (14 years ago)

Author:

[email protected]

Message:

DFG put_by_id transition optimizations test the wrong structures
​https://bugs.webkit.org/show_bug.cgi?id=72324

Reviewed by Gavin Barraclough.

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::structureChainIsStillValid):
(JSC::DFG::ByteCodeParser::parseBlock):

• jit/JITPropertyAccess.cpp:

(JSC::JIT::privateCompilePutByIdTransition):

File:

• trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -683 +683 @@
         
         return nodeIndex;
+    }
+    
+    bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)
+    {
+        if (direct)
+            return true;
+        
+        if (!previousStructure->storedPrototype().isNull() && previousStructure->storedPrototype().asCell()->structure() != chain->head()->get())
+            return false;
+        
+        for (WriteBarrier<Structure>* it = chain->head(); *it; ++it) {
+            if (!(*it)->storedPrototype().isNull() && (*it)->storedPrototype().asCell()->structure() != it[1].get())
+                return false;
+        }
+        
+        return true;
     }
     
@@ -1804 +1820 @@
                     size_t offset = newStructure->get(*m_globalData, identifier);
                     
-                    if (offset != notFound) {
+                    if (offset != notFound && structureChainIsStillValid(direct, previousStructure, structureChain)) {
                         addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure)), base);
                         if (!direct) {
+                            if (!previousStructure->storedPrototype().isNull())
+                                addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(previousStructure->storedPrototype().asCell()->structure())), cellConstant(previousStructure->storedPrototype().asCell()));
+                            
                             for (WriteBarrier<Structure>* it = structureChain->head(); *it; ++it) {
                                 JSValue prototype = (*it)->storedPrototype();