Changeset 121215 in webkit for trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

Timestamp:

Jun 25, 2012, 7:14:07 PM (13 years ago)

Author:

[email protected]

Message:

Value profiling should use tier-up threshold randomization to get more coverage
​https://bugs.webkit.org/show_bug.cgi?id=89802

Source/JavaScriptCore:

Reviewed by Gavin Barraclough.

This patch causes both LLInt and Baseline JIT code to take the OSR slow path several
times before actually doing OSR. If we take the OSR slow path before the execution
count threshold is reached, then we just call CodeBlock::updateAllPredictions() to
compute the current latest least-upper-bound SpecType of all values seen in each
ValueProfile.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::stronglyVisitStrongReferences):
(JSC::CodeBlock::updateAllPredictionsAndCountLiveness):
(JSC):
(JSC::CodeBlock::updateAllPredictions):
(JSC::CodeBlock::shouldOptimizeNow):

• bytecode/CodeBlock.h:

(JSC::CodeBlock::llintExecuteCounter):
(JSC::CodeBlock::jitExecuteCounter):
(CodeBlock):
(JSC::CodeBlock::updateAllPredictions):

• bytecode/ExecutionCounter.cpp:

(JSC::ExecutionCounter::setThreshold):
(JSC::ExecutionCounter::status):
(JSC):

• bytecode/ExecutionCounter.h:

(JSC::ExecutionCounter::count):
(ExecutionCounter):

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGOperations.cpp:
• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• jit/JITStubs.cpp:

(JSC::DEFINE_STUB_FUNCTION):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::jitCompileAndSetHeuristics):
(JSC::LLInt::entryOSR):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::JSGlobalObject):
(JSC):

• runtime/JSGlobalObject.h:

(JSGlobalObject):
(JSC::JSGlobalObject::weakRandomInteger):

• runtime/Options.cpp:

(Options):
(JSC::Options::initializeOptions):

• runtime/Options.h:

(Options):

• runtime/WeakRandom.h:

(WeakRandom):
(JSC::WeakRandom::seedUnsafe):

LayoutTests:

Reviewed by Gavin Barraclough.

• fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit-expected.txt: Added.
• fast/js/dfg-store-unexpected-value-into-argument-and-osr-exit.html: Added.
• fast/js/script-tests/dfg-store-unexpected-value-into-argument-and-osr-exit.js: Added.

(foo):

File:

• trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGAbstractState.cpp

@@ -1393 +1393 @@
         // FIXME: Turn CheckStructure into StructureTransitionWatchpoint when possible!
         AbstractValue& value = forNode(node.child1());
-        ASSERT(isCellSpeculation(value.m_type));
+        ASSERT(value.isClear() || isCellSpeculation(value.m_type)); // Value could be clear if we've proven must-exit due to a speculation statically known to be bad.
         value.filter(node.structure());
         node.setCanExit(true);