Changeset 129053 in webkit for trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

Timestamp:

Sep 19, 2012, 3:36:44 PM (13 years ago)

Author:

[email protected]

Message:

DFG should not assume that a ByVal access is generic just because it was unprofiled
​https://bugs.webkit.org/show_bug.cgi?id=97088

Reviewed by Geoffrey Garen.

We were not disambiguating between "Undecided" in the sense that the array profile
has no useful information versus "Undecided" in the sense that the array profile
knows that the access has not executed. That's an important distinction, since
the former form of "Undecided" means that we should consult value profiling, while
the latter means that we should force exit unless the value profiling indicates
that the access must be generic (base is not cell or property is not int).

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGArrayMode.cpp:

(JSC::DFG::fromObserved):
(JSC::DFG::refineArrayMode):
(JSC::DFG::modeAlreadyChecked):
(JSC::DFG::modeToString):

• dfg/DFGArrayMode.h:

(JSC::DFG::canCSEStorage):
(JSC::DFG::modeIsSpecific):
(JSC::DFG::modeSupportsLength):
(JSC::DFG::benefitsFromStructureCheck):

File:

• trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

@@ -37 +37 @@
     switch (profile->observedArrayModes()) {
     case 0:
-        return Array::Undecided;
+        return Array::Unprofiled;
     case asArrayModes(NonArray):
         if (action == Array::Write && !profile->mayInterceptIndexedAccesses())
@@ -88 +88 @@
         return Array::Generic;
     
+    if (arrayMode == Array::Unprofiled) {
+        // If the indexing type wasn't recorded in the array profile but the values are
+        // base=cell property=int, then we know that this access didn't execute.
+        return Array::ForceExit;
+    }
+    
     if (arrayMode != Array::Undecided)
         return arrayMode;
@@ -199 +205 @@
         
     case Array::Undecided:
+    case Array::Unprofiled:
         break;
     }
@@ -211 +218 @@
     case Array::Undecided:
         return "Undecided";
+    case Array::Unprofiled:
+        return "Unprofiled";
     case Array::Generic:
         return "Generic";