Changeset 134555 in webkit for trunk/Source/JavaScriptCore/runtime/JSFunction.h

Timestamp:

Nov 13, 2012, 11:22:57 PM (13 years ago)

Author:

[email protected]

Message:

DFG CreateThis should be able to statically account for the structure of the object it creates, if profiling indicates that this structure is always the same
​https://bugs.webkit.org/show_bug.cgi?id=102017

Reviewed by Geoffrey Garen.

This adds a watchpoint in JSFunction on the cached inheritor ID. It also changes
NewObject to take a structure as an operand (previously it implicitly used the owning
global object's empty object structure). Any GetCallee where the callee is predictable
is turned into a CheckFunction + WeakJSConstant, and any CreateThis on a WeakJSConstant
where the inheritor ID watchpoint is still valid is turned into an InheritorIDWatchpoint
followed by a NewObject. NewObject already accounts for the structure it uses for object
creation in the CFA.

• dfg/DFGAbstractState.cpp:

(JSC::DFG::AbstractState::execute):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGCSEPhase.cpp:

(JSC::DFG::CSEPhase::checkFunctionElimination):

• dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

• dfg/DFGNode.h:

(JSC::DFG::Node::hasFunction):
(JSC::DFG::Node::function):
(JSC::DFG::Node::hasStructure):

• dfg/DFGNodeType.h:

(DFG):

• dfg/DFGOperations.cpp:
• dfg/DFGOperations.h:
• dfg/DFGPredictionPropagationPhase.cpp:

(JSC::DFG::PredictionPropagationPhase::propagate):

• dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• runtime/Executable.h:

(JSC::JSFunction::JSFunction):

• runtime/JSBoundFunction.cpp:

(JSC):

• runtime/JSFunction.cpp:

(JSC::JSFunction::JSFunction):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):

• runtime/JSFunction.h:

(JSC::JSFunction::tryGetKnownInheritorID):
(JSFunction):
(JSC::JSFunction::addInheritorIDWatchpoint):

File:

• trunk/Source/JavaScriptCore/runtime/JSFunction.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/runtime/JSFunction.h

@@ -28 +28 @@
 #include "JSDestructibleObject.h"
 #include "JSScope.h"
+#include "Watchpoint.h"
 
 namespace JSC {
@@ -133 +134 @@
         }
 
+        Structure* tryGetKnownInheritorID()
+        {
+            if (!m_cachedInheritorID)
+                return 0;
+            if (m_inheritorIDWatchpoint.hasBeenInvalidated())
+                return 0;
+            return m_cachedInheritorID.get();
+        }
+        
+        void addInheritorIDWatchpoint(Watchpoint* watchpoint)
+        {
+            ASSERT(tryGetKnownInheritorID());
+            m_inheritorIDWatchpoint.add(watchpoint);
+        }
+
         static size_t offsetOfCachedInheritorID()
         {
@@ -173 +189 @@
         WriteBarrier<JSScope> m_scope;
         WriteBarrier<Structure> m_cachedInheritorID;
+        InlineWatchpointSet m_inheritorIDWatchpoint;
     };