Changeset 138669 in webkit for trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

Timestamp:

Jan 2, 2013, 3:54:42 PM (12 years ago)

Author:

[email protected]

Message:

DFG inlining machinery should be robust against the inline callee varying while the executable stays the same
​https://bugs.webkit.org/show_bug.cgi?id=105953

Reviewed by Mark Hahnenberg.

This institutes the policy that if InlineCallFrame::callee is null, then the callee and scope have already
been stored into the true call frame (i.e. the place where the call frame of the inlined call would have
been) and so any attempt to access the callee or scope should do a load instead of assuming that the value
is constant. This wires the changes through the bytecode parser, the stack scanning logic, and the compiler
optimization phases and backends.

• bytecode/CodeOrigin.cpp:

(JSC::InlineCallFrame::dump):

• bytecode/CodeOrigin.h:

(CodeOrigin):
(InlineCallFrame):
(JSC::InlineCallFrame::isClosureCall):
(JSC::CodeOrigin::stackOffset):
(JSC):

• dfg/DFGAssemblyHelpers.h:
• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::get):
(InlineStackEntry):
(JSC::DFG::ByteCodeParser::getScope):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

• dfg/DFGCSEPhase.cpp:

(CSEPhase):
(JSC::DFG::CSEPhase::genericPureCSE):
(JSC::DFG::CSEPhase::pureCSE):
(JSC::DFG::CSEPhase::pureCSERequiringSameInlineCallFrame):
(JSC::DFG::CSEPhase::getMyScopeLoadElimination):
(JSC::DFG::CSEPhase::performNodeCSE):

• dfg/DFGOSRExitCompiler32_64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGOSRExitCompiler64.cpp:

(JSC::DFG::OSRExitCompiler::compileExit):

• dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

• interpreter/CallFrame.cpp:

(JSC::CallFrame::trueCallFrame):

File:

• trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h (modified) (5 diffs)

trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -84 +84 @@
     ExecutableBase* codeOriginOwner() const;
     
+    unsigned stackOffset() const;
+    
     static unsigned inlineDepthForCallFrame(InlineCallFrame*);
     
@@ -99 +101 @@
     Vector<ValueRecovery> arguments;
     WriteBarrier<ExecutableBase> executable;
-    WriteBarrier<JSFunction> callee;
+    WriteBarrier<JSFunction> callee; // This may be null, indicating that this is a closure call and that the JSFunction and JSScope are already on the stack.
     CodeOrigin caller;
     BitVector capturedVars; // Indexed by the machine call frame's variable numbering.
@@ -106 +108 @@
     
     CodeSpecializationKind specializationKind() const { return specializationFromIsCall(isCall); }
+    
+    bool isClosureCall() const { return !callee; }
     
     CodeBlockHash hash() const;
@@ -118 +122 @@
     unsigned callReturnOffset;
 };
+
+inline unsigned CodeOrigin::stackOffset() const
+{
+    if (!inlineCallFrame)
+        return 0;
+    
+    return inlineCallFrame->stackOffset;
+}
 
 inline bool CodeOrigin::operator==(const CodeOrigin& other) const