Changeset 167963 in webkit for trunk/Source/JavaScriptCore/jsc.cpp

Timestamp:

Apr 29, 2014, 3:21:04 PM (11 years ago)

Author:

[email protected]

Message:

JSProxies should be cacheable
​https://bugs.webkit.org/show_bug.cgi?id=132351

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:
Whenever we encounter a proxy in an inline cache we should try to cache on the
proxy's target instead of giving up.

This patch adds support for a simple "recursive" inline cache if the base object
we're accessing is a pure forwarding proxy. JSGlobalObject and its subclasses
are the only ones to benefit from this right now.

This is performance neutral on the benchmarks we track. Currently we won't
cache on JSDOMWindow due to HasImpureGetOwnPropertySlot, but this issue will be fixed soon.

• jit/Repatch.cpp:

(JSC::generateByIdStub):
(JSC::tryBuildGetByIDList):
(JSC::tryCachePutByID):
(JSC::tryBuildPutByIdList):

• jsc.cpp:

(GlobalObject::finishCreation):
(functionCreateProxy):

• runtime/IntendedStructureChain.cpp:

(JSC::IntendedStructureChain::isNormalized):

• runtime/JSCellInlines.h:

(JSC::JSCell::isProxy):

• runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::finishCreation):

• runtime/JSProxy.h:

(JSC::JSProxy::createStructure):
(JSC::JSProxy::targetOffset):

• runtime/JSType.h:
• runtime/Operations.h:

(JSC::isPrototypeChainNormalized):

• runtime/Structure.h:

(JSC::Structure::isProxy):

• tests/stress/proxy-inline-cache.js: Added.

(cacheOnTarget.getX):
(cacheOnTarget):
(cacheOnPrototypeOfTarget.getX):
(cacheOnPrototypeOfTarget):
(dontCacheOnProxyInPrototypeChain.getX):
(dontCacheOnProxyInPrototypeChain):
(dontCacheOnTargetOfProxyInPrototypeChainOfTarget.getX):
(dontCacheOnTargetOfProxyInPrototypeChainOfTarget):

Source/WebCore:
No new tests.

Whenever we encounter a proxy in an inline cache we should try to cache on the
proxy's target instead of giving up.

This patch adds support for a simple "recursive" inline cache if the base object
we're accessing is a pure forwarding proxy. JSGlobalObject and its subclasses
are the only ones to benefit from this right now.

This is performance neutral on the benchmarks we track. Currently we won't
cache on JSDOMWindow due to HasImpureGetOwnPropertySlot, but this issue will be fixed soon.

• bindings/js/JSDOMWindowShell.h:

(WebCore::JSDOMWindowShell::createStructure):

File:

• trunk/Source/JavaScriptCore/jsc.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/jsc.cpp

@@ -242 +242 @@
 static bool fillBufferWithContentsOfFile(const String& fileName, Vector<char>& buffer);
 
+static EncodedJSValue JSC_HOST_CALL functionCreateProxy(ExecState*);
+
 static EncodedJSValue JSC_HOST_CALL functionSetElementRoot(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionCreateRoot(ExecState*);
@@ -414 +416 @@
         addFunction(vm, "effectful42", functionEffectful42, 0);
         addFunction(vm, "makeMasquerader", functionMakeMasquerader, 0);
+
+        addFunction(vm, "createProxy", functionCreateProxy, 1);
         
         JSArray* array = constructEmptyArray(globalExec(), 0);
@@ -570 +574 @@
     element->setRoot(root);
     return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL functionCreateProxy(ExecState* exec)
+{
+    JSLockHolder lock(exec);
+    JSValue target = exec->argument(0);
+    if (!target.isObject())
+        return JSValue::encode(jsUndefined());
+    JSObject* jsTarget = asObject(target.asCell());
+    Structure* structure = JSProxy::createStructure(exec->vm(), exec->lexicalGlobalObject(), jsTarget->prototype());
+    JSProxy* proxy = JSProxy::create(exec->vm(), structure, jsTarget);
+    return JSValue::encode(proxy);
 }