Changeset 172949 in webkit

Timestamp:

Aug 25, 2014, 7:17:58 PM (11 years ago)

Author:

[email protected]

Message:

Return statement TypeSet's might be duplicated
​https://bugs.webkit.org/show_bug.cgi?id=136200

Patch by Saam Barati <​[email protected]> on 2014-08-25
Reviewed by Filip Pizlo.

Currently, the globalTypeSet that converges the types of all
return statements in a function lives off of CodeBlock. It lives
off CodeBlock because of a faulty assumption that CodeBlock
will have a one to one mapping with a function in the source
text of the program. (Currently, there isn't an actual bug
with this design because TypeLocationCache will hash cons to
the same TypeLocation, but this is still an incorrect design).
In this patch, the globalTypeSet for function return statements
is moved to the FunctionExecutable object which does have a one
to one mapping with functions in the source text of a program.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::CodeBlock):

• bytecode/CodeBlock.h:

(JSC::CodeBlock::returnStatementTypeSet): Deleted.

• runtime/Executable.h:

(JSC::FunctionExecutable::returnStatementTypeSet):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecode/CodeBlock.cpp (modified) (2 diffs)
• bytecode/CodeBlock.h (modified) (3 diffs)
• runtime/Executable.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-08-25  Saam Barati  <[email protected]>
+
+        Return statement TypeSet's might be duplicated
+        https://bugs.webkit.org/show_bug.cgi?id=136200
+
+        Reviewed by Filip Pizlo.
+
+        Currently, the globalTypeSet that converges the types of all 
+        return statements in a function lives off of CodeBlock. It lives 
+        off CodeBlock because of a faulty assumption that CodeBlock 
+        will have a one to one mapping with a function in the source 
+        text of the program. (Currently, there isn't an actual bug 
+        with this design because TypeLocationCache will hash cons to 
+        the same TypeLocation, but this is still an incorrect design). 
+        In this patch, the globalTypeSet for function return statements  
+        is moved to the FunctionExecutable object which does have a one 
+        to one mapping with functions in the source text of a program.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::returnStatementTypeSet): Deleted.
+        * runtime/Executable.h:
+        (JSC::FunctionExecutable::returnStatementTypeSet):
+
 2014-08-24  Filip Pizlo  <[email protected]>
 

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1707 +1707 @@
     , m_optimizationDelayCounter(0)
     , m_reoptimizationRetryCounter(0)
-    , m_returnStatementTypeSet(nullptr)
 #if ENABLE(JIT)
     , m_capabilityLevelState(DFG::CapabilityLevelNotSet)
@@ -2044 +2043 @@
             }
             case ProfileTypeBytecodeFunctionReturnStatement: {
-                globalTypeSet = returnStatementTypeSet();
+                RELEASE_ASSERT(ownerExecutable->isFunctionExecutable());
+                globalTypeSet = jsCast<FunctionExecutable*>(ownerExecutable)->returnStatementTypeSet();
                 globalVariableID = TypeProfilerReturnStatement;
                 if (!shouldAnalyze) {

trunk/Source/JavaScriptCore/bytecode/CodeBlock.h

@@ -65 +65 @@
 #include "RegExpObject.h"
 #include "StructureStubInfo.h"
-#include "TypeSet.h"
 #include "UnconditionalFinalizer.h"
 #include "ValueProfile.h"
@@ -943 +942 @@
 
     bool isKnownToBeLiveDuringGC(); // Will only return valid results when called during GC. Assumes that you've already established that the owner executable is live.
-    RefPtr<TypeSet> returnStatementTypeSet() 
-    {
-        if (!m_returnStatementTypeSet)
-            m_returnStatementTypeSet = TypeSet::create();
-
-        return m_returnStatementTypeSet;
-    }
 
 
@@ -1100 +1092 @@
     std::unique_ptr<BytecodeLivenessAnalysis> m_livenessAnalysis;
 
-    RefPtr<TypeSet> m_returnStatementTypeSet;
-
     struct RareData {
         WTF_MAKE_FAST_ALLOCATED;

trunk/Source/JavaScriptCore/runtime/Executable.h

@@ -41 +41 @@
 #include "SamplingTool.h"
 #include "SourceCode.h"
+#include "TypeSet.h"
 #include "UnlinkedCodeBlock.h"
 #include <wtf/PassOwnPtr.h>
@@ -613 +614 @@
         return baselineCodeBlockFor(kind);
     }
+
+    RefPtr<TypeSet> returnStatementTypeSet() 
+    {
+        if (!m_returnStatementTypeSet)
+            m_returnStatementTypeSet = TypeSet::create();
+
+        return m_returnStatementTypeSet;
+    }
         
     FunctionMode functionMode() { return m_unlinkedExecutable->functionMode(); }
@@ -660 +669 @@
     bool m_bodyIncludesBraces;
     bool m_didParseForTheFirstTime;
+    RefPtr<TypeSet> m_returnStatementTypeSet;
 };