Changeset 174606 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Oct 10, 2014, 12:03:20 PM (11 years ago)

Author:

[email protected]

Message:

Various arguments optimisations in codegen fail to account for arguments being in lexical record
​https://bugs.webkit.org/show_bug.cgi?id=137617

Reviewed by Michael Saboff.

Rework the way we track |arguments| references so that we don't try
to use the |arguments| reference on the stack if it's not safe.

To do this without nuking performance it was necessary to update
the parser to track modification of the |arguments| reference
itself.

• bytecode/CodeBlock.cpp:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::willResolveToArguments):
(JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitConstruct):
(JSC::BytecodeGenerator::emitEnumeration):
(JSC::BytecodeGenerator::uncheckedRegisterForArguments): Deleted.

• bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::hasSafeLocalArgumentsRegister):

• bytecompiler/NodesCodegen.cpp:

(JSC::BracketAccessorNode::emitBytecode):
(JSC::DotAccessorNode::emitBytecode):
(JSC::getArgumentByVal):
(JSC::CallFunctionCallDotNode::emitBytecode):
(JSC::ApplyFunctionCallDotNode::emitBytecode):
(JSC::ArrayPatternNode::emitDirectBinding):

• interpreter/StackVisitor.cpp:

(JSC::StackVisitor::Frame::existingArguments):

• parser/Nodes.h:

(JSC::ScopeNode::modifiesArguments):

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseInner):

• parser/Parser.h:

(JSC::Scope::getCapturedVariables):

• parser/ParserModes.h:

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (7 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -387 +387 @@
         RegisterID* property = generator.emitNode(m_subscript);
         generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
-        return generator.emitGetArgumentByVal(generator.finalDestination(dst), generator.uncheckedRegisterForArguments(), property);
+        return generator.emitGetArgumentByVal(generator.finalDestination(dst), generator.uncheckedLocalArgumentsRegister(), property);
     }
 
@@ -413 +413 @@
             goto nonArgumentsPath;
         generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
-        return generator.emitGetArgumentsLength(generator.finalDestination(dst), generator.uncheckedRegisterForArguments());
+        return generator.emitGetArgumentsLength(generator.finalDestination(dst), generator.uncheckedLocalArgumentsRegister());
     }
 
@@ -594 +594 @@
         && !generator.symbolTable().slowArguments()) {
         generator.emitExpressionInfo(divot, divotStart, divotEnd);
-        return generator.emitGetArgumentByVal(generator.finalDestination(dst), generator.uncheckedRegisterForArguments(), property);
+        return generator.emitGetArgumentByVal(generator.finalDestination(dst), generator.uncheckedLocalArgumentsRegister(), property);
     }
     return nullptr;
@@ -622 +622 @@
             RefPtr<RegisterID> argumentsRegister;
             if (thisRegister)
-                argumentsRegister = generator.uncheckedRegisterForArguments();
+                argumentsRegister = generator.uncheckedLocalArgumentsRegister();
             else {
                 argumentsRegister = generator.emitNode(subject);
@@ -750 +750 @@
         ArgumentListNode* args = m_args->m_listNode->m_next;
         if (args->m_expr->isResolveNode() && generator.willResolveToArguments(static_cast<ResolveNode*>(args->m_expr)->identifier()) && !generator.symbolTable().slowArguments())
-            argsRegister = generator.uncheckedRegisterForArguments();
+            argsRegister = generator.uncheckedLocalArgumentsRegister();
         else
             argsRegister = generator.emitNode(args->m_expr);
@@ -2722 +2722 @@
     if (rhs->isResolveNode()
         && generator.willResolveToArguments(static_cast<ResolveNode*>(rhs)->identifier())
-        && !generator.symbolTable().slowArguments()) {
+        && generator.hasSafeLocalArgumentsRegister()&& !generator.symbolTable().slowArguments()) {
         for (size_t i = 0; i < m_targetPatterns.size(); i++) {
             auto target = m_targetPatterns[i];
@@ -2730 +2730 @@
             RefPtr<RegisterID> temp = generator.newTemporary();
             generator.emitLoad(temp.get(), jsNumber(i));
-            generator.emitGetArgumentByVal(temp.get(), generator.uncheckedRegisterForArguments(), temp.get());
+            generator.emitGetArgumentByVal(temp.get(), generator.uncheckedLocalArgumentsRegister(), temp.get());
             target->bindValue(generator, temp.get());
         }