Changeset 178591 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Jan 16, 2015, 12:40:22 PM (10 years ago)

Author:

[email protected]

Message:

REGRESSION (r174226): Header on huffingtonpost.com is too large
​https://bugs.webkit.org/show_bug.cgi?id=140306

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

BytecodeGenerator::willResolveToArguments() is used to check to see if we can use the
arguments register or whether we need to resolve "arguments". If the arguments have
been captured, then they are stored in the lexical environment and the arguments
register is not used.

Changed BytecodeGenerator::willResolveToArguments() to also check to see if the arguments
register is captured. Renamed the function to willResolveToArgumentsRegister() to
better indicate what we are checking.

Aligned 32 and 64 bit paths in ArgumentsRecoveryGenerator::generateFor() for creating
an arguments object that was optimized out of an inlined callFrame. The 32 bit path
incorrectly calculated the location of the reified callee frame. This alignment resulted
in the removal of operationCreateInlinedArgumentsDuringOSRExit()

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::willResolveToArgumentsRegister):
(JSC::BytecodeGenerator::uncheckedLocalArgumentsRegister):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitConstruct):
(JSC::BytecodeGenerator::emitEnumeration):
(JSC::BytecodeGenerator::willResolveToArguments): Deleted.

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::BracketAccessorNode::emitBytecode):
(JSC::DotAccessorNode::emitBytecode):
(JSC::getArgumentByVal):
(JSC::ApplyFunctionCallDotNode::emitBytecode):
(JSC::ArrayPatternNode::emitDirectBinding):

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::ArgumentsRecoveryGenerator::generateFor):

• dfg/DFGOperations.cpp:

(JSC::operationCreateInlinedArgumentsDuringOSRExit): Deleted.

• dfg/DFGOperations.h:

(JSC::operationCreateInlinedArgumentsDuringOSRExit): Deleted.

LayoutTests:

Updated js/arguments-iterator to test changing argument to array values.
Removed tests that changed arguments to a string and an object as they were
bogus and didn't test what the appeared to test.
for .. of works on iterable objects only.

Added new regression test, js/regress-140306.

• js/arguments-iterator-expected.txt:
• js/regress-140306-expected.txt: Added.
• js/regress-140306.html: Added.
• js/script-tests/arguments-iterator.js:

(testEmptyArrayArguments):
(testArrayArguments):
(testOverwrittenArguments): Deleted.
(testNullArguments): Deleted.
(testNonArrayLikeArguments): Deleted.

• js/script-tests/regress-140306.js: Added.

(checkArgs):
(applyToArgs):

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (5 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -383 +383 @@
 {
     if (m_base->isResolveNode() 
-        && generator.willResolveToArguments(static_cast<ResolveNode*>(m_base)->identifier())
+        && generator.willResolveToArgumentsRegister(static_cast<ResolveNode*>(m_base)->identifier())
         && !generator.symbolTable().slowArguments()) {
         RefPtr<RegisterID> property = generator.emitNode(m_subscript);
@@ -419 +419 @@
             goto nonArgumentsPath;
         ResolveNode* resolveNode = static_cast<ResolveNode*>(m_base);
-        if (!generator.willResolveToArguments(resolveNode->identifier()))
+        if (!generator.willResolveToArgumentsRegister(resolveNode->identifier()))
             goto nonArgumentsPath;
         generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
@@ -600 +600 @@
 {
     if (base->isResolveNode()
-        && generator.willResolveToArguments(static_cast<ResolveNode*>(base)->identifier())
+        && generator.willResolveToArgumentsRegister(static_cast<ResolveNode*>(base)->identifier())
         && !generator.symbolTable().slowArguments()) {
         generator.emitExpressionInfo(divot, divotStart, divotEnd);
@@ -758 +758 @@
         RefPtr<RegisterID> argsRegister;
         ArgumentListNode* args = m_args->m_listNode->m_next;
-        if (args->m_expr->isResolveNode() && generator.willResolveToArguments(static_cast<ResolveNode*>(args->m_expr)->identifier()) && !generator.symbolTable().slowArguments())
+        if (args->m_expr->isResolveNode() && generator.willResolveToArgumentsRegister(static_cast<ResolveNode*>(args->m_expr)->identifier()) && !generator.symbolTable().slowArguments())
             argsRegister = generator.uncheckedLocalArgumentsRegister();
         else
@@ -2777 +2777 @@
 {
     if (rhs->isResolveNode()
-        && generator.willResolveToArguments(static_cast<ResolveNode*>(rhs)->identifier())
+        && generator.willResolveToArgumentsRegister(static_cast<ResolveNode*>(rhs)->identifier())
         && generator.hasSafeLocalArgumentsRegister()&& !generator.symbolTable().slowArguments()) {
         for (size_t i = 0; i < m_targetPatterns.size(); i++) {