Changeset 180703 in webkit for trunk/Source/JavaScriptCore/bytecode/ExitKind.h

Timestamp:

Feb 26, 2015, 2:44:45 PM (10 years ago)

Author:

[email protected]

Message:

Various array access corner cases should take OSR exit feedback
​https://bugs.webkit.org/show_bug.cgi?id=142056

Reviewed by Geoffrey Garen.
Source/JavaScriptCore:

Two major changes here:

• Don't keep converting GetById into GetArrayLength if we exited due to any kind of array type check.

• Use a generic form of GetByVal/PutByVal if we exited due to any kind of exotic checks, like the Arguments safety checks. We use the "ExoticObjectMode" for out-of-bounds on arguments for now, since it's a convenient way of forcing out-of-bounds to be handled by the Generic array mode.

• bytecode/ExitKind.cpp:

(JSC::exitKindToString):

• bytecode/ExitKind.h:
• dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
(JSC::DFG::SpeculativeJIT::compileGetArgumentsLength):

• tests/stress/array-length-array-storage-plain-object.js: Added.

(foo):

• tests/stress/array-length-plain-object.js: Added.

(foo):

LayoutTests:

• js/regress/arguments-out-of-bounds-expected.txt: Added.
• js/regress/arguments-out-of-bounds.html: Added.
• js/regress/exit-length-on-plain-object-expected.txt: Added.
• js/regress/exit-length-on-plain-object.html: Added.
• js/regress/script-tests/arguments-out-of-bounds.js: Added.

(foo):
(bar):

• js/regress/script-tests/exit-length-on-plain-object.js: Added.

(foo):

• js/regress/script-tests/string-out-of-bounds.js: Added.

(bar):

• js/regress/string-out-of-bounds-expected.txt: Added.
• js/regress/string-out-of-bounds.html: Added.

File:

• trunk/Source/JavaScriptCore/bytecode/ExitKind.h (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecode/ExitKind.h

@@ -45 +45 @@
     InadequateCoverage, // We exited because we ended up in code that didn't have profiling coverage.
     ArgumentsEscaped, // We exited because arguments escaped but we didn't expect them to.
+    ExoticObjectMode, // We exited because some exotic object that we were accessing was in an exotic mode (like Arguments with slow arguments).
     NotStringObject, // We exited because we shouldn't have attempted to optimize string object access.
     VarargsOverflow, // We exited because a varargs call passed more arguments than we expected.